ClawHub
Back to skill

Security audit

文件管理整理

Security checks for vulnerabilities and agentic risk

Overview

This file-management skill is broadly purpose-aligned, but it asks for powerful local file authority while relying on unenforced safety claims and vague controls around deletion, command execution, and callbacks.

Install only if you are comfortable giving the agent access to local files for organization tasks. Use it with narrow folders, require a preview before moves or deletions, keep backups, avoid permanent deletion, and do not provide callback URLs or API keys unless you trust the destination and understand what data may be sent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill repeatedly states that file moves will only occur after user approval, but this is a Markdown-only skill with no enforcement mechanism. In an agentic environment with read/write/exec tools, operators may trust the documentation and permit autonomous file operations that proceed without a real confirmation gate, increasing risk of unintended or destructive changes.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The document claims commands are executed in a safe sandbox and restricted to a whitelist, but no such controls exist in the artifact. This can create misplaced trust and lead users or orchestrators to allow exec-enabled runs under the assumption that dangerous shell operations are constrained when they are not.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill describes deletion, cleanup, archive handling, and reorganization of user files without a prominent upfront warning that actions may be destructive or irreversible. In a file-management context, this increases the chance that a user or agent will perform bulk operations before understanding deletion and data-loss risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documented callback_url parameter introduces potential outbound transmission of task results or metadata, but there is no privacy, trust-boundary, or destination validation warning. In a skill handling file-management tasks and potentially sensitive document inventories, this could lead to unintentional exfiltration of filenames, paths, or derived content to attacker-controlled endpoints.

Static analysis

No suspicious patterns detected.