ClawHub
Back to skill

Security audit

llm-provider AI工具

Security checks for vulnerabilities and agentic risk

Overview

This skill is for OpenAI account automation, but it gives broad command/file authority and shows account-changing provider actions without enough upfront warning and confirmation structure.

Review this skill before installing. It appears intended for legitimate OpenAI/llm-provider automation, but use it only when you explicitly want ClawLink to call the provider on your behalf. Do not provide sensitive files or prompts unless you are comfortable with provider-side processing and possible retention, and require a preview plus explicit confirmation before uploads, assistant/vector-store changes, batch jobs, fine-tuning, deletes, or other write actions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill says write actions should always be confirmed first, but elsewhere it presents direct execution patterns and resource-creation examples without a strong, repeated confirmation gate. That inconsistency can cause an agent or user to treat mutating operations as routine, increasing the chance of unintended remote changes such as file uploads, assistant creation, or vector store modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation guidance is overly broad, effectively suggesting use for generic AI-model, chat, agent, and workflow requests. This can cause over-selection of the skill in contexts where external calls, account changes, or data transfer are unnecessary, raising the risk of accidental data exposure or unintended tool execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill does not prominently warn at the start that prompts, files, and other user data may be sent to an external LLM provider. Because the skill includes upload, assistant, vector store, and batch operations, users may invoke it without understanding that sensitive content could leave the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The operations section documents commands that can create chat completions, files, assistants, vector stores, and other remote resources, but it does not clearly foreground that these are account-affecting write actions. In context, this is more dangerous because the skill advertises broad automation and includes exec/write capabilities, so an agent may proceed with state-changing actions that incur cost, persist data, or alter provider resources.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.