ClawHub
Back to skill

Security audit

Bookmark Smart Hub

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent bookmark-monitoring purpose, but it asks users to run unaudited install/daemon commands and store sensitive session/API credentials with inconsistent privacy claims.

Review this before installing. Do not place real social session tokens, AI keys, bot tokens, or Slack webhooks into this skill unless you trust the publisher and can verify the missing implementation. Avoid global npm installs from these instructions without pinned package provenance, and treat the PM2 daemon as persistent software that may keep processing bookmark content and sending data to external services.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:168
Finding

Unpinned Global npm Package Installation Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:230
Finding

API Keys and Session Credentials Are Stored in Plaintext Configuration Files

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:168
Finding

Missing Implementation Prevents Verification of Executable and Privacy Claims

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The skill explicitly instructs users to provision and store high-value secrets including social auth tokens, AI API keys, and notification credentials. In an agent-skill context with read/exec/write capabilities, encouraging credential placement in accessible local files increases the blast radius of any compromise or accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

  • 在 config.json 的 aiApiKey 字段配置 AI 分析模型 API Key.
  • 通知渠道凭证（Telegram Bot Token、Slack Webhook 等）在对应通知配置中填入.
bash
# .env 环境变量示例
AUTH_TOKEN=your_social_auth_token
CT0=your_social_ct0_token
AI_API_KEY=your_ai_api_key

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation guidance is very broad and encourages use whenever AI/model invocation or agent orchestration is needed, without clear limits, trust boundaries, or consent requirements. In the context of a skill that can execute commands, run background monitoring, and handle credentials, overly broad triggers increase the chance of unsafe or unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes daemonized background monitoring, PM2 management, notifications, credential setup, and external AI/API use without prominent up-front warnings or consent gating. Because these behaviors persist, access external services, and may process sensitive content, the lack of early warning materially increases user risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document states 'no telemetry, no callback/upload' while also describing transmission of article content to external LLM APIs and use of external notification services like Telegram and Slack. This contradiction is security-relevant because users may believe data never leaves the host when in fact content is sent to third parties.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill claims it does not store personal credentials or sensitive information, yet elsewhere explicitly instructs users to place tokens and API keys in local .env and config files. This is a materially misleading privacy/security statement that can cause users to underestimate the sensitivity of the local files and mishandle secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.