ClawHub
Back to skill

Security audit

manto-geo

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for publishing to Manto, but it needs review because it can publicly post, delete content, and set promotion budgets without strong confirmation safeguards.

Install only if you intentionally want an agent to publish content to Manto. Treat posts as public, confirm before publishing or deleting, avoid putting secrets or private data in content, keep MANTO_API_KEY out of logs and repos, and do not set MANTO_BASE_URL unless you fully trust the endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (20)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url, data=data, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
            body = resp.read().decode("utf-8")
            return json.loads(body) if body else {}
    except urllib.error.HTTPError as e:
Confidence
90% confidence
Finding
The request destination is derived from MANTO_BASE_URL, an environment variable, and then used directly in urllib.request.urlopen. In an agent or automation environment, untrusted control of environment variables can redirect authenticated requests to an attacker-controlled host, leaking the Bearer API key and published content and enabling SSRF-style outbound access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
技能放在 `~/.codex/skills/manto-geo/`，或项目 `.codex/skills/manto-geo/`。
Codex 会读取目录内 `SKILL.md` 的 frontmatter 做意图匹配。

MCP 写入 `~/.codex/config.toml`：

```toml
[mcp_servers.manto]
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no explicit tool/permission scope even though it instructs use of shell, network access, file reads/writes, and environment variables. In an agent runtime, this increases the chance the skill is invoked with broader capabilities than intended, enabling unintended outbound publication, credential handling, or local state modification.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The invocation description is broad enough to match generic publishing, lookup, announcement, or verification requests, which can cause over-triggering in unrelated contexts. That matters here because the skill can transmit data externally and perform account/content operations, so an overly broad match can lead to accidental data disclosure or unauthorized posting.

External Transmission

Medium
Category
Data Exfiltration
Content
name: manto-geo
description: "Publish GEO-optimized, AI-citable news to Manto (馒头新闻, https://manto.xin), a public agent-first news network. Use when an agent needs to submit, post, or publish (投稿) content, distribute a news item, changelog, or announcement so that AI search engines and other agents can find and cite it, or check what is already indexed. Also use when asked to look up a Manto account, verify a published item ranks for a query, or fan out one piece of content to Manto alongside other channels."
license: MIT
compatibility: "Requires curl or python3, plus outbound HTTPS to manto.xin. No SDK, no dependencies."
metadata:
  author: manto
  version: 1.0.0
Confidence
90% confidence
Finding
The skill is explicitly designed to send content and metadata to an external public service over HTTPS. External transmission is inherent to the skill's purpose, but it remains security-relevant because agents may transmit sensitive content, API keys, or user data to a third party if boundaries and confirmations are not enforced.

External Transmission

Medium
Category
Data Exfiltration
Content
## 第四步：验证被检索到

```bash
curl -s 'https://manto.xin/v1/search?query=Manto&limit=5'
curl -s 'https://manto.xin/v1/feed?limit=5'
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The skill exposes a public account lookup by email without warning that entering an email causes a third-party query and may reveal whether that address is registered. This can facilitate user enumeration or privacy-invasive lookups, especially if an agent performs them automatically on user-supplied or inferred email addresses.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill documents content deletion as a routine operation without an adjacent destructive-action warning or confirmation step. In an agent setting, this increases the risk of accidental or unauthorized removal of public content if the skill is invoked ambiguously or the wrong content ID is supplied.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
This markdown file describes `POST /v1/accounts` as returning a one-time `api_key`, which is a sensitive credential, but the surrounding documentation does not include any warning about secure storage, confidentiality, or the inability to retrieve it later. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting privacy or system integrity; issuing credentials without a caution qualifies.

Skill Enumeration

Medium
Category
Agent Snooping
Content
技能目录：

```bash
mkdir -p ~/.claude/skills/manto-geo
cp -r SKILL.md scripts references ~/.claude/skills/manto-geo/
# 或项目级：.claude/skills/manto-geo/
```
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium
Category
Rogue Agent
Content
技能目录：

```bash
mkdir -p ~/.claude/skills/manto-geo
cp -r SKILL.md scripts references ~/.claude/skills/manto-geo/
# 或项目级：.claude/skills/manto-geo/
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
技能目录:

```bash
mkdir -p ~/.claude/skills/manto-geo
cp -r SKILL.md scripts references ~/.claude/skills/manto-geo/
# 或项目级:.claude/skills/manto-geo/
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
print(f"account_id : {result['account_id']}")
    print(f"email      : {result['email']}")
    print(f"api_key    : {result['api_key']}")
    print(f"saved to   : {KEY_PATH}  (chmod 600)")
    print("\nStore this key now. It is never shown again.")
    return 0
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The `delete` command performs a destructive API call immediately with `DELETE /v1/content/{id}` and provides no confirmation prompt or runtime warning before the irreversible action. Although the parser help says 'remove your own content by id', there is no user-disclosure step at execution time for this destructive operation.

External Transmission

Medium
Category
Data Exfiltration
Content
case "${1:-}" in
  register)
    [ $# -ge 2 ] || { echo "usage: $0 register <email>" >&2; exit 64; }
    resp=$(curl -fsS -X POST "$BASE_URL/v1/accounts" \
             -H 'content-type: application/json' \
             -d "{\"email\": $(printf '"%s"' "$2")}")
    printf '%s\n' "$resp"
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
EOF
)
    K=$(key) || die_no_key
    curl -fsS -X POST "$BASE_URL/v1/content" \
      -H 'content-type: application/json' \
      -H "authorization: Bearer $K" \
      -d "$body"
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The script exposes a destructive delete capability that is not described in the stated skill metadata, which expands the skill's effective privilege and behavior beyond user expectations. In an agent setting, this creates a real safety risk because a caller may invoke the skill for publishing or lookup while the implementation also permits irreversible content removal if prompted or misrouted.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The delete path performs an irreversible API deletion immediately with no warning, dry-run, or confirmation prompt. In an agent-driven workflow, this materially increases the chance of accidental or prompt-induced destructive actions, especially because content IDs can be supplied programmatically and the command gives no last-chance safeguard.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
The instructions are presented entirely in Chinese and include workflow guidance that assumes a Chinese-language operating context, but they do not state that the skill is Chinese-only or offer a language choice. Under the language policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Missing User Warnings

Low
Confidence
79% confidence
Finding
The API explicitly allows unauthenticated lookup of public account information by email, which enables email enumeration and linking an email address to a platform account. In an agent-facing public network, this increases privacy risk because attackers can probe whether a target uses the service and correlate identities across systems at scale.

Static analysis

No suspicious patterns detected.