ClawHub
Back to skill

Security audit

物料清单漏洞情报专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly an SBOM vulnerability scanner, but its activation text is overbroad for a command-executing skill and could pull it into unrelated operations tasks.

Review before installing. Use this only for supply-chain security tasks where you are comfortable letting the agent run local scanner commands and send dependency metadata to OSV/NVD or configured alert webhooks. Avoid using real webhook URLs or API keys inline, and prefer approved internal scanners or mirrors for private enterprise dependency inventories.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest broadens the skill from SBOM and vulnerability intelligence into generic system monitoring, log analysis, ops alerting, and deployment management. Overly broad scope increases the chance the agent will invoke this skill in unrelated contexts and execute its `exec`-backed commands with more authority than users intended.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The skill's safety guidance says secrets should not be hardcoded, yet the monitoring example places a webhook endpoint directly in configuration. Even if the sample value is placeholder-like, normalizing inline webhook configuration encourages users to store real notification endpoints in files that may be committed, shared, or exposed through logs.

Vague Triggers

High
Confidence
96% confidence
Finding
The activation text is broad enough to match many generic operational requests unrelated to SBOM analysis. In a skill that advertises `exec` capability, this can cause unsafe over-selection and execution of shell-based workflows in contexts where the user did not intend to grant broad operational control.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The coverage keyword list includes vague terms like 'Use', 'when', and broad ops language that can trigger the skill opportunistically. Ambiguous routing guidance makes accidental invocation more likely, which is risky because the skill contains command execution and external network interactions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The monitoring design sends alerts via webhook but does not clearly warn that vulnerability findings, project names, SBOM-derived component data, or other security metadata may be transmitted to third-party services. This can lead to unintended disclosure of internal inventory and vulnerability posture outside the organization.

External Transmission

Medium
Category
Data Exfiltration
Content
}
    def _query_osv(self, pkg, version, ecosystem):
        """查询OSV数据库"""
        resp = requests.post(
            "https://api.osv.dev/v1/query",
            json={
                "package": {"name": pkg, "ecosystem": ecosystem},
Confidence
90% confidence
Finding
The code transmits package names, ecosystem identifiers, and versions to an external OSV service. In SBOM tooling this is expected functionality, but dependency metadata can still reveal internal technology choices, unreleased components, or proprietary package names if sent without user awareness or controls.

External Transmission

Medium
Category
Data Exfiltration
Content
}
    def _query_osv(self, pkg, version, ecosystem):
        """查询OSV数据库"""
        resp = requests.post(
            "https://api.osv.dev/v1/query",
            json={
                "package": {"name": pkg, "ecosystem": ecosystem},
Confidence
90% confidence
Finding
The code transmits package names, ecosystem identifiers, and versions to an external OSV service. In SBOM tooling this is expected functionality, but dependency metadata can still reveal internal technology choices, unreleased components, or proprietary package names if sent without user awareness or controls.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "扫描: ${project}"
    jq -r '.components[]? | "\(.name) \(.version) \(.ecosystem // "npm")"' "$sbom" | \
    while read -r name version eco; do
        curl -s -X POST "https://api.osv.dev/v1/query" \
            -H "Content-Type: application/json" \
            -d "{\"package\": {\"name\": \"${name}\", \"ecosystem\": \"${eco}\"}, \"version\": \"${version}\"}" | \
            jq --arg n "$name" --arg v "$version" '{
Confidence
90% confidence
Finding
The shell workflow posts SBOM-derived component metadata to the OSV API for each dependency. This can expose internal package inventories and versions to an external service at scale, especially in enterprise scans covering private or pre-release software.

External Transmission

Medium
Category
Data Exfiltration
Content
CRITICAL=0
          jq -r '.components[] | "\(.name) \(.version)"' sbom.json | \
          while read -r name version; do
            COUNT=$(curl -s -X POST "https://api.osv.dev/v1/query" \
              -H "Content-Type: application/json" \
              -d "{\"package\": {\"name\": \"${name}\", \"ecosystem\": \"npm\"}, \"version\": \"${version}\"}" \
              | jq '.vulns | length // 0')
Confidence
90% confidence
Finding
The CI/CD example sends dependency names and versions from build artifacts to an external service during pipeline execution. In CI this is particularly sensitive because it may disclose repository contents, dependency state, and release timing to third parties.

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.vulns | length // 0')
            if [ "$COUNT" -gt 0 ]; then
              echo "${name}@${version}: ${COUNT} vulns"
              SEVERITY=$(curl -s -X POST "https://api.osv.dev/v1/query" \
                -H "Content-Type: application/json" \
                -d "{\"package\": {\"name\": \"${name}\", \"ecosystem\": \"npm\"}, \"version\": \"${version}\"}" \
                | jq -r '.vulns[]? | .severity // "UNKNOWN"' | grep -c "CRITICAL")
Confidence
90% confidence
Finding
A second CI pipeline step again posts dependency metadata externally to derive severity information, increasing both egress volume and exposure of the same package set. Repeated outbound calls also amplify logging, monitoring, and rate-limit side effects in shared build environments.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "扫描: ${project}"
    jq -r '.components[]? | "\(.name) \(.version) \(.ecosystem // "npm")"' "$sbom" | \
    while read -r name version eco; do
        curl -s -X POST "https://api.osv.dev/v1/query" \
            -H "Content-Type: application/json" \
            -d "{\"package\": {\"name\": \"${name}\", \"ecosystem\": \"${eco}\"}, \"version\": \"${version}\"}" | \
            jq --arg n "$name" --arg v "$version" '{
Confidence
90% confidence
Finding
The shell workflow posts SBOM-derived component metadata to the OSV API for each dependency. This can expose internal package inventories and versions to an external service at scale, especially in enterprise scans covering private or pre-release software.

External Transmission

Medium
Category
Data Exfiltration
Content
CRITICAL=0
          jq -r '.components[] | "\(.name) \(.version)"' sbom.json | \
          while read -r name version; do
            COUNT=$(curl -s -X POST "https://api.osv.dev/v1/query" \
              -H "Content-Type: application/json" \
              -d "{\"package\": {\"name\": \"${name}\", \"ecosystem\": \"npm\"}, \"version\": \"${version}\"}" \
              | jq '.vulns | length // 0')
Confidence
90% confidence
Finding
The CI/CD example sends dependency names and versions from build artifacts to an external service during pipeline execution. In CI this is particularly sensitive because it may disclose repository contents, dependency state, and release timing to third parties.

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.vulns | length // 0')
            if [ "$COUNT" -gt 0 ]; then
              echo "${name}@${version}: ${COUNT} vulns"
              SEVERITY=$(curl -s -X POST "https://api.osv.dev/v1/query" \
                -H "Content-Type: application/json" \
                -d "{\"package\": {\"name\": \"${name}\", \"ecosystem\": \"npm\"}, \"version\": \"${version}\"}" \
                | jq -r '.vulns[]? | .severity // "UNKNOWN"' | grep -c "CRITICAL")
Confidence
90% confidence
Finding
A second CI pipeline step again posts dependency metadata externally to derive severity information, increasing both egress volume and exposure of the same package set. Repeated outbound calls also amplify logging, monitoring, and rate-limit side effects in shared build environments.

Static analysis

No suspicious patterns detected.