ClawHub
Back to skill

Security audit

account-pool-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it manages many account cookies and publishing rotation with under-scoped safeguards users should review before installing.

Install only if you intend to manage a multi-account publishing pool and are comfortable with local scripts reading cookie files, writing account state, and optionally sending cookies to platform verification APIs. Prefer using tenant-specific checks, avoid running broad verification across all cookies, and require input validation before allowing untrusted account registration data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill's stated purpose is account-pool management, but the documentation expands into real publishing workflows, anti-risk posting intervals, and integration with automated publishing. This scope creep increases the chance that a seemingly administrative skill will be used to facilitate multi-account automated content operations, reducing oversight and making misuse or policy-violating automation easier.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Granting exec to a skill whose core function is managing account metadata and checking cookie health is broader than necessary as documented. Overbroad execution capability raises the blast radius if the skill is misused, modified, or chained with untrusted inputs, because arbitrary local commands or scripts could be launched under the guise of account maintenance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

register_account accepts an arbitrary department value and unconditionally creates BASE_DIR / department with mkdir(parents=True), instead of restricting values to the intended fixed set. If an attacker can invoke this script with crafted input such as path traversal segments, they may create directories and write account JSON files outside the intended account-pool hierarchy, causing unauthorized file creation or corruption of adjacent application data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill describes file-writing and exec-based workflows that create directories, update account state, and run scripts, but it does not warn users about filesystem changes, credential/cookie sensitivity, or process execution impact. Lack of transparency can lead operators to trigger sensitive actions without informed consent, increasing the risk of accidental credential exposure or unintended system modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

When verification is enabled, the code constructs a Cookie header from local cookie files and sends it to third-party platform APIs to test login validity. Even if this is functionally intended, cookies are highly sensitive credentials, and transmitting them off-box without explicit consent, clear audit controls, or scoping increases the chance of account takeover if logs, proxies, or misdirected requests expose them.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The code is designed to contact external APIs and, during verification, attaches a Cookie header derived from stored authentication material. In the context of an account-pool manager, this increases sensitivity because the system handles many accounts and tenants, so a mistake, interception point, or unintended invocation can expose reusable session credentials at scale.

Content

Scanner excerpt · scripts/cookie_health.py (reported line 27)May include surrounding context.

python
"segmentfault","bilibili","sohu"}
# API验证策略（来源: content_stats_collector.py已验证的API）
API_VERIFY = {
    "bilibili": ("https://api.bilibili.com/x/web-interface/nav",
                 lambda d: d.get("data",{}).get("isLogin") is True),
    "zhihu": ("https://www.zhihu.com/api/v4/me",
              lambda d: "id" in d and d.get("id") is not None),

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

This external transmission path is another instance of remote cookie validation against a third-party API. Because the script manages multi-account cookies and can scan broad directories, the operational context amplifies privacy and credential-exposure risk if verification is run broadly or without tenant safeguards.

Content

Scanner excerpt · scripts/cookie_health.py (reported line 31)May include surrounding context.

python
lambda d: d.get("data",{}).get("isLogin") is True),
    "zhihu": ("https://www.zhihu.com/api/v4/me",
              lambda d: "id" in d and d.get("id") is not None),
    "juejin": ("https://api.juejin.cn/user_api/v1/user/get",
               lambda d: d.get("data",{}).get("user_id") is not None),
}
MCP_VERIFY = {"xianyu": ("fishclaw-mcp", "check_cookie_validity")}

Static analysis

No suspicious patterns detected.