ClawHub
Back to skill

Security audit

笔记

Security checks for vulnerabilities and agentic risk

Overview

This skill looks like a note-taking helper, but its instructions also introduce an unscoped command-line task tool with execution, writing, and logging behavior that is not clearly bounded.

Review this skill carefully before installing. It is not evidence of malware, but it should be treated as requiring human review because the advertised note-taking purpose does not cleanly match the task CLI, command execution, file writing, API key, and history logging instructions. Install only if you are comfortable granting read/write/exec authority and can constrain where it stores logs and what commands it may run.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata presents a benign note-organizing assistant, but the body documents a task/todo CLI with commands such as add, done, priority, remind, export, and history logging. This capability mismatch can mislead an agent or user into invoking broader file/command behaviors than expected, increasing the risk of unintended command execution, data modification, or sensitive data logging.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill is described both as MD+execute() and later as pure Markdown/natural-language-driven, while the manifest also requests read/exec/write tools. This ambiguity weakens operator expectations and can cause an agent to grant or use execution privileges under a misleading 'documentation-only' framing, expanding the attack surface for filesystem or shell actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The invocation guidance is overly broad, effectively suggesting the skill for many AI/agent/LLM scenarios rather than a narrowly defined note-taking workflow. Broad activation criteria can cause inappropriate invocation in unrelated contexts, where the skill's read/exec/write permissions and ambiguous behavior may be unnecessarily exposed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.