ClawHub
Back to skill

Security audit

自集成工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed integration gateway helper, but it asks users to delegate broad SaaS access and execute external actions without enough scoping, confirmation, audit, or privacy guidance.

Install only if you trust the gateway operator and are comfortable giving it delegated access to connected SaaS accounts. Use narrowly scoped tokens and OAuth permissions, avoid sensitive payloads where possible, verify returned OAuth URLs before opening them, and manually confirm any write, delete, external-message, CRM, document, or account-changing action before execution.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:125
Finding

Unvalidated OAuth Authorization URL Supplied by an External Gateway

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:104
Finding

Broad Delegation of SaaS Access to a Centralized Gateway Without Documented Least-Privilege Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill declares the exec tool even though its documented purpose is limited to querying a gateway and invoking remote integration APIs. Granting arbitrary shell execution unnecessarily expands the capability boundary, creating a path for unintended local command execution, secret access, filesystem manipulation, or command injection if later prompts or parameters are mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises action execution across third-party apps but does not clearly warn users that those actions may create, modify, or delete external data. This omission increases the chance of unsafe or unintended state-changing operations because users may treat the skill like a read-only lookup tool when it is actually capable of mutating connected systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation instructs the agent to send bearer tokens and potentially user/application data to an external integration gateway and onward to connected SaaS platforms, but it does not provide a clear privacy and data-transfer warning. Users may unknowingly expose credentials, metadata, or business content to third parties without understanding storage, routing, logging, and retention implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example explicitly sends an authorization bearer token to an external domain to enumerate connections. External transmission is inherent to the skill's purpose, but it remains security-relevant because it exposes credentials and account metadata to a third-party gateway; the risk is elevated by the absence of strong privacy/scoping guidance.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

Step 2：检查已有连接

bash
curl https://api.integration-gateway.com/connections \
  -H "Authorization: Bearer $INTEGRATION_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example explicitly sends an authorization bearer token to an external domain to enumerate connections. External transmission is inherent to the skill's purpose, but it remains security-relevant because it exposes credentials and account metadata to a third-party gateway; the risk is elevated by the absence of strong privacy/scoping guidance.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

Step 2：检查已有连接

bash
curl https://api.integration-gateway.com/connections \
  -H "Authorization: Bearer $INTEGRATION_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill instructs transmission of a bearer token and search query to an external integration-gateway endpoint. While aligned with the integration use case, it still creates data exposure risk because user intent, target app selection, and authentication data are disclosed to a third party.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

搜索目标应用的连接器：

bash
curl "https://api.integration-gateway.com/search?q=slack" \
  -H "Authorization: Bearer $INTEGRATION_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This request sends a bearer token and connector identifier to an external service to create an OAuth connection request. That is core functionality, but it is security-sensitive because it initiates trust relationships with third-party apps and may expose organizational integration metadata if triggered without sufficient user awareness or approval.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

找到elementType: "connector"的结果，使用其id创建连接请求：

bash
curl -X POST https://api.integration-gateway.com/connection-requests \
  -H "Authorization: Bearer $INTEGRATION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"connectorId": "cnt_abc123"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The action search request transmits the bearer token, connection identifier, and natural-language intent to an external service. This may reveal internal workflow details or business context, and the returned actions could enable sensitive downstream operations if users are not clearly informed about the external processing involved.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

授权完成后，搜索可用动作：

bash
curl "https://api.integration-gateway.com/actions?connectionId=con_abc123&intent=send+a+message&limit=10" \
  -H "Authorization: Bearer $INTEGRATION_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This example executes a remote action against a connected third-party application, sending the bearer token, connection ID, and user payload externally. In context, this is the most dangerous operation because it can directly modify external systems and transmit potentially sensitive content, yet the skill lacks strong warnings, confirmation requirements, and privacy guidance.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

执行动作：

bash
curl -X POST "https://api.integration-gateway.com/actions/act_xyz/run?connectionId=con_abc123" \
  -H "Authorization: Bearer $INTEGRATION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input": {"channel": "#general", "text": "Hello!"}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

查询已有连接

bash
curl https://api.integration-gateway.com/connections \
  -H "Authorization: Bearer $INTEGRATION_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Polling the connection-request status sends the bearer token and request identifier to an external service, exposing integration lifecycle metadata. Though expected for OAuth completion, it still contributes to third-party visibility into account linkage state and should be disclosed as part of the skill's privacy and external-transmission model.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

轮询连接结果

bash
curl https://api.integration-gateway.com/connection-requests/req_xyz \
  -H "Authorization: Bearer $INTEGRATION_TOKEN"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest-facing display name, summary, and description are presented in Chinese only, with no indication that users may select another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.