ClawHub
Back to skill

Security audit

biometric-confirm

Security checks for vulnerabilities and agentic risk

Overview

The skill claims to enforce biometric approval for sensitive actions, but the package does not include the verification service it tells the agent to run.

Review before installing. This does not look malicious, but it should not be trusted as a real biometric gate unless the missing biometric_service.py or equivalent verified integration is supplied, scoped, and tested. Otherwise users may believe sensitive actions are protected when the artifact cannot actually enforce that protection.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is biometric confirmation for sensitive actions, but the analyzed behavior indicates the skill instead reads local metadata, validates document structure, and runs test assertions rather than performing real biometric verification. In a security control skill, this mismatch is dangerous because downstream systems or operators may assume sensitive operations are protected when the skill is not actually enforcing the promised second factor.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger terms include broad phrases such as '生物识别' and '二次确认', which can activate the skill outside the intended context of sensitive operations. Overbroad activation is risky here because this skill gates high-impact actions, and accidental invocation or routing confusion can cause inconsistent enforcement, user friction, or incorrect security decisions around privileged operations.

Static analysis

No suspicious patterns detected.