ClawHub
Back to skill

Security audit

Mac 系统工具

Security checks for vulnerabilities and agentic risk

Overview

This macOS control skill is mostly aligned with its purpose, but it needs Review because it includes high-impact local commands with weak scoping and an unrelated trigger condition.

Install only if you are comfortable with an agent running local macOS commands. Confirm exact process IDs and deletion paths before any kill or trash-emptying action, avoid using screenshot or clipboard commands around sensitive data, and treat the data-analysis trigger as erroneous.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill markets the free edition as focused on read-only queries and basic control, yet later documents destructive actions such as process termination and trash deletion. This mismatch can cause users or agents to trust the skill more than warranted and execute harmful operations under a misleading safety model.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger condition says to use the skill for data analysis, reporting, statistics, and visualization, which does not match the actual macOS control functionality. Overbroad and incorrect invocation criteria increase the chance an agent will activate this skill in unrelated contexts and run local system commands unexpectedly.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The examples encourage screenshot capture and clipboard read/write operations without prominently warning that these may expose sensitive on-screen data, copied secrets, tokens, or personal content. In an agent-execution context, these commands can silently collect or overwrite private user data if invoked casually.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| 复制到剪贴板 | `echo x \| pbcopy` |
| 粘贴 | `pbpaste` |
| 打开 Finder | `open .` |
| 清空废纸篓 | `rm -rf ./.Trash/*`（先确认） |

## 安全操作规范
Confidence
97% confidence
Finding
The skill includes a raw `rm -rf ./.Trash/*` deletion command in a markdown-executable context. Even with a parenthetical 'confirm first' note, destructive filesystem operations are dangerous because path mistakes, environment differences, or agent misuse can irreversibly delete user data, and the command bypasses safer platform trash-management APIs.

Static analysis

No suspicious patterns detected.