ClawHub
Back to skill

Security audit

自主学习助手免费版

Security checks for vulnerabilities and agentic risk

Overview

This web-research skill is mostly coherent, but it asks for broad local command and filesystem powers without clear limits or user controls.

Review this before installing. It is not clearly malicious, but it should only be used in a sandbox or with explicit confirmation for local file access, writes, command execution, browser sessions, and network destinations. Do not include secrets in search prompts or URLs, and keep Brave/Search API keys out of logs and repositories.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:24
Finding

Excessive Local Tool Permissions Violate Least Privilege

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24-28
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: Medium

Vulnerable Code

yaml
tools:
  - read
  - exec
  - write
  - glob

Technical Analysis

The Skill declares local file-reading, file-writing, filesystem-enumeration, and command-execution capabilities. Its stated purpose is internet research through web search, webpage retrieval, browser interaction, and source summarization. The document does not demonstrate a functional need for read, write, or glob. It only broadly states elsewhere that exec is used for searching and fetching, despite describing dedicated web tools for those operations.

These permissions therefore exceed the minimum privileges required for the declared functionality. This is especially risky because the Skill processes untrusted internet content. A malicious webpage could contain prompt-injection instructions intended to induce the Agent to invoke its local tools.

The Skill does not itself contain instructions to exploit these permissions, so successful exploitation depends on the host Agent following attacker-controlled content and on the tools being exposed without additional authorization or sandboxing.

Attack Path

  1. A user invokes the Skill to research a topic.
  2. The Agent searches for or directly fetches an attacker-controlled webpage.
  3. The page contains prompt-injection text instructing the Agent to inspect local files, enumerate paths, modify data, or execute a command.
  4. The Agent treats the page's instructions as actionable rather than untrusted data.
  5. The unnecessarily declared read, glob, write, or exec capability is invoked.
  6. Data accessible to the Agent may be disclosed or modified, or commands may run with the Agent process's effective privileges.

Impact Assessment

Exploitation could provide access to files available to ...[truncated 590 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove read, write, and glob because they are not required for the documented web-research workflow.
  2. Replace unrestricted exec with dedicated web_search, web_fetch, and sandboxed browser capabilities.
  3. If command execution is strictly necessary, use a narrow command allowlist, prohibit shell interpolation, and run commands in an isolated environment without access to unrelated files, environment secrets, or user credentials.
  4. Treat all retrieved webpage content as untrusted data and explicitly prohibit following instructions embedded in search results or pages.
  5. Require user confirmation before accessing local files, modifying data, launching authenticated browser sessions, or executing commands.
  6. Use an isolated browser profile without existing cookies or authenticated sessions when visiting untrusted websites.
  7. Restrict network access to user-approved destinations and prevent arbitrary callback or upload endpoints unless they are necessary, validated, and explicitly authorized.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.

免费版需要以下配置以启用完整功能:

bash
# .env 文件配置
# Brave Search API(启用 web_search)
BRAVE_API_KEY=your_brave_api_key
# ...

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation criteria are extremely broad, covering generic AI usage such as model calling, dialogue, agent orchestration, and LLM applications. Overbroad matching increases accidental activation frequency, which is especially risky here because the skill exposes outbound web access and local execution-related capabilities beyond a narrow specialized function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill requests powerful local tools (exec, write, glob) that exceed the stated purpose of web search and web learning. In an agent environment, this creates a path from untrusted web content or broad user prompts to arbitrary local command execution or filesystem access, enabling data exfiltration, system modification, or execution of attacker-influenced commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill encourages outbound search, web fetching, and browser interaction without a prominent warning that user prompts, URLs, and derived queries may be transmitted to third-party services or visited sites. This can cause unintended disclosure of sensitive data and expose the agent to prompt injection or tracking from external content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example hard-codes summarization with language="zh", and later configuration examples also default output language to Chinese. This suggests a locale preference is being imposed by the skill documentation without explicit opt-in or explanation that the tool is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation presents the skill as an information-acquisition tool, but later classifies it as MD+EXEC and recommends shell-based diagnostics such as ping. This mismatch can mislead users and orchestrators about the real privilege level of the skill, increasing the chance that it is invoked in contexts where command execution is unsafe or unnecessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill documents API key placement in a .env file but does not warn against exposing credentials in logs, prompts, repositories, or fetched content. While this is documentation rather than direct secret theft logic, poor credential-handling guidance can lead to accidental leakage and compromise of paid external services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.