Security audit

Idea Reality Validator

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks users to run unpinned external code and its bundled validator presents mock, random results as real market validation.

Install only if you are comfortable reviewing and pinning the external `idea-reality-mcp` package yourself. Treat the included `npm run validate` output as a mock demo, not real competitive research, and avoid running it until the hardcoded persistent memory path is removed or made configurable.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:43
Finding: Unpinned Third-Party Package Is Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/validator.cjs:18
Finding: Validator Writes Persistent State to a Hard-Coded OpenClaw Memory Path
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/validator.cjs:58
Finding: Randomized Mock Data Is Presented as Multi-Source Validation
Content: View full analysis
CONFIG.rules.stopThreshold) { console.log('⚠️ 竞争度非常高！\n'); console.log('头部竞品:'); console.log('1. 项目 A - 50,000 stars'); console.log('2. 项目 B - 30,000 stars'); console.log('3. 项目 C - 20,000 stars\n'); console.log('💡 建议: 考虑差异化或换一个方向'); ``` The command also validates a fixed idea rather than accepting user input: ```js // 模拟验证一个创意 const testIdea = 'AI 代码审查工具'; const result = this.validateIdea(testIdea); ``` ### Technical Analysis The documentation advertises competition analysis using GitHub, Hacker News, npm, PyPI, Product Hunt, and additional Chinese market sources. The bundled validator does not make requests to any of these services. Instead, it prints successful scan markers for each source, assigns a uniformly random score through `Math.random()`, and conditionally displays invented competitor names and star counts. It also validates a hard-coded idea rather than an idea supplied by the user. Although source comments identify portions as simulations, the runtime output presents the scan and score as completed validation without a visible mock-data warning. The file imports `execSync`, but no command is executed and no MCP ser ...[truncated 1498 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script claims to validate ideas by scanning GitHub, Hacker News, npm, PyPI, and Product Hunt, but it only prints simulated source names and generates a random score. This is dangerous because users may make product or investment decisions based on fabricated competitive analysis, creating a trust-boundary violation between the advertised behavior and the actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and primary descriptive text are presented in Chinese, and the rest of the skill documentation continues in Chinese without stating that other languages are supported. This creates a locale/language constraint without explicit user opt-in, which matches the policy-violation category for forced language choice.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to run an MCP server via uvx idea-reality-mcp without pinning a specific version or integrity constraint. That creates a supply-chain risk: a future malicious or compromised release could be fetched and executed automatically in the user's environment, and MCP servers typically have broad access to local data and agent workflows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code comments state that actual validation should call an MCP server, yet the implementation performs only a random mock simulation. This mismatch is dangerous because it disguises nonfunctional security- or decision-relevant logic as real validation, undermining operator trust and enabling false assurances from arbitrary output.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as validating the user's idea, but the runtime always evaluates a hardcoded idea string instead of user-supplied input. This is dangerous because it can mislead users into believing their own idea was assessed, causing incorrect business decisions while hiding that no real target-specific analysis occurred.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language key and values under the chinaMarket section indicate the skill is configured to use a specific regional/locale context by default. Because the file does not present any user choice, opt-in, or justification for enforcing this locale-specific mode, it may violate the policy against forcing a specific language or locale without user consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.