Mbti Master

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

The MBTI tools mostly run locally, but the package also includes unsafe installation instructions, a plaintext ClawHub token, and publishing scripts with account and repository side effects.

Review before installing. Do not run the documented curl-to-bash installer, do not use the exposed ClawHub token, and avoid the publishing scripts unless you are the maintainer and have reviewed the target account, repository, branch, and release artifacts. Prefer a verified ClawHub install or a signed/checksummed release archive.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: INSTALL.md:13

Finding

Unverified Remote Installer Is Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md:13
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash

curl -fsSL https://your-domain.com/mbti-master/install.sh | bash

Technical Analysis

The installation guide pipes an HTTPS response directly into Bash. The downloaded script is not pinned to an immutable version and is not authenticated with a cryptographic signature or checksum. Users also have no opportunity to inspect the content before it executes.

The placeholder host is not demonstrated to be a trusted canonical project source. Control or compromise of the domain, hosting account, TLS endpoint, or deployment pipeline would allow the effective installer payload to be changed after the reviewed Skill package was published.

Direct remote shell execution is unnecessary for the declared offline MBTI functionality. The Skill only needs local Bash scripts and static data, so this installation mechanism exceeds the minimum capabilities required.

Attack Path

1. An attacker obtains control of your-domain.com, compromises its hosting infrastructure, or changes the file served as install.sh.
2. The attacker replaces the installer with commands that steal files, modify shell configuration, install persistence, or download further payloads.
3. A user follows the documented installation command.
4. curl retrieves the attacker-controlled response.
5. Bash immediately executes that response with all privileges available to the installing user.

Impact Assessment

Successful exploitation provides arbitrary command execution as the user running the installer. The attacker could read or alter user-accessible files, steal credentials, modify Agent Skills, install persistence, or execute additional payloads.

The command does not contain sudo, so root access is not automatically obtained. However, the scop ...[truncated 102 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the pipe-to-shell installation method.
• Publish a versioned archive through the canonical project repository.
• Publish a SHA-256 checksum and, preferably, a signature created with a separately managed signing key.
• Require users to download the artifact, verify its checksum or signature, inspect its contents, and only then install it.
• Pin installation instructions to an immutable release tag or commit.
• If an installer remains necessary, distribute it as a reviewable file and never execute a mutable network response directly.

T09 · Insecure Skill Coding Practices

Error

• Location: REMINDER_PUBLISH.md:18

Finding

ClawHub Authentication Token Is Committed in Plaintext

Content

View full analysis

Vulnerability Details

File Location: REMINDER_PUBLISH.md:18
Vulnerability Type: Hardcoded authentication secret
Risk Level: High

bash

clawhub login --token clh_Blbq6yXG9H9z1HtoogcuAePHMtO9irQfH7uVBGo3w_4

Technical Analysis

A credential-shaped ClawHub token is embedded directly in a tracked documentation file. Anyone who can read the project or its repository history can copy the token and attempt to authenticate with it.

Passing the token as a command-line argument creates additional exposure because commands can be retained in shell history and may be visible through process inspection while running. The surrounding document describes token expiration and regeneration, confirming that the value is intended to function as authentication material.

Whether the token remains active cannot be established through static analysis. Nevertheless, committed credentials must be treated as compromised.

Attack Path

1. An attacker obtains a copy of the project or reads its public repository history.
2. The attacker extracts the token from REMINDER_PUBLISH.md.
3. The attacker supplies the token to the ClawHub CLI or relevant service API.
4. If the token remains valid, the attacker performs operations allowed by its assigned scope.
5. Depending on those permissions, the attacker may publish or alter Skill releases under the account owner's identity.

Impact Assessment

The maximum impact depends on the token's validity and scope. A valid publishing token could permit unauthorized account access, malicious Skill publication, release modification, or supply-chain compromise affecting downstream users.

This finding does not establish access to the host operating system or root privileges. Its direct scope is the associated ClawHub account and resources authorized to the token.

Remediation

View remediation

Remediation Suggestions

• Revoke the exposed token immediately and generate a replacement with the narrowest possible scope.
• Remove the token from the current project and purge it from repository history where feasible.
• Review account and publication logs for unauthorized use.
• Store replacement credentials in an approved secret manager or protected environment variable.
• Prefer interactive authentication that does not place secrets in documentation or shell history.
• Add automated secret scanning and pre-commit checks to prevent recurrence.

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:20

Finding

Executable Skill Archives Are Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Locations:

• INSTALL.md:20-26
• README.md:56-58
• GITHUB_PUBLISH.md:169-172

Vulnerability Type: Unverified executable dependency or release artifact
Risk Level: Medium

bash

wget https://your-domain.com/mbti-master/mbti-master.skill.tar.gz

tar -xzf mbti-master.skill.tar.gz -C ~/.openclaw/skills/

chmod -R +x ~/.openclaw/skills/mbti-master/scripts/

bash

wget https://github.com/yourusername/mbti-master/releases/download/v1.0.0/mbti-master.skill.tar.gz
tar -xzf mbti-master.skill.tar.gz -C ~/.openclaw/skills/
chmod -R +x ~/.openclaw/skills/mbti-master/scripts/

bash

curl -L https://github.com/yourusername/mbti-master/releases/download/v1.0.0/mbti-master-v1.0.0.tar.gz -o mbti-master.tar.gz
tar -xzf mbti-master.tar.gz
bash scripts/quick_test.sh

Technical Analysis

The installation and release-validation instructions download archives from placeholder or personal publishing locations without verifying a checksum or cryptographic signature. The contents are then extracted and, in the installation workflows, scripts are made executable.

HTTPS protects transport under normal conditions but does not establish that a mutable release artifact is the exact artifact reviewed by auditors. Compromise of the hosting account, repository, release pipeline, or placeholder domain could replace the archive with modified scripts or Skill instructions.

The extraction commands also do not validate archive member paths before extraction. A malicious archive could contain unexpected paths, including parent-directory traversal entries, depending on the extraction tool and platform protections.

Attack Path

1. An attacker compromises the release account, hosting service, placeholder domain, or artifact-generation pipeline.
2. The attacker replaces the expected archive with one containing modified Skill ...[truncated 822 chars]

Remediation

View remediation

Remediation Suggestions

• Replace placeholder URLs with the documented canonical repository and release owner.
• Publish immutable, versioned artifacts together with SHA-256 checksums and cryptographic signatures.
• Require checksum or signature verification before extraction or execution.
• Inspect archive member names and reject absolute paths, symbolic-link escapes, and parent-directory traversal entries.
• Extract into a newly created staging directory before copying reviewed files into the Skill directory.
• Grant execute permission only to an explicit allowlist of expected scripts rather than using recursive chmod.
• Document the expected archive digest and file manifest for each release.

T09 · Insecure Skill Coding Practices

Warning

• Location: publish-to-github.sh:84

Finding

Publishing Helper Automatically Falls Back to Force-Pushing the Main Branch

Content

View full analysis

Vulnerability Details

File Location: publish-to-github.sh:84-85
Vulnerability Type: Unsafe destructive repository operation
Risk Level: Medium

bash

if ! git push -u origin main 2>/dev/null; then
    git push -f origin main
fi

Technical Analysis

The publishing helper treats every ordinary push failure as authorization to perform an unconditional force-push. It does not distinguish a non-fast-forward rejection from authentication failure, branch protection, an incorrect remote, network failure, or another operational error.

A force-push can replace the remote branch history. The script suppresses the first push's error output, making it harder for the operator to understand why the fallback was triggered. Automatically rewriting history is not required to publish this Skill and violates a safe least-destructive workflow.

Attack Path

1. The operator runs the publishing helper in a repository connected to an existing main branch.
2. The local and remote histories have diverged, or the initial push fails for another reason.
3. The script suppresses the original error and automatically executes git push -f origin main.
4. If the remote accepts force-pushes, its main branch is replaced with the local branch state.
5. Remote commits not present locally become unreachable through the branch and may be lost from the normal project history.

Impact Assessment

The operation can overwrite remote repository history and remove collaborators' commits from the main branch. It could also publish unintended local content if the helper is run from the wrong working directory or against an incorrectly configured remote.

The impact is limited by the authenticated user's GitHub permissions and branch protection settings. It does not itself grant additional privileges, but it can destructively exercise already-authorized repository write access.

Remediation

View remediation

Remediation Suggestions

• Remove the automatic force-push fallback.
• Preserve and display the original push error, then terminate with a nonzero status.
• Validate the current working directory, remote URL, repository owner, and target branch before publishing.
• Require explicit operator confirmation before any history-rewriting operation.
• If rewriting is intentionally required, use --force-with-lease rather than --force and verify the expected remote commit first.
• Enable branch protection for the main branch and require pull-request-based updates where appropriate.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (49)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · GITHUB_PUBLISH.md (reported line 20)May include surrounding context.

Linux:

bash

# Debian/Ubuntu
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
sudo apt update

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · GITHUB_PUBLISH.md (reported line 21)May include surrounding context.

Linux:

bash

# Debian/Ubuntu
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
sudo apt update

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · GITHUB_PUBLISH.md (reported line 22)May include surrounding context.

Linux:

bash

# Debian/Ubuntu
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
sudo apt update

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · GITHUB_PUBLISH.md (reported line 20)May include surrounding context.

Linux:

bash

# Debian/Ubuntu
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
sudo apt update

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · GITHUB_PUBLISH.md (reported line 22)May include surrounding context.

Linux:

bash

# Debian/Ubuntu
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
sudo apt update

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · GITHUB_PUBLISH.md (reported line 33)May include surrounding context.

gh auth login

text

- 按提示选择：GitHub.com → HTTPS → 浏览器登录
- 或选择Token方式（如果你生成了Personal Access Token）

---

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The install command fetches a script from an external domain and executes it immediately, giving that remote content full authority to run arbitrary commands on the system. In the context of a simple MBTI skill, such behavior is unnecessary and disproportionately dangerous because users would not expect personality-test tooling to require blind remote code execution.

Content

Scanner excerpt · INSTALL.md (reported line 13)May include surrounding context.

bash

# 下载并安装
curl -fsSL https://your-domain.com/mbti-master/install.sh | bash

方法2：手动安装

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The pipeline chains network retrieval directly into shell execution, removing any opportunity for inspection or integrity validation between fetch and execution. This increases the blast radius of any compromise of the remote source and is especially risky in installer documentation because users may copy-paste it without scrutiny.

Content

Scanner excerpt · INSTALL.md (reported line 13)May include surrounding context.

bash

# 下载并安装
curl -fsSL https://your-domain.com/mbti-master/install.sh | bash

方法2：手动安装

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 75)May include surrounding context.

卸载

bash

rm -rf ~/.openclaw/skills/mbti-master

更新日志

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 75)May include surrounding context.

卸载

bash

rm -rf ~/.openclaw/skills/mbti-master

更新日志

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file contains a plaintext ClawHub authentication token embedded in publish instructions. Exposing reusable credentials in repository content enables unauthorized access to the associated ClawHub account and publication actions, and this capability is unrelated to an MBTI analysis skill, which increases suspicion and risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Publishing a live authentication token in Markdown without any sensitivity warning or protection creates direct credential leakage. Anyone with access to the file can use the token to authenticate as the publisher, potentially publishing, modifying, or managing skills under that account.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is an MBTI personality analysis and interactive MBTI tool. The supplied code does not implement any MBTI-related functionality at all. Instead, it is a release automation script for publishing a skill named 'mbti-master' to ClawHub. Its behavior is operational/devops-oriented: checking for the clawhub command, verifying authentication, validating packaging, prompting for confirmation, and running 'clawhub publish'. This is a materially different primary purpose and includes undeclared capabilities related to deployment and account/login checks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an MBTI analysis application for personality exploration, but the supplied code chunk is purely a deployment/publishing helper script for GitHub. Its primary purpose is repository setup and release automation, not personality testing, analysis, compatibility, or games. This is a material mismatch in behavior and capabilities. While the release notes mention MBTI features, the code itself does not implement them; it performs GitHub publishing operations instead.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code chunk is related to the declared MBTI domain, specifically cognitive function education, but it implements only a narrow subset of the claimed functionality. It does not perform personality testing, compatibility analysis, or interactive games, and it is not a comprehensive analysis tool in itself. Since the declared description presents a broader, multi-feature tool while the supplied code chunk only outputs static explanatory content about cognitive functions, the description does not accurately represent this code chunk's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad, multi-feature MBTI analysis product, but the provided code chunk is limited to a single compatibility-report script. It accepts two MBTI types, normalizes them, looks up a hardcoded compatibility score for a few pairings with a default fallback, compares each of the four MBTI letters, and prints relationship guidance. There is no personality test, no cognitive function analysis, no broader 16-personality exploration, and no game-related functionality. While compatibility matching is one stated feature, the actual code does not substantiate the overall declared purpose, so the description materially overstates what this code chunk does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose promises MBTI personality analysis features such as quick testing, cognitive function analysis, compatibility matching, and trending MBTI games. However, the supplied code does none of these. Instead, it generates a daily 'fortune' for a provided MBTI label using the current date and a checksum-derived seed, then outputs pseudo-random advice and lucky items/colors. This is materially different from analytical MBTI functionality and introduces an undeclared horoscope-like capability. The only overlap is superficial use of an MBTI type string as input.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad, comprehensive MBTI analysis product with multiple major capabilities: testing, cognitive function analysis, compatibility matching, and games. The supplied code chunk implements only one narrow feature: a command-line MBTI guessing game. It does not analyze the user's personality, compute or infer an MBTI type, provide cognitive function explanations, perform compatibility checks, or offer a wider suite of tools. While 'MBTI-related interactive games' is mentioned in the description, the code's actual primary purpose is much narrower than the declared purpose, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a broad, comprehensive MBTI suite, but this specific code chunk only implements the quick testing portion. It does not perform cognitive function analysis, compatibility matching, or any game functionality. More importantly, the script writes test results to $HOME/.mbti-results/test_history.csv, which is a capability involving local file persistence that is not reflected in the declared permissions section. While referencing other scripts is consistent with a larger MBTI tool, the supplied code chunk itself is narrower than the declared functionality and includes undeclared local storage behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code chunk is clearly MBTI-related and does include cognitive function analysis and personality descriptions, so it partially aligns with the declared theme. However, the description presents a broader, comprehensive tool with quick testing, compatibility matching, and interactive MBTI games. This code chunk does not administer a test, compute compatibility, or provide games; it only formats prewritten information for a supplied MBTI type and references another script for compatibility. Because the declared purpose materially overstates the capabilities present in this code chunk, this should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a broad MBTI tool with multiple interactive and analytical features. The supplied code chunk only renders a formatted static cheat sheet of the 16 MBTI types and short descriptions in the terminal. It does not collect user input, perform tests, analyze cognitive functions, calculate compatibility, or provide games. While it is related to MBTI, its actual behavior is much narrower and materially different from the declared comprehensive functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file contains direct external publishing capability through GitHub CLI and git commands, including repo creation and release publishing, with network-side effects not justified by an MBTI personality tool. This mismatch between declared purpose and actual capability makes the skill more dangerous because users may trust it as harmless content analysis tooling while it includes software supply-chain and exfiltration-adjacent publication actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script automates repository initialization, remote creation, force-push behavior, tagging, tarball creation, and GitHub release publication, which is unrelated to the stated MBTI-analysis purpose of the skill. In a skill package, bundling deployment automation expands capability beyond expected behavior and could cause accidental code publication or repository modification if a user runs it without understanding the consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese, including setup, publishing, and troubleshooting guidance. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the regional constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · GITHUB_PUBLISH.md (reported line 20)May include surrounding context.

Linux:

bash

# Debian/Ubuntu
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
sudo apt update