ClawHub
Back to skill

Security audit

JS SDK工具免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a JavaScript AI SDK guide, but it needs Review because it encourages public local-file uploads and leaves shell/write authority and dependency installation too loosely scoped.

Review this skill before installing. Use it only for non-sensitive JavaScript SDK experiments, verify and pin any npm packages before installation, avoid running shell commands automatically, and do not upload private files unless you understand where they go, who can access them, and how they can be deleted. Remove public: true or require explicit confirmation before any public upload.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:192
Finding

Unverified and Unpinned SDK Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:120
Finding

Local File Upload Configured with Public Visibility

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
const client = createClient({ apiKey: 'your_api_key' });
   
   // 或使用环境变量（推荐）
   // .env 文件
   AI_API_KEY=your_api_key
   
   const client = createClient({ apiKey: process.env.AI_API_KEY });

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

md
const client = createClient({ apiKey: 'your_api_key' });
   
   // 或使用环境变量（推荐）
   // .env 文件
   AI_API_KEY=your_api_key
   
   const client = createClient({ apiKey: process.env.AI_API_KEY });

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description includes broad 'use when' language covering general AI model calls, agent orchestration, and LLM applications without meaningful scope boundaries. In a skill that exposes read/exec/write tools, vague activation guidance can lead to unnecessary invocation in higher-risk situations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description explicitly states '支持中文交互' and is written as a default behavioral characteristic, but does not indicate that language is optional or user-selectable. Under the policy, language or locale constraints should not be forced without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The functionality note lists '中文交互' as a core capability without clarifying that the user can choose another language. This can be interpreted as a default language constraint rather than optional support.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to upload files and even shows an example with public: true, but it does not clearly warn that files may be transmitted to external services or exposed publicly. This can cause accidental disclosure of sensitive local files, especially when path-based auto-upload is used.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are written so broadly that ordinary API integration, webhook, or system connection requests could activate this skill outside its narrow intended purpose. Overbroad activation increases the chance that an agent invokes a skill with exec/write access in contexts where safer or more specialized skills should be used.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill claims that only whitelist commands will be executed, but no whitelist is actually defined and the manifest permits broad exec and write capabilities. This creates a misleading safety boundary that may cause users or agents to trust shell execution more than warranted, increasing the chance of unsafe command execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.