ClawHub
Back to skill

Security audit

Domain Monitor

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward domain monitoring skill with expected network checks and local state, though users should note its privacy and SSL-result accuracy limitations.

Install only if you are comfortable with a Chinese-language domain-monitoring helper that stores its domain list in your home directory and performs live WHOIS/TLS lookups. Do not rely on its SSL status as authoritative until the certificate verification logic is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/domain.py:44
Finding

Invalid TLS Certificates Are Incorrectly Reported as Valid

Content
View full analysis
Remediation
View remediation
`, rather than relying only on SNI through `-servername`. - Check the subprocess return code and treat timeouts, malformed output, and nonzero exits as errors rather than valid certificates. - Parse certificate expiration dates independently when expiration monitoring is required. - Prefer Python's `ssl` module with a default trust context and hostname checking enabled, which avoids fragile parsing of human-readable command output. - Add automated tests covering valid, expired, self-signed, hostname-mismatched, and untrusted-chain certificates. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill exposes shell, file, and network-capable workflows via documented commands, but the manifest does not declare any tool scope or permissions boundaries. This creates a least-privilege and reviewability problem: an agent or runtime may grant broader capabilities than users expect, increasing the chance of unintended file access, network use, or command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language content in the description and instructions is entirely in Chinese, and the file does not indicate that this language restriction is optional or region-specific. This can violate language-choice expectations if users are not explicitly opting into a Chinese-only skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrase "WHOIS" is very broad and can activate on ordinary discussion rather than a clear request to run the skill. Over-broad invocation can cause the agent to enter a networked, shell-capable workflow unexpectedly, which is risky given the skill's operational commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill performs WHOIS and TLS lookups over the network without clearly informing the user that queried domains will be transmitted to external servers and local resolvers. In monitoring workflows, this can expose sensitive domains, internal assets, or investigative targets to third parties, creating a real privacy and operational-security risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/domain.py (reported line 28)May include surrounding context.

python
def get_whois(domain):
    """获取 WHOIS 信息（简化版）"""
    try:
        result = subprocess.run(
            ["whois", domain],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a domain monitoring tool for expiry, WHOIS changes, and SSL status, which makes network lookups expected. However, the implementation performs those checks by spawning local executables (whois and later openssl) rather than using standard library or direct protocol/network logic. Executing subprocesses is a broader host capability that is not implied by the stated purpose and can introduce operational risk beyond simple monitoring.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/domain.py (reported line 51)May include surrounding context.

python
def check_ssl(domain):
    """检查 SSL 证书"""
    try:
        result = subprocess.run(
            ["openssl", "s_client", "-connect", f"{domain}:443", "-servername", domain],
            input="",
            capture_output=True,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Checking SSL certificate status is consistent with the manifest, but doing so by launching the openssl binary gives the skill local command-execution capability. That capability is not itself part of the declared purpose and is broader than necessary for a monitoring utility.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The trigger list lacks activation constraints and exclusion conditions, so the skill may be invoked too easily from generic domain-related conversation. Because the skill is intended to monitor domains and uses scripts with network/shell behavior, accidental activation expands operational risk and can surprise users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

User-facing strings such as the title, help text, and runtime output are written in Chinese only, which imposes a specific language on users without opt-in. The file does not indicate that the tool is intentionally region-specific or provide any mechanism to select another language.

Content

No source excerpt is available for this finding.