Security audit

决策简报虾 (decision-briefing-claw)

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate business reporting skill, but it grants broad database querying and external report-sharing capabilities that need careful review before use.

Install only if you are comfortable giving it access to the configured business data sources and report recipients. Use read-only database credentials, avoid the arbitrary SQL test command in production, restrict webhook/email destinations, and review generated reports before enabling scheduled pushes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes a raw SQL testing capability (test --query) that expands the skill from routine reporting into arbitrary database query execution, yet this elevated capability is not clearly declared in the purpose statement. In a business reporting context, hidden or understated query execution can expose sensitive records, enable destructive queries if safeguards are absent, and mislead operators about the trust boundary of the skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior includes a raw SQL testing capability (test --query) that expands the skill from routine reporting into arbitrary database query execution, yet this elevated capability is not clearly declared in the purpose statement. In a business reporting context, hidden or understated query execution can expose sensitive records, enable destructive queries if safeguards are absent, and mislead operators about the trust boundary of the skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents shell execution, network access, and file-writing behavior but does not declare any explicit tool scope or permissions boundary. In a skill that connects to databases, runs scripts, writes reports, and pushes data externally, the lack of declared restrictions increases the chance of unintended command execution, unauthorized data movement, or overly broad runtime privileges.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Overly broad trigger keywords can cause accidental activation of a skill that collects business data, runs scripts, and pushes reports externally. In this context, mis-triggering is more dangerous than for a passive skill because unintended invocation may initiate data access, report generation, or outbound transmission without the user's informed intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill description states that it aggregates data from multiple sources and pushes results to external platforms, but it does not clearly warn users about data transfer, storage, and archival implications. For business KPI workflows, this can lead to unintentional disclosure of confidential operational or financial information to third-party services or local archives that are not appropriately governed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire document is written in Chinese, including headings, metric definitions, anomaly rules, and SQL comments, with no indication that the skill is intentionally region-specific or that users may choose another language. This creates a natural-language policy concern because it imposes a specific language/locale without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains only Chinese-language headings and instructions, which can amount to a forced language choice if the skill is intended for general users. The policy specifically calls for flagging language or locale constraints when they are imposed without user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The collect workflow creates a JSON report under ../reports and writes all collected source data to disk. Although it prints the save path after completion, there is no prior user-facing warning, inline comment, or docstring disclosing that collected data from databases and APIs will be persisted locally.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The test subcommand executes arbitrary SQL supplied on the command line against the first configured database source, with no restriction to read-only statements or approved query templates. In a data-collection skill whose normal purpose is daily KPI aggregation, this creates an unnecessary capability that could be abused to modify data, exfiltrate sensitive records, or run destructive administrative statements if the configured DB credentials permit it.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This curl call performs direct outbound transmission of the report body to a webhook endpoint. In a decision-briefing skill that aggregates business data, such external transmission is security-relevant because it can leak sensitive operational information to third-party systems or to compromised/misconfigured webhook endpoints.
Content: Scanner excerpt · scripts/report-generator.sh (reported line 103)May include surrounding context.
sh
local payload payload=$(jq -n --arg text "$content" '{"msg_type":"text","content":{"text":$text}}') local resp resp=$(curl -s -X POST "$webhook" -H "Content-Type: application/json" -d "$payload") echo "飞书响应: $resp" }

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script sends the full generated report content to a configured Feishu webhook, which is an external transmission of potentially sensitive business data. In this skill’s context, the reports aggregate operational KPIs from multiple sources, so automatic outbound posting can disclose confidential information if recipients, webhook ownership, or report contents are not carefully controlled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script emails the generated report to configured recipients without any review, warning, or data minimization step. Because the report may contain sensitive business metrics consolidated from databases, APIs, and spreadsheets, emailing it can create unintended disclosure, forwarding risk, and loss of control over where the data ultimately resides.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: SQP-3 适用于所有文件类型。L97 指示“统一使用 Asia/Shanghai”，这构成默认强制特定 locale/timezone 的自然语言策略，文档未提供用户选择机制，也未说明该技能仅适用于中国区或该限制的业务理由。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file contains user-facing instructions only in Chinese, including headings, labels, and explanatory text. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring and CLI help/messages throughout the script are presented exclusively in Chinese, with no language-selection mechanism or documented locale constraint. This creates a natural-language policy issue because the skill effectively requires one language without asking the user or stating a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: User-facing help text, status messages, and errors throughout the script are written in Chinese only, which imposes a specific language choice without user opt-in. The policy requires avoiding forced language or locale constraints unless they are explicitly optional or justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.