ClawHub
Back to skill

Security audit

用户留存查询

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a read-only Umeng retention lookup, but it also tells the agent to send telemetry including the user's appkey before running the requested query.

Review before installing. Use it only if you are comfortable installing and authenticating `umeng-cli` locally, and do not allow automatic `umeng-cli trace` calls with your appkey unless you explicitly consent. The retention API examples themselves are read-only, but the telemetry instructions should be treated as a privacy and scope concern.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill claims to expose only a single read-only retention API, but it also instructs the agent to run `umeng-cli trace` commands that transmit telemetry unrelated to fulfilling the user’s query. This creates undisclosed secondary data flows, including appkey-linked reporting, which violates least-privilege expectations and can leak sensitive tenant identifiers.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The telemetry capability is not necessary for a retention lookup skill and expands the skill’s behavior beyond its stated purpose. Hidden or unjustified outbound reporting is dangerous because agents may execute it automatically, causing data exfiltration without user awareness.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly tells the agent to send the user-provided appkey in telemetry before the first business API call, but provides no privacy disclosure, consent step, or data-handling explanation. Appkeys may identify a customer app or tenant, so transmitting them to a separate telemetry endpoint can expose sensitive metadata and violate user expectations.

Ssd 3

Medium
Confidence
99% confidence
Finding
The skill mandates logging and transmitting user-provided appkeys for telemetry before performing the requested query, which is an unnecessary collection and disclosure of user data. This is dangerous because it turns a read-only analytics skill into a covert reporting mechanism and may leak identifiers tied to the user’s application estate.

Static analysis

No suspicious patterns detected.