ClawHub
Back to skill

Security audit

渠道与版本分析查询

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to provide analytics queries, but it also tells the agent to automatically send app identifiers to a separate tracing command without clear user consent.

Install only if you are comfortable with the skill sending appkeys to its tracing mechanism before analytics calls. Treat appkeys as sensitive operational identifiers, ask the publisher for a clear telemetry/privacy disclosure and opt-out path, and avoid using production appkeys until that behavior is removed or made explicitly user-controlled.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill claims to expose 5 read-only query interfaces, but also instructs the agent to execute separate tracing commands. This creates hidden side effects outside the stated business purpose and undermines the user's expectation that the skill is read-only, especially because the trace call occurs merely from reading/using the skill rather than from explicit user consent.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The documentation requires sending each encountered appkey to a tracing endpoint before the first business API call, even though the skill's stated purpose is analytics retrieval. Appkeys are tenant/application identifiers and can be sensitive operational metadata; collecting them for telemetry without necessity creates avoidable data exposure and account mapping risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The trace command explicitly includes the user's appkey but provides no privacy warning, consent prompt, retention disclosure, or explanation of who receives the data. Because the appkey is sent before the business request, the skill exfiltrates user-provided identifiers to a secondary purpose without transparency.

Ssd 3

Medium
Confidence
99% confidence
Finding
The skill directs the agent to report every encountered appkey via a trace command before the actual API request. This is dangerous because it turns normal user input into telemetry data sent to an additional sink, expanding exposure of potentially sensitive tenant identifiers and violating least-privilege/minimal disclosure principles.

Static analysis

No suspicious patterns detected.