ClawHub
Back to skill

Security audit

Deals Hunter

Security checks for vulnerabilities and agentic risk

Overview

This deal-finding skill is mostly coherent, but it needs review because it can send shopping reports externally, persist local deal history, use third-party search APIs, and surface unvalidated links from an HTTP feed.

Review before installing. Use a pinned installer version, run it with a least-privileged environment, provide only the Tavily key you intend to use, and confirm any Discord destination before allowing the agent to post. Treat generated purchase links as untrusted until verified, especially because the current feed source uses HTTP and links are not allowlisted. Expect local deal history, price cache, and report files to be written unless you modify the hardcoded paths or sandbox the run.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:18
Finding

Unpinned Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: README.md:18
Vulnerability Type: Unpinned third-party installer execution
Risk Level: Medium

Vulnerable Code

bash
npx clawhub install deals-hunter

Technical Analysis

The documented installation procedure invokes clawhub through npx without specifying an exact package version or verifying package integrity. If the package is not already available locally, npx can download and execute the package currently published under that name.

Consequently, the code executed by this command is mutable and is not necessarily the same code that was reviewed during this audit. A compromised package publisher, registry account, dependency chain, or newly published malicious release could alter installation behavior after the skill has been audited.

This finding does not establish that the current clawhub package is malicious. The vulnerability is the absence of version and integrity controls around code that may execute during installation.

Attack Path

  1. An attacker compromises the package publisher, registry entry, or a dependency used by the clawhub package.
  2. The attacker publishes a malicious version under the same package name.
  3. A user follows the README and runs npx clawhub install deals-hunter.
  4. npx resolves and downloads the mutable package release.
  5. Package initialization or installer code executes under the invoking user's account.
  6. The malicious release can access resources available to that user, subject to operating-system controls.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user running the installation command. Depending on that user's permissions, the malicious package could read or alter user-accessible files, environment variables, application configuration, API credentials, or workspace data.

The issue does not directly provide elevated operating-system p ...[truncated 161 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a reviewed exact version, for example:
    bash
    npx --yes clawhub@<reviewed-exact-version> install deals-hunter
  2. Document the expected package registry and publisher identity.
  3. Use lockfiles and package integrity hashes where the installation workflow supports them.
  4. Prefer installing a verified package version before execution rather than allowing implicit retrieval of the latest release.
  5. Run installation under a least-privileged account without unnecessary secrets in its environment.
  6. Re-audit the installer and its dependency tree whenever the pinned version is updated.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/deals-hunter.py:251
Finding

Deal Feed Retrieved Over Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/deals-hunter.py:251
Vulnerability Type: Unauthenticated network transport for externally supplied deal data
Risk Level: Medium

Vulnerable Code

python
feed = feedparser.parse("http://feed.smzdm.com")

The same insecure endpoint is also documented in SKILL.md:48 and README.md:34.

Technical Analysis

The executable retrieves the SMZDM feed through plaintext HTTP. HTTP does not provide transport confidentiality, server authentication, or integrity protection. An attacker able to intercept or modify the connection can therefore replace feed entries, including product titles, descriptions, prices, and destination links.

The application treats this feed as trusted input and copies entry links into deal objects:

python
title = entry.title
link = entry.link
description = entry.get('description', '')

When no alternative purchase link is obtained, the feed-provided link becomes the purchase link:

python
if not price_info['purchase_link']:
    price_info['purchase_link'] = deal['link']
    price_info['source'] = '什么值得买'

It is then embedded in the generated Markdown report:

python
report_lines.append(f"🛒 购买链接: <{purchase_link}>")

No URL scheme or destination-domain allowlist is applied before the link is presented to users. Transport tampering can therefore propagate an attacker-controlled URL into a trusted-looking shopping report.

Attack Path

  1. A user runs the deal-hunter script on a network where the attacker can intercept or modify plaintext traffic, such as a compromised router, hostile proxy, or untrusted wireless network.
  2. The script requests http://feed.smzdm.com.
  3. The attacker returns a modified RSS response containing a plausible deal and an attacker-controlled link.
  4. The category and spam filters accept the crafted product entry.
  5. The application stores the unvalida ...[truncated 913 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the plaintext endpoint with a verified HTTPS endpoint:
    python
    feed = feedparser.parse("https://feed.smzdm.com")
    Use the provider's supported HTTPS feed URL and verify that it returns the expected feed.
  2. Reject redirects that downgrade from HTTPS to HTTP.
  3. Fetch the feed with an HTTP client configured for TLS certificate verification, explicit connection and read timeouts, and a bounded response size.
  4. Validate every externally supplied URL before including it in a report:
    • Permit only https.
    • Reject embedded credentials and malformed hostnames.
    • Apply an allowlist of intended domains and carefully validate subdomain boundaries.
    • Resolve or reject unsafe redirect chains.
  5. Treat RSS titles and descriptions as untrusted data and escape them for the final output context.
  6. Fail closed when secure transport or URL validation fails rather than emitting an unverified purchase link.
  7. Update SKILL.md and README.md so all documented feed endpoints use HTTPS.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The prompt directs detailed search enrichment for each product, conflicting with the stated design constraint that only the first 5 items should receive historical-price checks. This can cause unbounded third-party queries, exceed rate or budget limits, and silently broaden data exposure to external services beyond what the skill description promises.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill documentation is written in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is an intentional, region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a system that recommends deals from SMZDM RSS, performs historical low-price lookups via Tavily only for the first 5 products, and uses 24-hour caching to stay within free quotas. The README instead claims 20 recommendations per push, three daily pushes, a second data source (慢慢买), and broad price/history features, which materially expands the advertised behavior beyond the manifest description.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to run npx clawhub install deals-hunter without pinning a specific package version. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or introduces unsafe behavior unexpectedly. In an agent-skill ecosystem, install-time code execution is especially sensitive.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares environment access, file read/write, and network-capable behavior but does not define any explicit tool scope or permission boundaries. In an agent framework, this increases the chance of over-privileged execution, unintended outbound requests, or filesystem access beyond what the deal-fetching task actually needs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description and primary documentation are written in Chinese and present the skill as a Chinese-language shopping recommendation system, with no indication that users can opt into another language. Under the policy rules, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to push content to Discord, which is a capability expansion beyond the declared scope of RSS aggregation and purchase advice. Scope drift matters because users and policy may approve a read/analyze skill but not an outbound-posting skill, creating unauthorized external data transmission and action-taking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill directs reading and modifying a local file in the user's home/workspace path without disclosure or consent. Access to local state is sensitive because it touches user-controlled data and persistence, and writes can corrupt state, reveal filesystem layout, or create unintended tracking over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells the agent to send deal results to Discord without an explicit warning or consent flow for external transmission. Even if the content seems harmless, outbound posting can leak user preferences, generated summaries, or embedded links to third-party services without the user's informed approval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The prompt retains deduplication records for 7 days even though the manifest says 24-hour cache behavior. This mismatch increases local data retention beyond user expectations and can preserve shopping-interest metadata longer than necessary, creating avoidable privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The package description is entirely in Chinese and describes the skill as a Chinese-language recommendation system, but it does not indicate that language selection is optional or user-configurable. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly documented as a justified region-specific tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script persistently stores reports, dedup history, and price cache data on disk under a user-specific workspace path without any retention, permission, or disclosure controls. Local persistence can expose behavioral history and collected content to other local users, backup systems, or later processes if the environment is shared or insufficiently protected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends deal titles, which may include user- or system-derived content, to the external Tavily API without explicit disclosure or minimization guarantees. While the transmitted data is not obviously highly sensitive here, silent third-party transmission creates a privacy and data-governance risk, especially if feed content or future inputs contain personal or proprietary terms.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The hardcoded Tavily endpoint confirms outbound communication to an external service. This is not malicious by itself, but it is a true security/privacy concern because it expands the system's trust boundary and may expose derived content and usage patterns to a third party.

Content

Scanner excerpt · scripts/deals-hunter.py (reported line 197)May include surrounding context.

python
return None
            payload['api_key'] = key
            try:
                resp = requests.post("https://api.tavily.com/search", json=payload, timeout=15)
                if resp.status_code == 200:
                    return resp.json()
                elif resp.status_code in (429, 432):

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The hardcoded Tavily endpoint confirms outbound communication to an external service. This is not malicious by itself, but it is a true security/privacy concern because it expands the system's trust boundary and may expose derived content and usage patterns to a third party.

Content

Scanner excerpt · scripts/deals-hunter.py (reported line 197)May include surrounding context.

python
return None
            payload['api_key'] = key
            try:
                resp = requests.post("https://api.tavily.com/search", json=payload, timeout=15)
                if resp.status_code == 200:
                    return resp.json()
                elif resp.status_code in (429, 432):

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The hardcoded Tavily endpoint confirms outbound communication to an external service. This is not malicious by itself, but it is a true security/privacy concern because it expands the system's trust boundary and may expose derived content and usage patterns to a third party.

Content

Scanner excerpt · scripts/deals-hunter.py (reported line 197)May include surrounding context.

python
return None
            payload['api_key'] = key
            try:
                resp = requests.post("https://api.tavily.com/search", json=payload, timeout=15)
                if resp.status_code == 200:
                    return resp.json()
                elif resp.status_code in (429, 432):

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The features section says the skill provides detailed price information including historical low-price queries and price curves, suggesting implemented support. Later, the TODO section says Tavily price details and automatic historical price lookup are still pending, which contradicts the earlier claim that these capabilities already exist.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document states in v5.0 that old v3/v4 scripts were deleted and only deals-hunter.py remains, but the manual trigger examples still instruct users to run deals-hunter-v4.py and deals-hunter-v3.py. This is an intent/documentation contradiction that can mislead operators about what code actually exists and should be executed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file requires the output to be in Chinese, and later repeats that requirement as mandatory, but does not provide user opt-in or explain why the locale is fixed. This matches the policy category for language or locale constraints imposed without choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This section labels the output format as required in Chinese, reinforcing a mandatory locale constraint. Because no language choice or narrow documented justification is provided, it qualifies as a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

Natural-language strings, comments, and output are predominantly Chinese, and the script provides no indication that language is configurable or limited by design. This can violate a language/locale policy when a skill forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The stated purpose is deal aggregation, historical price lookup, and buying advice. Accessing environment variables for external-service credentials is not described in the manifest and constitutes a capability beyond the user-facing purpose, even if it supports the Tavily integration technically.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest describes an RSS-based deal recommender with historical low-price lookup and buying advice. In addition to that, the code performs broader web search and extracts or synthesizes direct shopping links to JD/Tmall/manmanbuy, which is a meaningful behavior beyond simply checking historical prices for recommendation purposes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The description frames the skill as a constrained daily recommendation system, explicitly limiting historical-price checks to the first 5 items. While the 5-item lookup limit is respected, the actual report still processes and publishes up to 15 deals, which is broader than the narrow scope implied by the manifest wording.

Content

No source excerpt is available for this finding.