ClawHub
Back to skill

Security audit

Dota2-Stats-Skill

Security checks for vulnerabilities and agentic risk

Overview

This Dota 2 stats skill is a disclosed OpenDota query helper with expected network use and no evidence of hidden, destructive, credential-stealing, or persistent behavior.

Install only if you are comfortable sending Dota 2 player names, account IDs, Steam64 IDs, match IDs, and query filters to OpenDota. Use the refresh command deliberately, since it asks OpenDota to refresh a player record rather than only reading cached data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

README 说明“然后直接用自然语言提问”，并给出普通中文问句示例，但没有限定必须包含哪些命令词、适用上下文或不应触发的负例。这类日常表达如“查一下……战绩”“最近有什么职业比赛”与普通对话高度重叠，容易导致技能被意外调用。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

与 Claude Code 部分相同，这里仅说明将目录放置后“直接用自然语言提问”，没有说明技能如何区分普通聊天与技能调用，也没有限定触发短语范围。对清单型技能而言，缺少明确触发条件会增加误调用风险。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs the agent to run a Python script with network access, but the manifest does not declare any explicit tool scope or permissions boundaries. This creates an authorization ambiguity: an agent or platform may grant broader file and network capabilities than users expect, increasing the risk of unintended file access or outbound requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill requires transmitting user-supplied identifiers and queries to an external service (api.opendota.com). Even though this is expected for the skill's purpose, it still introduces data egress, privacy, logging, and third-party trust risks, especially if users provide account IDs, Steam64 IDs, or other identifying inputs.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

python scripts/dota2_query.py [args]

text

The script uses only the Python standard library, so no pip install is required. It needs network access to `https://api.opendota.com/api` and uses browser-like HTTP headers to reduce 403 risk.

## Command Selection

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This translation file explicitly defines only "zh" and "en" language outputs, which indicates the skill is constrained to specific locales. Under the policy, forcing specific languages without user opt-in or a documented justification can be a natural-language policy violation; this file contains no indication of user language choice or region-specific rationale.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest and module documentation frame the tool as a Dota 2/OpenDota query utility, which implies read-oriented retrieval of stats and match data. However, the implemented refresh command sends a POST request to /players/{account_id}/refresh, causing a state-changing action on the OpenDota service rather than merely querying data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 130)May include surrounding context.

md
import time
from datetime import datetime, timezone, timedelta

BASE_URL = "https://api.opendota.com/api"

# HTTP headers to avoid 403
REQUEST_HEADERS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_EN.md (reported line 130)May include surrounding context.

md
import time
from datetime import datetime, timezone, timedelta

BASE_URL = "https://api.opendota.com/api"

# HTTP headers to avoid 403
REQUEST_HEADERS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/dota2_query.py (reported line 60)May include surrounding context.

python
import time
from datetime import datetime, timezone, timedelta

BASE_URL = "https://api.opendota.com/api"

# HTTP headers to avoid 403
REQUEST_HEADERS = {

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
70% confidence
Finding

文档主体以中文呈现，虽然顶部提供英文 README 链接，但当前说明页本身未明确告诉用户该技能是否默认以中文响应，或是否会根据用户偏好切换语言。按语言/区域策略，若技能体验隐含固定语言而缺少清晰的用户选择说明，可能构成轻微的语言策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description states that the default output is Chinese and only switches to English when --lang en is provided. This is a locale/language policy concern because it forces a specific language by default rather than clearly offering a neutral default or requiring user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This JSON file is a mapping of hero identifiers exclusively to Chinese names, which encodes a fixed language choice in the skill data. Because SQP-3 applies to all file types and there is no indication here of optional locale selection or that the skill is explicitly China-specific, this appears to hard-code a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The top-level docstring describes the script as a stats query tool and enumerates commands in a query-centric way. One listed command, refresh, actually performs a POST that requests backend reprocessing/refresh, which is materially different from passive querying and is not called out as a side-effecting operation in the documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The help text states --lang zh|en with default: zh, which imposes a specific language choice unless the user explicitly overrides it. This is a natural-language locale policy concern because the skill defaults to one locale rather than prompting for or inferring a user-preferred language.

Content

No source excerpt is available for this finding.