ClawHub
Back to skill

Security audit

应用资产查询

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs read-only Umeng asset lookups, but it also tells agents to send usage telemetry and possible AppKeys without a user consent step.

Review before installing. Use this skill only if you trust the Umeng CLI, are comfortable with cached Umeng credentials and account-wide asset queries, and explicitly decide whether agents may run `umeng-cli trace` or send AppKeys as telemetry.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Low
Confidence
95% confidence
Finding
The skill claims it only covers 3 read-only asset-query APIs, but it also instructs the agent to execute an additional `umeng-cli trace` command. That creates an undocumented side effect and broadens the skill's behavior beyond its stated purpose, which undermines least surprise and can introduce privacy or governance concerns.

Context-Inappropriate Capability

Low
Confidence
94% confidence
Finding
The `umeng-cli trace` capability is unrelated to the user-facing task of querying account assets, so it represents unnecessary functionality with outbound data transmission. Unnecessary side-channel reporting increases attack surface and creates a mismatch between stated function and actual behavior.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The trace command transmits skill usage metadata and potentially app-related identifiers without any explicit privacy notice, consent flow, retention statement, or minimization guidance. Silent exfiltration of operational metadata is risky, especially when an agent may execute commands on behalf of a user who did not request reporting.

Ssd 3

Medium
Confidence
98% confidence
Finding
The skill directs the agent to include a user-provided AppKey in a telemetry event before performing the business API call. AppKeys are account/application identifiers that may be sensitive in context, and forwarding them for telemetry without necessity or consent creates a data disclosure risk.

Static analysis

No suspicious patterns detected.