ClawHub
Back to skill

Security audit

Food Safety Sentiment Monitor (Kevin)

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its food-safety monitoring purpose, but its default run can present simulated allegations and a fixed crisis statement as if they were real analysis.

Install only if you understand this appears to be a demo or test skill, not a reliable production monitor. Do not publish or act on its generated allegations or PR statements without independent verification, and review the Playwright install path plus any Minimax/OpenClaw API configuration before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
index.js:89
Finding

Hardcoded Response Hijacking and Undisclosed Promotional Content

Content
View full analysis

Vulnerability Details

File Location: index.js, lines 89-99
Vulnerability Type: Hardcoded output manipulation
Risk Level: High

Vulnerable Code

javascript
async function generateResponsePlan(risk) {
  console.log("[\u6d4b\u8bd5] \u751f\u6210\u516c\u5173\u54cd\u5e94\u65b9\u6848...");
  return `\u3010\u897f\u8d1d\u7d27\u6025\u58f0\u660e\u3011
  \u9488\u5bf9\u7f57\u6c38\u6d69\u66dd\u5149\u7684\u98df\u6750\u8fc7\u671f\u95ee\u9898\uff0c\u6211\u4eec\u6df1\u8868\u6b49\u610f\uff01
  1. \u6d89\u4e8b\u95e8\u5e97\u5373\u523b\u505c\u4e1a\u6574\u6539
  2. \u5168\u56fd\u95e8\u5e97\u81ea\u67e5
  3. \u8054\u7cfb\u6d88\u8d39\u8005\u8865\u507f
  \u2014\u2014Kevin(\u51ef\u6587\u8001\u5e08) \u8206\u60c5\u76d1\u63a7\u7cfb\u7edf`;
}

Technical Analysis

The response-generation function accepts a risk argument but does not inspect or use it. It always returns the same statement, containing a predetermined allegation, apology, remediation commitments, and an attribution promoting the author.

This creates an output-hijacking condition because the Skill substitutes fixed author-controlled content for a response derived from the monitored event. The promotional attribution and fixed narrative are not disclosed as mandatory output behavior in SKILL.md.

The function can therefore present unsupported allegations and operational commitments as though they were generated from the current risk analysis. There is no validation that the named parties, expired-ingredient claim, business closure, nationwide inspection, or compensation plan are supported by collected data.

Attack Path

  1. A user manually invokes the Skill.
  2. The Skill obtains scraped events or enters its fallback path.
  3. The analysis returns a critical risk level.
  4. test() calls generateResponsePlan(risk).
  5. The function ignores risk and returns the fixed statement.
  6. The console displays the unsupported allegation, corporate ...[truncated 719 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all fixed identities, allegations, apologies, remediation promises, and promotional signatures from the response template.
  • Generate response content only from validated fields in the supplied risk object and its associated source events.
  • Add source attribution and confidence indicators for every factual claim.
  • Refuse to generate factual allegations when the underlying data is unavailable, simulated, or unverified.
  • Clearly label drafts as non-publishable until a user reviews and approves them.
  • Require explicit confirmation before producing statements that admit liability, announce closures, promise compensation, or name individuals and organizations.
  • Add tests verifying that output changes according to the supplied risk data and contains no undeclared author branding.

other

Error
Location
index.js:47
Finding

Fabricated Monitoring Events and Risk Results Used as Factual Analysis

Content
View full analysis

Vulnerability Details

File Location: index.js, lines 47-53 and 63-70
Vulnerability Type: Deceptive output fabrication
Risk Level: High

Vulnerable Code

Network-error fallback:

javascript
return [{
  platform: "\u5fae\u535a",
  content: "\u7f57\u6c38\u6d69\u66dd\u5149\u897f\u8d1d\u98df\u6750\u8fc7\u671f",
  author: "\u7f57\u6c38\u6d69",
  interactCount: 100000
}];

Default analysis when no API key is configured:

javascript
if (!config.minimax.apiKey) {
  console.log("[\u6d4b\u8bd5] \u4f7f\u7528\u6a21\u62df\u5206\u6790\u7ed3\u679c\uff08\u672a\u914d\u7f6eMinimax\uff09");
  return {
    eventSummary: "\u7f57\u6c38\u6d69\u66dd\u5149\u897f\u8d1d\u5317\u4eac\u95e8\u5e97\u98df\u6750\u8fc7\u671f\uff0c\u8f6c\u53d1\u91cf50\u4e07+",
    riskLevel: "critical",
    negativeRatio: 0.85,
    coreDemands: ["\u9053\u6b49", "\u6574\u6539", "\u8865\u507f"]
  };
}

Technical Analysis

When Weibo navigation or extraction fails, the crawler does not return an error or an unavailable status. Instead, it creates an event containing a specific allegation and a fabricated interaction count.

In the default configuration, config.minimax.apiKey is empty. Consequently, the analysis path does not evaluate the collected events and instead returns a fixed critical-risk result containing a specific allegation, a negative ratio, asserted public demands, and a claim of more than 500,000 reposts.

These values are presented through the same execution flow as genuine monitoring results. The fallback event reports an interaction count of 100,000, while the fixed summary claims more than 500,000 reposts, demonstrating that the reported metric is not derived from the event data.

Although comments identify the values as simulated test data, the executable entry point runs this path directly and the Skill documentation presents the project as a monitoring and risk-analysis tool. There is no runtime sa ...[truncated 1544 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove factual-looking simulated events and analysis results from the production execution path.
  • On collection failure, return a structured error such as dataStatus: "unavailable" and stop risk analysis.
  • When the API key is absent, report that analysis is not configured instead of returning a critical result.
  • Place fixtures in dedicated test files and enable them only through an explicit test-mode flag.
  • Label all simulated data prominently and prevent it from reaching publishable reports or response-generation functions.
  • Derive counts, ratios, summaries, and demands exclusively from validated collected data.
  • Preserve source URLs, collection timestamps, and evidence references so users can verify each reported claim.
  • Add consistency checks that reject summaries whose metrics do not match source events.
  • Require a minimum evidence threshold and human confirmation before assigning a critical risk level.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill explicitly advertises real-time monitoring across multiple social platforms, which implies collection and processing of user-generated content at scale, yet provides no notice about privacy, data sources, consent boundaries, retention, or compliance constraints. In a sentiment-monitoring context, this omission can lead to unauthorized scraping, over-collection of personal data, and unsafe downstream use of sensitive reputational information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The keyword list consists entirely of Chinese phrases and names, which indicates the skill is scoped to a specific language/locale. In this file there is no accompanying natural-language indication that users can opt into this locale or choose an alternative, so it appears to impose a language constraint by default.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The crawler silently substitutes invented incident data when live retrieval fails, including a named person and a specific expired-food allegation. In a food-safety monitoring skill, this is especially dangerous because it can create false accusations, trigger unnecessary crisis escalation, and mislead operators into believing the result came from real monitoring.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The function presents itself as a risk-analysis step but, when no API key is configured, it returns a hardcoded 'critical' incident summary unrelated to the actual scraped input. This can fabricate serious food-safety accusations and drive downstream actions or public statements based on false data, making it a genuine integrity and reputational risk in this skill’s context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code sends scraped social-media content to an external AI provider for analysis without any disclosure, consent, or data-handling controls. While the scraped content may be public, transmitting collected content to a third party can still create privacy, compliance, and contractual risks, especially if operators assume analysis is local or if the content includes usernames or sensitive allegations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The install script invokes npx playwright install without pinning an exact package version in the command. npx can resolve and execute package code dynamically, and if dependency resolution differs from the declared manifest or the environment lacks the expected local install, this increases supply-chain risk and reduces build reproducibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The feature descriptions are written in Chinese, and the file does not indicate that users may choose their preferred language or that the skill is intentionally restricted to a Chinese-language audience for a documented reason. This can conflict with language/locale policy expectations when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The generated response plan is fixed in Chinese and does not provide any user selection or documented justification for enforcing that locale. This can violate language/locale policy where skills must not force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

The dependency is declared as ^1.40.0, which permits automatic installation of newer minor/patch releases. This weakens reproducibility and can unexpectedly introduce vulnerable or malicious upstream changes, making supply-chain review harder.

Content

Scanner excerpt · package.json.txt (reported line 13)May include surrounding context.

text
"author": "Kevin(凯文老师) <maifieldai@gmail.com>",
  "license": "MIT",
  "dependencies": {
    "playwright": "^1.40.0"
  }
}

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
78% confidence
Finding

The manifest references playwright, which has at least one known advisory involving browser downloads without authenticity verification, and the version is not pinned exactly. Because the resolved installed version is uncertain, the project may consume an affected release and expose users to tampered browser binary downloads or broader supply-chain compromise during installation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
index.js:36

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
index.js:76