ClawHub
Back to skill

Security audit

Bookmark Smart Hub Free

Security checks for vulnerabilities and agentic risk

Overview

The bookmark workflow is plausible, but it asks users to handle raw account session credentials and run an unpinned global CLI with incomplete scoping and disclosure.

Review this skill carefully before installing. Use it only in an isolated workspace, avoid production or primary-account session tokens, verify the bird CLI package and version yourself, and do not let an agent echo, log, or broadly source the .env credentials. Treat saved bookmark content as private local data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:241
Finding

Unpinned Third-Party CLI Installed Globally

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 241
Vulnerability Type: Supply-chain exposure through an unpinned global npm dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash
npm install -g bird

The same installation command is also referenced in the dependency table at line 281.

Technical Analysis

The skill directs users or agents to install the npm package bird globally without specifying an exact version, package integrity hash, verified publisher, or authoritative source repository. The artifact also contains no package manifest or lockfile capable of providing reproducible dependency resolution.

Consequently, npm resolves whichever package version is current when the command runs. npm packages may execute lifecycle scripts during installation. If the named package or one of its transitive dependencies is compromised, replaced, or resolves to an unintended package, attacker-controlled code could execute during installation. The -g option increases exposure by installing the package into the user's global npm environment rather than isolating it within the project.

This finding establishes an insecure dependency-installation pattern. The audited artifact does not establish that the current bird package itself is malicious.

Attack Path

  1. An attacker compromises the resolved bird package, its publisher account, or a transitive dependency, or publishes a release containing a malicious lifecycle script.
  2. A user or tool-enabled agent follows the instruction in SKILL.md and runs npm install -g bird.
  3. npm retrieves the current unpinned package and dependencies from the configured registry.
  4. Malicious package code or lifecycle scripts execute with the privileges of the user running npm.
  5. The payload can access resources available to that user, potentially including the .env social-platform credentials used by this skill, and can modify files or the us ...[truncated 581 chars]
Remediation
View remediation

Remediation Suggestions

  1. Identify and document the exact official package, publisher, and source repository rather than relying only on the short package name.
  2. Pin a reviewed, known-good version instead of resolving the latest release dynamically.
  3. Add a project-local package.json and committed lockfile with integrity metadata to make installation reproducible.
  4. Prefer a local project dependency over npm install -g, and invoke its binary through a package script or npx --no-install.
  5. Review the package and its transitive dependencies, including lifecycle scripts, before approval.
  6. Where compatible with the dependency, install with lifecycle scripts disabled and enable only specifically reviewed build steps.
  7. Run installation without administrative privileges and in an isolated environment with no production credentials present.
  8. Document package provenance and periodically audit pinned dependencies for compromise and known vulnerabilities.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

The skill is explicitly designed to consume credentials from a local .env file, which is sensitive material equivalent to account access tokens. In the context of an agent skill with allowed-tools: read exec, any workflow that encourages reading, sourcing, or handling credential files expands the risk of accidental disclosure, misuse, or leakage through logs and subprocesses.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

json
{
  "credentialsFile": ".env",
  "bookmarkCount": 20,
  "storageDir": "~/knowledge/bookmarks",
  "notifyTelegram": false,

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The documentation instructs users to place live AUTH_TOKEN and CT0 values into a .env file. This creates a clear credential access pattern and, in an agent-execution context, increases the chance that tokens are read, sourced, committed, or exposed to tools beyond what the user expects.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

| analysisMode | 分析模式（免费版仅 keyword） | keyword | | contextProjects | 个人关注领域，辅助关键词匹配 | [] |

凭证配置（.env 文件）

bash
AUTH_TOKEN=your_auth_token_here

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The command source .env loads secrets directly into the shell environment before invoking an external CLI. This is a high-risk pattern because environment variables may be inherited by child processes, exposed in debugging/logging contexts, or misused by compromised tooling; in an agent setting with exec, it also normalizes direct secret materialization during execution.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

bash
cd skills/bookmark-smart-hub
source .env
bird whoami --json

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill performs two security-relevant actions: writing extracted content to local JSON files and fetching external links for full-text extraction, but the top-level description does not prominently warn users about either. This can lead to unintentional data collection, storage of sensitive content, or contact with untrusted remote sites without clear informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file defines a very broad '能力覆盖范围' using many loosely bounded keywords and generic verbs like 创建/查询/修改/删除, without clear activation constraints or negative examples. Such language makes it unclear when the skill should or should not be invoked, increasing the chance of unintended activation from ordinary bookmark- or content-related requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims credentials never leave the local machine, but also instructs users to provide those credentials to an external CLI (bird) to access the social platform. Even if this is operationally necessary, the documentation materially understates external credential use and could mislead users about trust boundaries, increasing the chance of unsafe credential handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file is entirely written in Chinese and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest repeatedly states that the free version excludes notification features, especially Telegram-style outbound alerts, but the sample config still exposes notifyTelegram. Even though it is set to false and labeled unsupported, the documentation presents a capability surface inconsistent with the stated product limits.

Content

No source excerpt is available for this finding.