ClawHub
Back to skill

Security audit

WhatsApp表情搜索

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly describes a WhatsApp GIF sender, but its routing text and broad automation claims could cause it to be invoked for unrelated SEO tasks while using command execution, network downloads, media conversion, and message sending.

Review this skill before installing. Use it only for user-directed WhatsApp GIF sending, confirm the exact recipient and selected media before sending, and avoid enabling it for SEO or general automation prompts. Run conversion with least privilege, validate media URLs, and avoid fixed /tmp filenames if adapting the workflow.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:95
Finding

Unvalidated Remote Media Download and Processing

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 95-98
Vulnerability Type: Unrestricted remote resource retrieval followed by unsafe media parsing
Risk Level: Medium

bash
curl -sL "GIF_URL" -o /tmp/gif.gif
ffmpeg -i /tmp/gif.gif -movflags faststart -pix_fmt yuv420p \
  -vf "scale=trunc(iw/2)*2:trunc(ih/2)*2" /tmp/gif.mp4 -y
cp /tmp/gif.mp4 /root/.skill-platform/workspace/gif.mp4

Equivalent download-and-conversion patterns also appear at lines 116-119, 133-136, and 184-191.

Technical Analysis

The Skill instructs the Agent to follow redirects with curl -L, download a selected URL, and immediately process the response with ffmpeg. It does not require validation of:

  • The URL scheme or destination host
  • Redirect destinations
  • Response size
  • MIME type or media signature
  • Download and conversion time limits
  • Media dimensions, frame count, or decompression limits

Although quoting the URL prevents direct shell metacharacter injection, it does not prevent retrieval from an unintended host or scheme. If an attacker can influence a search result, selected URL, or user-supplied URL, the Agent may request internal or otherwise unauthorized resources. The resulting attacker-controlled bytes are then passed to a complex native media parser.

Malformed media may consume excessive CPU, memory, or disk space. It could also exercise a vulnerability in the locally installed ffmpeg version. The document does not pin or verify the converter version and does not require media conversion to occur inside a restricted sandbox.

Attack Path

  1. An attacker supplies or influences a URL presented as a GIF search result.
  2. The Agent inserts that value into the documented curl -sL command.
  3. curl retrieves the resource and follows redirects without checking that the final destination remains on an approved Tenor or Giphy media host.
  4. The response is stored locally regardless of its a ...[truncated 1036 chars]
Remediation
View remediation

Remediation Suggestions

  1. Accept only https:// URLs and validate them with a structured URL parser rather than string-prefix checks.
  2. Maintain an explicit allowlist of approved Tenor and Giphy media hosts.
  3. Resolve and validate every redirect target; reject redirects to unapproved hosts, private IP ranges, loopback addresses, link-local addresses, and local schemes.
  4. Add strict connection, transfer, and total-operation timeouts.
  5. Enforce a conservative maximum response size before conversion.
  6. Verify both the response MIME type and the downloaded file signature.
  7. Apply limits for dimensions, duration, frame count, output size, CPU time, and memory.
  8. Run ffmpeg as an unprivileged user in a sandbox with no network access and access only to a private input/output directory.
  9. Pin ffmpeg to a supported, patched version and apply security updates.
  10. Require explicit user confirmation of the selected media and recipient before sending.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:133
Finding

Predictable Temporary Files in a Potentially Privileged Workflow

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 133-136
Vulnerability Type: Insecure temporary-file handling and potential symlink race
Risk Level: Medium

bash
curl -sL "URL" -o /tmp/g.gif && \
ffmpeg -i /tmp/g.gif -movflags faststart -pix_fmt yuv420p \
  -vf "scale=trunc(iw/2)*2:trunc(ih/2)*2" /tmp/g.mp4 -y 2>/dev/null && \
cp /tmp/g.mp4 /root/.skill-platform/workspace/g.mp4

Other fixed temporary names are used at lines 95-98, 116-119, and 184-191.

Technical Analysis

The workflow stores input and output in the shared /tmp directory under predictable names such as /tmp/g.gif, /tmp/g.mp4, /tmp/gif.gif, and /tmp/gif.mp4. It does not create a private temporary directory, check for symbolic links, or use exclusive file creation.

curl -o writes to the specified path, while ffmpeg -y explicitly allows the output path to be overwritten. On a multi-user system, another local process may pre-create one of these paths as a symbolic link or replace a file between workflow stages. This creates time-of-check/time-of-use and symlink risks.

The subsequent copy into /root/.skill-platform/workspace/ suggests that the workflow may execute with elevated privileges. If so, writes through attacker-prepared links occur with those elevated permissions. Even without elevated privileges, an attacker sharing the same host may replace the converted media before it is copied or sent.

Attack Path

  1. A local attacker predicts that the Skill will use /tmp/g.gif or /tmp/g.mp4.
  2. Before execution, the attacker creates the predictable path as a symbolic link to a file writable by the Agent, or repeatedly replaces the path during processing.
  3. curl or ffmpeg -y opens the attacker-controlled path and follows the link.
  4. The target file is overwritten with downloaded or converted data under the Agent process permissions.
  5. Alternatively, the attacker replaces `/tmp/g.m ...[truncated 860 chars]
Remediation
View remediation

Remediation Suggestions

  1. Run the workflow as a dedicated, unprivileged service account rather than root.
  2. Create a private temporary directory using mktemp -d and set permissions to 0700.
  3. Generate unpredictable input and output filenames inside that directory.
  4. Refuse symbolic links and use exclusive file-creation semantics where supported.
  5. Verify file ownership, type, link count, and resolved path before every processing and copy operation.
  6. Keep all conversion stages within the private directory and atomically move the validated final output into the workspace.
  7. Add a shell cleanup trap to delete temporary data on success, failure, or interruption.
  8. Use a unique workspace filename for each operation rather than repeatedly overwriting g.mp4 or gif.mp4.
  9. Ensure the workspace permits writes only by the dedicated Agent account.
  10. Avoid suppressing all ffmpeg errors with 2>/dev/null; securely log conversion failures so suspicious file replacement or parser errors can be detected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest description mixes unrelated SEO/keyword-ranking use cases into a WhatsApp GIF search/send skill, which misrepresents the tool’s purpose and can cause the agent to invoke it in the wrong context. In an agent ecosystem, misleading routing metadata is security-relevant because it broadens activation scope and may trigger network downloads and message-sending behavior for tasks unrelated to messaging.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger condition explicitly says to use the skill for SEO optimization, keyword analysis, ranking improvement, and search-traffic tasks, which directly contradicts the documented GIF/WhatsApp behavior. This can cause an agent to select a skill with exec and network-capable workflows for unrelated tasks, increasing the chance of unintended command execution, downloads, and message delivery.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

An overly broad, unrelated trigger condition is a true security issue in a skill because it affects when the agent may autonomously choose the skill. Here, the mismatch is especially risky because the skill has exec permission and operational instructions for downloading external content and sending messages, so incorrect activation could lead to unintended external side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description says the skill supports Chinese interaction, and later text emphasizes Chinese interaction as a core capability, but there is no indication that users may choose another language. This can violate language or locale policy when a skill appears to privilege one language without explicit opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes downloading media from Tenor/Giphy, converting it locally, and sending it to WhatsApp, but it does not prominently warn that this causes outbound network requests and message delivery to third parties. In a messaging context, lack of clear disclosure can lead to privacy surprises, accidental recipient targeting, and unintended transmission of externally sourced content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
brew install ffmpeg

# Ubuntu/Debian
sudo apt install ffmpeg

# 验证安装
ffmpeg -version

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The later capability and efficiency sections describe generic file processing, API aggregation, repeated task execution, and broad automation benefits that do not match a narrowly scoped WhatsApp GIF tool. This overstatement can expand perceived authority, encourage unsafe reuse, and cause agents or users to treat the skill as a general automation primitive rather than a constrained media-sending helper.

Content

No source excerpt is available for this finding.