ClawHub
Back to skill

Security audit

Tinker

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Tinker CLI integration, but users should know it can launch and control the local Tinker desktop app and its plugins.

Install this only if you intentionally use Tinker and are comfortable with an agent running tinker CLI commands that may launch the Tinker desktop app, open plugin windows, and call plugin-provided MCP tools. Review installed Tinker plugins separately because their tool permissions determine what actions are possible through this skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger list is broad and includes generic phrases like 'call a plugin tool' and 'any task requiring programmatic control of the Tinker Electron app and its plugins,' which can cause the skill to activate in situations where the user did not explicitly consent to desktop-app control. Because this skill can auto-launch and operate a local application over IPC, unintended invocation increases the chance of surprising side effects and overbroad tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill states that Tinker 'must be running (or will be auto-launched by the CLI)' but does not prominently warn that using the skill may start and control a local desktop application. This can undermine informed user consent and lead to unexpected local actions, though the impact is limited because the behavior is described elsewhere and appears confined to the local machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The troubleshooting step instructs the user to select the menu item labeled only in Chinese ("安装命令行工具") without offering an English alternative or clarifying locale expectations. This introduces a language-specific instruction without user opt-in and may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.