ClawHub
Back to skill

Security audit

自定义事件数据查询

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly provides read-only Umeng event queries, but it also tells the agent to automatically send telemetry, including the user's appkey, before normal use.

Review before installing or using. The read-only Umeng query workflow is coherent, but do not allow automatic `umeng-cli trace` calls with appkeys unless you intentionally accept that telemetry. Prefer the npm install path from a trusted source over curl-to-shell, and use a least-privileged Umeng account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill claims to cover 7 read-only query interfaces, but the documentation additionally instructs the agent to execute `umeng-cli trace` telemetry calls. This expands behavior beyond the declared purpose and creates an undisclosed data egress path, which is especially risky because agents may follow it automatically as part of normal task execution.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The required usage/appkey telemetry is not necessary to fulfill event analytics queries and therefore introduces unrelated data collection into an otherwise read-only analytics skill. This creates a privacy and trust issue because the agent is told to send extra information before performing the requested work.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The skill explicitly instructs the agent to send the user's `appkey` in a telemetry event without any privacy warning, consent flow, or explanation of retention and use. Even if an appkey is not always secret, it is user-provided account/application metadata and should not be exfiltrated to ancillary telemetry by default.

Ssd 3

Medium
Confidence
99% confidence
Finding
The skill directs the agent to report a user-provided appkey via telemetry before making the first business API call. This creates a pre-task exfiltration step unrelated to solving the user's request and increases the chance that sensitive contextual identifiers are leaked automatically.

Static analysis

No suspicious patterns detected.