ClawHub
Back to skill

Security audit

rice-tracker

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real rice inventory and receivables tracker, but it can expose customer and payment records on the local network without login protection.

Review before installing. Use it only on a trusted machine and network, change the web server to bind to 127.0.0.1 or add authentication before entering real customer data, protect the local JSON records file and logs, and inspect the start/stop scripts so they do not kill unrelated services on port 5001.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs the agent/user to run Python scripts, launch a Flask app, create logs, and configure a cron job, which implies shell execution plus file read/write behavior, yet no permissions are declared. This creates a transparency and consent problem: users and platforms cannot accurately assess or gate the skill's capabilities before use.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The application binds Flask to 0.0.0.0, making this inventory and debt-tracking service reachable from other hosts on the network instead of only the local machine. In context, the app handles customer names, phone numbers, purchase history, payment status, and settlement dates, so broader network exposure materially increases the risk of unauthorized access to sensitive business and personal data.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The application is configured to bind to 0.0.0.0, making a customer/order tracker containing phone numbers, billing data, arrears, and bank-account fields reachable from other hosts on the network rather than only the local machine. In this skill context, the app handles business and personal financial records, so unintended network exposure materially increases the chance of unauthorized access or data leakage.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
Rendering the full local storage path in the UI discloses filesystem layout details to anyone who can access the page. While not severe by itself, it provides unnecessary host-environment information that can aid follow-on attacks or reveal user/account structure.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The /api/records endpoint returns the full stored dataset as JSON with no authentication, exposing personal and financial information including customer names, phone numbers, purchase records, unpaid balances, and settlement data. Because the app is also configured for network-wide exposure, this endpoint can enable trivial data harvesting by any reachable user or process.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Listening on 0.0.0.0 exposes submitted customer PII and financial data to the local network without any visible warning or access control in the provided code. Given the skill's purpose is local rice/customer bookkeeping, this broad exposure is not necessary and significantly raises confidentiality risk.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# 启动 Web 服务（后台运行）
nohup python3 ~/.openclaw/workspace/skills/rice-tracker/scripts/app.py \
  > ~/.openclaw/workspace/skills/rice-tracker/app.log 2>&1 &

# 测试提醒脚本
Confidence
84% confidence
Finding
Using nohup to launch a persistent background Flask service creates long-lived state outside a managed runtime, increasing the risk of unintended exposure, stale processes, and unattended resource consumption. In this skill, the service may continue running and serving local/network requests after the user no longer expects it, especially since the documentation also advertises access from other devices on the LAN.

Static analysis

No suspicious patterns detected.