ClawHub
Back to skill

Security audit

CDN内容分发管理工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is a CDN helper, but it gives the agent broad command and API-related authority without clear limits or confirmation steps.

Review this skill before installing if your agent has shell access or cloud/CDN credentials. It appears aimed at CDN management rather than malware, but you should only use it in a constrained workspace, provide CDN tokens only when needed, and require explicit approval before running commands or changing CDN, WAF, cache, DNS, or security settings.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill claims broad command-execution capability despite being framed as a CDN configuration and troubleshooting tool. In an agent environment, exposing generic exec capability without strict scope limits can let prompts pivot into arbitrary system command execution, increasing the risk of host compromise, destructive actions, or sensitive data access.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill description expands from CDN-specific guidance into broad file handling and external API integration, which materially widens the operational scope. Scope creep in agent skills is dangerous because users or upstream planners may invoke capabilities that touch local files or external services beyond what a CDN-focused skill should need, increasing the attack surface for data exfiltration or unauthorized changes.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The activation text uses broad trigger language such as invoking the skill whenever code generation, debugging, deployment, or any CDN-related need appears. Over-broad routing criteria can cause the agent to select this skill in unrelated or weakly related contexts, exposing its powerful tools and expanding opportunities for misuse through prompt injection or accidental execution.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The markdown advertises file writing, external API access, and command execution but does not provide corresponding user-facing safety warnings, approval requirements, or operational limits. In agent ecosystems, this omission is dangerous because it normalizes powerful actions without clarifying trust boundaries, making unintended destructive changes, credential leakage, or unauthorized network calls more likely.

Static analysis

No suspicious patterns detected.