ClawHub
Back to skill

Security audit

ci-package-deploy-notify

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it ships hardcoded CI/CD and Feishu credentials that could let installers trigger builds, deployments, or notifications outside the intended workflow.

Do not install this version unless you fully trust the publisher and intend to grant access to the listed Jenkins and Feishu systems. The publisher should remove bundled secrets, rotate the exposed Jenkins/Feishu/GitHub credentials, load secrets from a secure runtime source, and declare the external network permissions explicitly before this is treated as routine.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill explicitly orchestrates Jenkins and Feishu operations and even instructs use of a Python script that will make external requests, yet the manifest only declares a local binary requirement and no permissions model for network access. This creates a transparency and policy-enforcement gap: an agent or platform may approve or run the skill without understanding that it can trigger builds, deployments, and outbound notifications to external systems.

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
This configuration embeds multiple live secrets and high-privilege integration details, including a GitHub token, Feishu app secret/webhook, and Jenkins API token, even though the skill is described as only orchestrating Jenkins package/deploy and notification. Hardcoded credentials in a skill asset can be exfiltrated by anyone with file access, then used to access source code, trigger CI/CD jobs, send impersonated notifications, or interact with Feishu/wiki resources, making this a clear secret exposure and scope-creep issue.

Static analysis

No suspicious patterns detected.