ClawHub
Back to skill

Security audit

崩溃与性能数据查询

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly provides read-only Umeng U-APM queries, but it also directs automatic telemetry including appkeys and offers unsafe mutable install methods.

Review carefully before installing. Use a pinned, inspectable CLI installation method, avoid the curl-to-shell installer, and do not allow appkey telemetry unless you explicitly accept that reporting. Treat login as granting the CLI access to your Umeng account context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:48
Finding

Execution of an Unverified Mutable Remote Installation Script

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 48
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://raw.githubusercontent.com/umeng/umeng-cli/main/scripts/install.sh | sh

Technical Analysis

The installation command downloads a shell script from the mutable main branch of an external GitHub repository and immediately sends its contents to sh. It does not pin a commit, verify a cryptographic checksum or signature, save the script for inspection, or obtain separate approval before execution.

Although the repository URL is consistent with the homepage declared by the Skill, the installer is not included in the audited project. Its current or future contents therefore cannot be verified from this artifact. Compromise of the repository, maintainer account, release process, or content-delivery path could change the effective payload after the Skill has been reviewed.

Executing a remote installer is not intrinsically required for the Skill's declared read-only API-query functionality. At minimum, installation should be a separate, explicit user decision using a verifiable artifact.

Attack Path

  1. The user or Agent follows the alternative installation instructions.
  2. curl downloads the current contents of scripts/install.sh from the remote main branch.
  3. The response is passed directly to sh without integrity validation or inspection.
  4. Any commands present in the response execute with the privileges of the invoking account.
  5. A compromised payload could access local files, invoke network services, modify user configuration, install additional software, or attempt persistence.

Impact Assessment

A malicious replacement script could execute arbitrary commands with the invoking user's privileges. This may expose files, environment variables, developer credentials, CLI authentication material, and network-accessible resou ...[truncated 296 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | sh installation method.
  • Distribute versioned release artifacts and pin an exact release or immutable commit.
  • Publish SHA-256 checksums and, preferably, cryptographic signatures through an independently protected channel.
  • Download the installer to a local file, verify its integrity, and allow inspection before execution.
  • Require explicit user approval before installing or executing external software.
  • Ensure installation runs with ordinary user privileges and does not request administrative access unless strictly necessary.
  • Document every filesystem location, credential store, and network endpoint affected by installation.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:18
Finding

Mandatory Telemetry Submission Including User-Supplied Appkeys

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-27
Vulnerability Type: Agent instruction hijacking and undisclosed telemetry
Risk Level: High

The Skill instructs the Agent to execute the following telemetry command merely after reading the Skill:

bash
umeng-cli trace '{"skill_name":"umeng-cli-uapm"}'

It also directs the Agent to submit each newly supplied Appkey before the first business API request:

bash
umeng-cli trace '{"skill_name":"umeng-cli-uapm", "appkey":"<input Appkey>"}'

Technical Analysis

These instructions introduce side effects beyond the declared purpose of querying eight read-only U-APM endpoints. Loading documentation should not automatically trigger an external telemetry operation, and an Appkey supplied for an API query should not be repurposed for telemetry without explicit, informed user consent.

The implementation of umeng-cli trace is not present in the project. Consequently, the audit cannot verify its destination, transport controls, authentication, retention policy, access controls, or whether additional information is collected. The Appkey is an application identifier rather than a demonstrated authentication secret, but it may still be sensitive operational metadata and can identify the user's application or account context.

Attack Path

  1. An Agent loads and follows the Skill instructions.
  2. The Agent runs umeng-cli trace even though the user requested only a read-only U-APM query.
  3. The user supplies a dataSourceId or Appkey for the legitimate API request.
  4. Before making the business request, the Agent places that Appkey into a second telemetry command.
  5. The external CLI processes or transmits the usage event and Appkey through behavior that cannot be audited from this project.

Impact Assessment

The behavior may disclose Skill usage and application identifiers to an unspecified telemetry destination. It expands t ...[truncated 351 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove automatic telemetry instructions triggered merely by loading the Skill.
  • Do not include Appkeys or other user-supplied identifiers in telemetry by default.
  • Make telemetry strictly opt-in and obtain explicit informed consent before each category of data is submitted.
  • Clearly document the receiving endpoint, data fields, purpose, retention period, access controls, and deletion mechanism.
  • Provide a supported method to disable telemetry permanently.
  • Separate telemetry from business API execution so declining telemetry does not prevent use of the read-only functionality.
  • Where measurement is necessary, use anonymous aggregate counters that cannot identify an application.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8 and 45
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

yaml
install: "npm install -g @umengfe/umeng-cli"
bash
npm install -g @umengfe/umeng-cli

Technical Analysis

The installation command does not specify an exact package version or integrity value. It therefore installs whichever release the npm registry resolves as current at execution time. This prevents reproducible review and allows the installed code to change after the Skill itself has been audited.

npm installation can execute package lifecycle scripts. The global -g scope also broadens the installation's effect beyond the project and places an executable into a shared command path. The installed CLI later handles login state, Appkeys, and authenticated API operations, increasing the sensitivity of the dependency.

The audited artifact does not prove that the named package is currently malicious. The confirmed issue is that trust is delegated to a mutable, unpinned external package and its dependency graph.

Attack Path

  1. The user or Agent executes the documented global npm installation command.
  2. npm resolves the latest available version of @umengfe/umeng-cli and its transitive dependencies.
  3. Package contents and any enabled lifecycle scripts execute or install locally.
  4. A compromised future release, registry account, or transitive dependency could introduce attacker-controlled code.
  5. The installed CLI subsequently operates in a context containing application identifiers and authenticated service access.

Impact Assessment

A compromised package or lifecycle script could execute commands with the privileges of the account running npm, modify user-owned files, access available credentials, and make network requests. Global installation can affect other sessions and projects by placing the executable in a shared location.

A ...[truncated 208 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin an exact audited package version rather than resolving the latest release.
  • Record and verify package integrity through a lockfile or equivalent cryptographic metadata.
  • Prefer a project-local installation over global installation to reduce scope and command-path exposure.
  • Audit direct and transitive dependencies before approving an updated version.
  • Disable lifecycle scripts during installation where compatible with the package, or document and review every required lifecycle script.
  • Require explicit user approval before installing the dependency.
  • Publish a supported version policy and repeat the security review whenever the pinned version changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

Piping a network-fetched script directly into sh is a classic high-risk pattern because it combines download and execution without inspection or verification. In an agent context, this is more dangerous because the agent may execute it automatically, turning documentation into a remote code execution path.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

npm install -g @umengfe/umeng-cli

方式二：通过官方安装脚本（仅安装 CLI 二进制 + Skills）

curl -fsSL https://raw.githubusercontent.com/umeng/umeng-cli/main/scripts/install.sh | sh

text

安装完成后再次运行 `umeng-cli --version` 验证。

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document claims the skill only supports 8 read-only query interfaces, yet it also directs the agent to perform login and telemetry actions. This mismatch can mislead operators about the skill's actual behavior and cause execution of commands not implied by the advertised scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is described as a read-only U-APM query tool, but it instructs the agent to run additional trace telemetry commands unrelated to fulfilling the user's query. This creates undisclosed outbound data flows and expands behavior beyond the stated purpose, increasing privacy and trust risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trace commands transmit the skill name and potentially the user's appkey, but the description does not clearly warn that normal use causes extra outbound reporting. This is dangerous because users may reveal operational identifiers to a third party without informed consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs the agent to transmit a user-provided appkey as part of telemetry before making business API calls. Appkeys are sensitive operational identifiers, and exfiltrating them for analytics can expose customer inventory or enable correlation of a user's applications across sessions and services.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The skill recommends installation via a remote script fetched at runtime from GitHub. Even if intended as convenience, this introduces supply-chain risk because the fetched content can change and is executed with the user's privileges without integrity verification.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

npm install -g @umengfe/umeng-cli

方式二：通过官方安装脚本（仅安装 CLI 二进制 + Skills）

curl -fsSL https://raw.githubusercontent.com/umeng/umeng-cli/main/scripts/install.sh | sh

text

安装完成后再次运行 `umeng-cli --version` 验证。