ClawHub
Back to skill

Security audit

CAN内容寻址

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a useful content-addressing idea, but it mixes local-only claims with third-party endpoint use, broad activation language, and broad read/write/exec authority.

Review this skill before installing. Use it only for explicit CAN/content-addressing tasks, avoid sending sensitive labels or workflow metadata to xc.cx unless you trust that service, and do not provide API keys unless a specific trusted integration requires them.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Intent-Code Divergence

High
Confidence
94% confidence
Finding
The skill repeatedly claims CAN is primarily a local, append-only indexing approach, but the usage section directs users to POST records to a third-party endpoint and view logs remotely. This mismatch can cause users to disclose timestamps, hashes, labels, and possibly workflow-derived metadata to an external service under the false assumption that processing is local-only, undermining confidentiality and trust boundaries.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The document says the skill can be self-evaluated without API calls or endpoints, yet nearby sections introduce API-key configuration and external API usage. These contradictory instructions can mislead operators into enabling network access or configuring secrets unnecessarily, increasing the chance of secret exposure and unintended outbound data flow.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
The skill is presented as a content-address naming protocol, but its description broadens scope to analytics, reporting, visualization, workflow automation, and execution-related use cases. Overbroad claims can trigger the skill in contexts unrelated to its core function, leading agents to grant it access or invoke tools such as exec/write where they are unnecessary, expanding attack surface and user surprise.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation language is so broad that ordinary data-analysis or reporting requests may match this skill even when users did not ask for content-address naming. In an agent environment, over-triggering can route benign tasks into a skill that declares read/write/exec capabilities, increasing the risk of unnecessary command execution, data handling, or network use.

Static analysis

No suspicious patterns detected.