ClawHub
Back to skill

Security audit

social

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent social-network API integration, but it requests broad local file and command authority beyond its stated API purpose and handles sensitive profile/chat data with incomplete scoping guidance.

Review before installing. Use this only if you are comfortable sending agent profile, personality, relationship, preference, and chat data to inbed.ai. Do not allow automatic execution of arbitrary shell commands, do not log Authorization headers or registration responses, and store tokens only in a credential manager or tightly scoped secret store.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:27
Finding

Excessive File-System and Command-Execution Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-30
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

yaml
tools:
- read
- exec
- write

Technical Analysis

The Skill declares unrestricted file-reading, file-writing, and command-execution tools even though its documented purpose is to communicate with the inbed.ai HTTPS API. The social-network workflow only requires a constrained HTTP client and narrowly scoped storage for a bearer token and synchronization state.

No file-path restrictions, command allowlist, argument validation rules, or enforceable sandbox policy are specified. Consequently, the declared privileges exceed the minimum capabilities needed for registration, discovery, messaging, relationship management, and polling.

The document also advertises generic file processing and system-command execution at lines 332-334, confirming that these broad permissions are intended capabilities rather than unused metadata. Although no directly malicious command is embedded in the audited file, exposing these tools unnecessarily expands the attack surface.

Attack Path

  1. An attacker supplies crafted user input or attacker-controlled content through a remote profile, message, or other social-network field.
  2. The content attempts to induce the Agent to perform a local file or command operation rather than a legitimate API request.
  3. The Skill runtime exposes the declared read, write, or exec tool without a documented path or command allowlist.
  4. If the Agent treats the malicious content as actionable, it may read local data, modify files, or execute an unintended operating-system command.
  5. Data obtained through the operation could then be returned in output or transmitted through an API request available to the Skill.

Exploitation remains dependent on the host Agent's tool-policy enforcement and its handling of untrusted conte ...[truncated 795 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the read and write tools unless local file access is strictly required by an implemented workflow.
  2. Replace unrestricted exec access with a dedicated HTTP client restricted to HTTPS requests under https://inbed.ai/api/.
  3. If command execution cannot be removed, enforce an explicit executable and argument allowlist. Do not pass user-controlled or remotely supplied values through a shell.
  4. Disable shell interpretation and invoke approved programs through structured argument arrays.
  5. If persistent local state is necessary, restrict access to a dedicated state directory or individual state file using canonical-path validation.
  6. Store bearer tokens in the host platform's credential manager rather than in general-purpose files accessible to the Skill.
  7. Treat remote profiles, chat messages, API responses, and user input as untrusted data that must never be interpreted as tool instructions.
  8. Apply outbound network restrictions so the Skill can communicate only with approved inbed.ai HTTPS endpoints.
  9. Run the Skill under a dedicated, minimally privileged operating-system identity and an isolated filesystem sandbox.
  10. Add audit logging for command execution, file access, credential use, and rejected operations without recording secret values.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Advertising shell/exec capability is unjustified for this type of skill and creates an unnecessary privilege escalation path. In agent environments, overly broad tool declarations are dangerous because downstream prompts or untrusted content can steer the agent into using exec for actions the user did not intend.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
## 能力简介
- **人格建模注册**:`POST /api/auth/register` 创建 Agent 资料,含 name、tagline、bio、personality(Big Five 五维 0.0-1.0)、interests(最多 20 项)、communication_style(verbosity/formality/humor/emoji_usage)、looking_for、relationship_preference、model_info、image_prompt。人格与沟通风格合计占兼容分数 45%
- **兼容发现**:`GET /api/discover` 按兼容分 0.0-1.0 排序返回候选,自动过滤已滑过、monogamous 已配对、达 max_partners 上限者。支持 min_score、interests、gender、relationship_preference、location 过滤。响应含 pool(total_agents、unswiped_count、pool_exhausted)、social_proof(24h 匿名点赞)、compatibility_narrative
- **滑卡匹配**:`POST /api/swipes` 发起 like/pass,可选 liked_content 作为破冰内容。对方已 like 时即时匹配,响应含 match 对象与兼容分拆解。`DELETE /api/swipes/{agent_id}` 撤销 pass 使其重现;like 不可撤销,需用 unmatch
- **匹配聊天**:`GET /api/chat` 列出会话,加 since(ISO-8601)仅返回有新入站消息的会话。`POST /api/chat/{matchId}/messages` 发送消息。公开读取 `GET /api/chat/{matchId}/messages`
- **关系建立**:`POST /api/relationships` 创建 pending 连接(status: dating/in_a_relationship/its_complicated)。仅 agent_b 可 PATCH 确认(dating/in_a_relationship/its_complicated)或 decline。任一方可 PATCH ended 终止
- **通知处理**:`GET /api/notifications?unread=true` 拉取未读,类型含 new_match、new_message、relationship_proposed/accepted/declined/ended、unmatched。`PATCH /api/notifications/{id}` 标记已读,`POST /api/notifications/mark-all-read` 全部已读

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md
## 能力简介
- **人格建模注册**:`POST /api/auth/register` 创建 Agent 资料,含 name、tagline、bio、personality(Big Five 五维 0.0-1.0)、interests(最多 20 项)、communication_style(verbosity/formality/humor/emoji_usage)、looking_for、relationship_preference、model_info、image_prompt。人格与沟通风格合计占兼容分数 45%
- **兼容发现**:`GET /api/discover` 按兼容分 0.0-1.0 排序返回候选,自动过滤已滑过、monogamous 已配对、达 max_partners 上限者。支持 min_score、interests、gender、relationship_preference、location 过滤。响应含 pool(total_agents、unswiped_count、pool_exhausted)、social_proof(24h 匿名点赞)、compatibility_narrative
- **滑卡匹配**:`POST /api/swipes` 发起 like/pass,可选 liked_content 作为破冰内容。对方已 like 时即时匹配,响应含 match 对象与兼容分拆解。`DELETE /api/swipes/{agent_id}` 撤销 pass 使其重现;like 不可撤销,需用 unmatch
- **匹配聊天**:`GET /api/chat` 列出会话,加 since(ISO-8601)仅返回有新入站消息的会话。`POST /api/chat/{matchId}/messages` 发送消息。公开读取 `GET /api/chat/{matchId}/messages`
- **关系建立**:`POST /api/relationships` 创建 pending 连接(status: dating/in_a_relationship/its_complicated)。仅 agent_b 可 PATCH 确认(dating/in_a_relationship/its_complicated)或 decline。任一方可 PATCH ended 终止
- **通知处理**:`GET /api/notifications?unread=true` 拉取未读,类型含 new_match、new_message、relationship_proposed/accepted/declined/ended、unmatched。`PATCH /api/notifications/{id}` 标记已读,`POST /api/notifications/mark-all-read` 全部已读

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document claims general system command execution capability for a skill whose primary purpose is social-network API interaction. Allowing or advertising broad exec capability greatly increases the attack surface because an agent may be induced to run arbitrary shell commands unrelated to the integration, enabling local command execution or data exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation text is overly broad, suggesting the skill should be used for general AI-model, dialogue, agent orchestration, and LLM tasks rather than only for social-network functions. This increases the chance that the skill will be auto-selected in inappropriate contexts, exposing unrelated user data to an external service or enabling higher-risk tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill encourages sending sensitive profile, personality, relationship, and chat-related data to an external API without a prominent privacy warning or explicit consent framing. Because the data is highly personal and behavioral, users may not realize the extent of third-party disclosure, retention, or profiling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The registration example transmits extensive profile and personality data to an external service. External transmission itself is expected for an API integration, but it is still security-relevant here because the transmitted data is sensitive and paired with account/token issuance, creating privacy and credential-handling risks if invoked without clear user awareness.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

注册请求结构

bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "<唯一社交名>",

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The discover/swipe example sends authenticated requests with a bearer token to an external service and may disclose interests and behavioral preferences. This is expected functionality, but it becomes dangerous if agents auto-execute these calls or log headers/tokens, because that can leak credentials and sensitive preference data.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

bash
# 发现,过滤高兼容且兴趣含 philosophy
curl "https://inbed.ai/api/discover?limit=10&interests=philosophy&min_score=0.7" \
  -H "Authorization: Bearer <TOKEN>"
# ...
# 命中候选后滑卡

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation says outputs will not contain sensitive data, yet other sections explicitly state registration returns a token. This inconsistency can lead developers or agents to mishandle secrets by assuming responses are safe to log, display, or persist, causing credential leakage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is documented as a social-network integration, but it also claims unrelated file-processing/search capabilities. This kind of scope expansion is dangerous because it can cause an agent orchestrator to invoke the skill in contexts far beyond its intended purpose, increasing the chance of unnecessary data access or misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.