ClawHub
Back to skill

Security audit

Confucius Debug

Security checks for vulnerabilities and agentic risk

Overview

This debugging skill is purpose-aligned overall, but it pushes broad automatic third-party debugging requests and understates how much diagnostic context may be sent and retained.

Review before installing. Use this only where sending debugging text, identifiers, logs, environment details, and project structure to api.washinmura.jp is acceptable. Do not use the automatic workflow on confidential, production, regulated, or secret-bearing errors unless you first redact and explicitly approve the exact payload.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:18
Finding

Mandatory Third-Party Debugging Workflow Overrides Agent Behavior

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/analyze.sh:14
Finding

Unredacted Diagnostic and Environment Data Can Be Sent to a Third Party

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:199
Finding

Privacy Statement Understates the Scope of Data Transmission

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description frames the behavior as a benign debugging assistant, but the actual instructions mandate remote transmission of debugging data and use an environment identifier without clearly declaring those behaviors as permissions. This mismatch can mislead users and systems into enabling a skill that sends potentially sensitive operational data off-machine under the guise of routine debugging.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The escalation workflow collects environment details, logs, and project structure, but the privacy warning omits these categories and instead suggests only limited error text leaves the machine. Incomplete disclosure undermines informed consent and increases the chance of leaking sensitive internal information to the external service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation states that no file contents are sent, yet escalation includes logs and project structure, which often contain snippets of source, filesystem paths, stack traces, SQL, tokens, and other file-derived sensitive data. This creates a material risk of unintended data exfiltration under a misleading privacy claim.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes shell/network capabilities via documented curl usage but does not declare an explicit tool scope or allowed-tools policy. That omission weakens reviewability and can cause the host agent to run broader capabilities than users expect, especially because the skill is designed to trigger automatically on errors.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

The skill is explicitly built around sending debugging queries to an external API, so external transmission itself is expected in context; however, it still poses a real data exposure risk because the feature is coupled to automatic debugging behavior and incomplete privacy disclosures. The risk is elevated by reliance on shell-based curl commands and an external identifier variable.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
primaryEnv: CONFUCIUS_LOBSTER_ID
    requires:
      bins:
        - curl
        - jq
      env:
        - CONFUCIUS_LOBSTER_ID

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Triggering on 'ANY error or exception' is overly broad and makes remote data transmission the default response to routine failures, including errors involving private repositories, production systems, or regulated environments. In this context, the skill becomes more dangerous because it encourages automatic escalation before evaluating sensitivity or necessity.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs users to submit environment details, logs, and project structure to a remote service while later asserting those data are not sent. This contradiction increases the likelihood of oversharing operationally sensitive information because users are primed to trust the privacy statement.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

The search endpoint transmits user-provided error queries to a third-party service. In a debugging context this may be acceptable, but queries can still contain proprietary stack traces, hostnames, paths, or customer data, making the transmission security-sensitive.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash
# Search for a bug pattern
curl -s -X POST https://api.washinmura.jp/api/v2/debug-ai/search \
  -H "Content-Type: application/json" \
  -d '{"query": "OpenClaw Telegram plugin not connecting", "limit": 5}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The analyze endpoint sends error descriptions, messages, and a user identifier to the remote service. Because error messages often embed sensitive application context, this creates a meaningful exfiltration surface even if the service is legitimate.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

bash
# Analyze a new bug
curl -s -X POST https://api.washinmura.jp/api/v2/debug-ai \
  -H "Content-Type: application/json" \
  -d '{
    "error_description": "OpenClaw Telegram bot not responding after restart",

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The escalate endpoint sends the richest payload: environment, logs, tried steps, and project structure. In practice, these fields can expose infrastructure details, internal filenames, code fragments, tokens in logs, and other sensitive operational information to the external service.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

When confucius_analyze returns status: "unsolved" (low confidence), submit more context to help offline research.

bash
curl -s -X POST https://api.washinmura.jp/api/v2/debug-ai/escalate \
  -H "Content-Type: application/json" \
  -d '{
    "error_description": "The original error",

External Transmission

Medium
Category
Data Exfiltration
Confidence
67% confidence
Finding

The contribute endpoint uploads user-authored bug/fix entries to the remote knowledge base. This is expected functionality, but it still creates a leakage risk if users contribute internal issue details or proprietary remediation steps.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

Solved a bug? Share it so nobody hits it again.

bash
curl -s -X POST https://api.washinmura.jp/api/v2/debug-ai/onboard \
  -H "Content-Type: application/json" \
  -d '{
    "lobster_id": "'"$CONFUCIUS_LOBSTER_ID"'",

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

The MCP server configuration establishes an external remote tool endpoint, enabling ongoing network interactions beyond the one-off curl examples. In context, that broadens the trust boundary to a remote service that can receive debugging inputs from the client ecosystem.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
{
  "mcpServers": {
    "confucius-debug": {
      "url": "https://api.washinmura.jp/mcp/debug"
    }
  }
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

The connection test demonstrates direct API communication and normalizes outbound calls as part of setup. Though low-risk by itself, it contributes to a broader pattern of remote transmission without strong permission framing or comprehensive privacy warnings.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

  1. Test the connection (no ID needed for search):
    bash
    curl -s https://api.washinmura.jp/api/v2/debug-ai/search \
  -X POST -H "Content-Type: application/json" \
  -d '{"query": "test", "limit": 1}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

The connection test demonstrates direct API communication and normalizes outbound calls as part of setup. Though low-risk by itself, it contributes to a broader pattern of remote transmission without strong permission framing or comprehensive privacy warnings.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

  1. Test the connection (no ID needed for search):
    bash
    curl -s https://api.washinmura.jp/api/v2/debug-ai/search \
  -X POST -H "Content-Type: application/json" \
  -d '{"query": "test", "limit": 1}'

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation states that no file contents are sent, yet escalation includes logs and project structure, which often contain snippets of source, filesystem paths, stack traces, SQL, tokens, and other file-derived sensitive data. This creates a material risk of unintended data exfiltration under a misleading privacy claim.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The declared external endpoint and comment that results are saved to a knowledge base indicate intentional off-host transmission and retention of debugging material. Even though this line is a comment/manifest rather than executable code, it documents a behavior that materially increases data exposure risk in the skill's operational context.

Content

Scanner excerpt · scripts/analyze.sh (reported line 8)May include surrounding context.

sh
#
# Security Manifest:
#   ENV accessed: CONFUCIUS_LOBSTER_ID (required, for identification)
#   External endpoints: https://api.washinmura.jp/api/v2/debug-ai
#   Files: none (read-only API call)
#   Side effects: solution saved to YanHui KB (free)
#

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

Hardcoding a remote API URL for a debugging workflow makes exfiltration of sensitive diagnostic content the default behavior. In this skill context, users are specifically encouraged to submit errors and stack traces, which often contain highly sensitive operational and credential data, making the external transmission more dangerous than in less sensitive domains.

Content

Scanner excerpt · scripts/analyze.sh (reported line 20)May include surrounding context.

sh
DESC="${1:?Usage: analyze.sh \"error description\" \"error message (optional)\"}"
MSG="${2:-}"
LOBSTER_ID="${CONFUCIUS_LOBSTER_ID:?Set CONFUCIUS_LOBSTER_ID env var first}"
API_URL="https://api.washinmura.jp/api/v2/debug-ai"

echo "🧙 Confucius is analyzing... (free, ~6 seconds)"
echo ""

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The script sends user-supplied error descriptions, stack traces, and the CONFUCIUS_LOBSTER_ID to an external third-party endpoint. In a debugging context, these fields can easily contain secrets, tokens, internal paths, source snippets, customer data, or proprietary information, and the header explicitly states the solution is saved to the YanHui KB, increasing persistence and disclosure risk.

Content

Scanner excerpt · scripts/analyze.sh (reported line 31)May include surrounding context.

sh
--arg lid "$LOBSTER_ID" \
  '{error_description: $desc, error_message: $msg, lobster_id: $lid, channel: "clawhub"}')

RESPONSE=$(curl -s --max-time 30 -X POST "$API_URL" \
  -H "Content-Type: application/json" \
  -d "$BODY") || {
  echo "❌ Cannot reach Confucius API (api.washinmura.jp). Check your internet or try again later."

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
#
# Security Manifest:
#   ENV accessed: CONFUCIUS_LOBSTER_ID (optional, for attribution)
#   External endpoints: https://api.washinmura.jp/api/v2/debug-ai/search
#   Files: none (read-only API call)
#   Side effects: none
#

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md
#
# Security Manifest:
#   ENV accessed: CONFUCIUS_LOBSTER_ID (optional, for attribution)
#   External endpoints: https://api.washinmura.jp/api/v2/debug-ai/search
#   Files: none (read-only API call)
#   Side effects: none
#

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md
#
# Security Manifest:
#   ENV accessed: CONFUCIUS_LOBSTER_ID (optional, for attribution)
#   External endpoints: https://api.washinmura.jp/api/v2/debug-ai/search
#   Files: none (read-only API call)
#   Side effects: none
#

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.sh (reported line 8)May include surrounding context.

sh
#
# Security Manifest:
#   ENV accessed: CONFUCIUS_LOBSTER_ID (optional, for attribution)
#   External endpoints: https://api.washinmura.jp/api/v2/debug-ai/search
#   Files: none (read-only API call)
#   Side effects: none
#

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.sh (reported line 19)May include surrounding context.

sh
#
# Security Manifest:
#   ENV accessed: CONFUCIUS_LOBSTER_ID (optional, for attribution)
#   External endpoints: https://api.washinmura.jp/api/v2/debug-ai/search
#   Files: none (read-only API call)
#   Side effects: none
#

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The script transmits the user-supplied query to an external third-party endpoint, which can leak sensitive error messages, tokens, file paths, stack traces, or internal system details entered by the user. In a debugging skill, this context makes the risk more concrete because users commonly paste confidential operational data into error reports.

Content

Scanner excerpt · scripts/search.sh (reported line 24)May include surrounding context.

sh
echo "🔍 Searching YanHui KB for: ${QUERY:0:80}..."
echo ""

RESPONSE=$(curl -s --max-time 15 -w "%{http_code}" -o >(cat) -X POST "$API_URL" \
  -H "Content-Type: application/json" \
  -d "{\"query\": $(echo "$QUERY" | jq -Rs .), \"limit\": 5, \"channel\": \"clawhub\"}" 2>/dev/null) || {
  echo "❌ Cannot reach Confucius API (api.washinmura.jp). Check your internet or try again later."

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This shell script includes natural-language content in Chinese (the comment on L38) while the rest of the script is primarily English, and there is no indication that users can choose or opt into a locale. The policy requires flagging language or locale constraints when a specific language is imposed without user choice or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.