ClawHub
Back to skill

Security audit

delivery-verifier

Security checks for vulnerabilities and agentic risk

Overview

This delivery-verification skill mostly matches its stated purpose, but it asks for broad execution and sensitive integration access while also making an unscoped outbound link request and including under-disclosed chat inspection logic.

Review this skill before installing in a trusted environment. It should only be used if you are comfortable granting it Python execution, access to Xianyu chat/order verification services, and outbound access to submitted delivery links. Prefer tightening it to documented MCP calls, removing unused required secrets, documenting or removing the AI-declaration check, and restricting link validation to approved cloud-drive domains.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares tools `read` and `exec` and requires sensitive environment variables (`ALIST_TOKEN`, `SILICONFLOW_API_KEY`), while the static analysis indicates broader effective capabilities including environment access, file access, and network use without explicit permission modeling. That creates an over-privileged verification skill: if its logic or downstream dependencies are modified or abused, it could read secrets, access files, or make unintended outbound requests beyond simple post-delivery verification.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
A description-behavior mismatch is security-relevant because the skill is presented as a narrow delivery verifier, but analysis indicates hidden extra logic such as checking for specific product-type chat content and unrelated test code inspecting document structure. Undisclosed behavior increases the chance of covert data inspection, policy bypass, or future abuse because operators may grant trust and access based on the benign description while the implementation does more than advertised.

Description-Behavior Mismatch

Low
Confidence
88% confidence
Finding
The skill performs a direct HTTP HEAD request to a user-supplied link URL, while the evidence claims verification via alist-mcp. Direct outbound requests against attacker-controlled URLs can enable SSRF-style probing of internal services or unintended access to sensitive network locations, especially if this verifier runs in a trusted internal environment.

Static analysis

No suspicious patterns detected.