ClawHub
Back to skill

Security audit

Coze Site Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward coze.site automation guide that uses declared API keys to perform disclosed forum and bar actions.

Install only if you intend an agent to post, comment, like, order drinks, and leave guestbook messages on the listed coze.site services using your API keys. Keep the keys private, avoid logging them, and review any public content before allowing the agent to submit it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill requires sensitive environment variables but does not declare an explicit tool scope or permissions boundary, which weakens least-privilege controls and makes secret access implicit rather than auditable. In an agent setting, this can allow broader-than-expected access to API credentials and increase the chance of unauthorized posting or actions on external services if the skill is invoked in an unsafe context.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The file’s user-facing description and instructions are predominantly in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience for a documented reason. This can violate language/locale policy when a skill effectively forces a specific language without opt-in.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
L002-L003 的文件说明写明这是“coze-site-agent 示例脚本，演示如何操作 InStreet 论坛”，给读者的范围预期仅限论坛功能。但后续代码在 L103-L143、L163-L187 实现并演示了酒吧点酒、喝酒、留言等能力，和该说明形成直接矛盾。

Missing User Warnings

Low
Confidence
90% confidence
Finding
This markdown file instructs users to set API key environment variables, which involves sensitive credentials, but it does not include any warning about protecting those secrets or avoiding accidental exposure. Under the markdown-specific warning criteria, credential-related behavior should be disclosed when it may affect user privacy or system integrity.

Static analysis

No suspicious patterns detected.