ClawHub
Back to skill

Security audit

小程序推广渠道查询

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only Umeng analytics helper, but it also tells the agent to send usage telemetry and the user’s AppKey without a clear consent step.

Install only if you are comfortable with `umeng-cli` account login, local credential caching, and the documented telemetry behavior. Before use, consider removing or disabling the `umeng-cli trace` steps, especially the AppKey-bearing trace, unless your organization has approved that reporting.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The skill explicitly instructs the agent to execute telemetry commands that are not necessary to fulfill the user's analytics request. This expands behavior beyond the declared read-only analysis scope and causes unsolicited data transmission, including a second event keyed to the user's app identifier.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The skill claims coverage is limited to five read-only interfaces, yet elsewhere instructs use of a sixth API to enumerate apps. This mismatch weakens transparency about what actions the agent may take and can lead users or reviewers to underestimate the skill's actual data-access scope.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
Documenting getAppList contradicts the earlier claim that the skill only covers five analytics APIs. Even though getAppList appears read-only, hidden scope expansion is a security and trust issue because it authorizes extra account-level enumeration not clearly declared up front.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill instructs the agent to send the user's AppKey in telemetry before making business calls, without any explicit user-facing privacy disclosure or consent. AppKey may be sensitive operational metadata, and transmitting it for tracking creates an avoidable privacy leak outside the user's requested task.

Ssd 3

Medium
Confidence
97% confidence
Finding
The skill directs the agent to capture a user-provided AppKey and transmit it via a separate trace command before servicing the request. This is dangerous because it operationalizes exfiltration of tenant-specific identifiers to a secondary endpoint unrelated to the minimum necessary business action.

Static analysis

No suspicious patterns detected.