ClawHub
Back to skill

Security audit

multilingual-template-sync

Security checks across malware telemetry and agentic risk

Overview

The skill matches its stated template-sync purpose, but it needs Review because it can upload arbitrary local file content to Feishu and create GitHub issues using write-capable tokens without built-in confirmation or file scoping.

Review before installing. Use only with least-privilege Feishu and GitHub tokens, confirm the exact file, wiki space, parent node, repository, title, and issue body before running scripts, and avoid passing files that may contain secrets or private customer data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs the agent to read local files, potentially modify template content, and execute shell scripts that use privileged external credentials for Feishu and GitHub, yet no explicit permissions are declared. This creates a real safety gap because the runtime may grant capabilities implicitly, making it harder to constrain or audit what the skill can access and execute.

Vague Triggers

Medium
Confidence
74% confidence
Finding
The trigger phrases are broad and overlap with common documentation, translation, and publishing tasks, which increases the chance the skill activates when the user did not intend to run a workflow that edits files and invokes shell scripts. Because the skill can lead to local modification and external publication, unintended activation raises the risk of accidental changes or data disclosure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The workflow instructs use of Feishu write-capable credentials and a script that creates wiki nodes and inserts content into a remote system, but it does not warn the user that running these steps will consume secrets and perform external state-changing actions. In an agent skill context, this increases the chance of unintended publication, misuse of privileged tokens, or execution against the wrong workspace without explicit user awareness or confirmation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The GitHub workflow describes creating an issue with a repository-scoped token but omits any warning that this will create a persistent remote artifact in GitHub using privileged credentials. In a skill that automates cross-platform updates, that omission can lead to accidental issue creation, misuse of tokens, or writes to the wrong repository if the operator is not prompted to verify the destination.

External Transmission

Medium
Category
Data Exfiltration
Content
#    Production use should parse markdown into Feishu block structures.
ESCAPED_CONTENT=$(echo "$CONTENT" | jq -Rs .)

curl -s -X POST "https://open.feishu.cn/open-apis/docx/v1/documents/${OBJ_TOKEN}/blocks/${OBJ_TOKEN}/children" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{
Confidence
92% confidence
Finding
curl -s -X POST "https://open.feishu.cn/open-apis/docx/v1/documents/${OBJ_TOKEN}/blocks/${OBJ_TOKEN}/children" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.