ClawHub
Back to skill

Security audit

酷家乐AI室内设计

Security checks across malware telemetry and agentic risk

Overview

This skill is a Kujiale interior-design workflow, with expected cloud uploads and token use that users should handle carefully.

Before installing, confirm you are comfortable sending floorplan images and design data to Kujiale. Store the Kujiale token outside version control, restrict file permissions on any local config file, and make sure quota-consuming layout or render steps only run after your explicit confirmation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documentation is internally inconsistent about secret handling: it first presents environment-variable configuration, but the actual workflow directs the agent to read the Kujiale access token from a local `.kjlconfig.json` file. Storing long-lived tokens in project files materially increases the chance of accidental exposure through source control, workspace sharing, logs, backups, or other tools that can read local files.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The security section claims API keys are protected via environment variables and not hardcoded, but the earlier workflow contradicts that by requiring storage of the access token in a local config file. This mismatch creates a false sense of safety and can lead operators to adopt insecure handling practices for sensitive credentials.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to watch for uploaded floorplan images and send them to an external Kujiale workflow, but it does not give a clear privacy warning or informed-consent notice at the point of transmission. Floorplan images can reveal sensitive residential information, so silent upload to a third-party service creates privacy and compliance risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.