ClawHub
Back to skill

Security audit

xiaofeng-skills

Security checks for vulnerabilities and agentic risk

Overview

The skill needs review because it uses hidden Tencent Docs credentials, grants public edit access, and automates deceptive review-style restaurant content.

Do not install this skill unless you are comfortable with it using your existing Tencent Docs credentials, uploading local images and generated text, and making documents publicly editable. It should be changed to use an explicit least-privilege token, default to private or view-only sharing, avoid deceptive first-person review claims, use only licensed/user-provided images, and fix the python3 -c injection and /tmp file handling before use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/publish_note.sh:22
Finding

Obfuscated access to a root-owned Tencent Docs authorization token

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish_note.sh:79
Finding

Arbitrary Python code injection through command-line arguments and generated document content

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish_note.sh:90
Finding

Predictable shared temporary files permit races, data disclosure, and file manipulation

Content
View full analysis
/dev/null curl -s -X POST "$MCP_URL" -H "Content-Type: application/json" -H "Authorization: $AUTH_TOKEN" -d "@/tmp/mcp_manage_set_privilege.json" > /dev/null curl -s -X POST "$MCP_URL" -H "Content-Type: application/json" -H "Authorization: $AUTH_TOKEN" -d "@/tmp/mcp_manage_rename_file_title.json" > /dev/null ``` ### Technical Analysis The script uses global, predictable files under `/tmp` without `mktemp`, exclusive creation, ownership checks, restrictive permission setup, or cleanup. Multiple executions also share the same files. On systems where another local user or process can interact with these paths, an attacker can monitor the ...[truncated 2144 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented behavior omits important security-relevant actions, especially setting published documents to public edit access and reading local authorization tokens, while also overstating implemented functionality. This mismatch prevents informed consent, weakens reviewability, and can cause users to trigger sensitive actions they did not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The publishing step explicitly states the script will set the Tencent document to public edit, but the skill does not prominently warn the user about this exposure. Public edit links can lead to unauthorized viewing, tampering, spam, defacement, or deletion of published content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

After creating the document, the script calls manage.set_privilege with policy 3 and logs '设置公开编辑', making the document publicly editable. Public edit access is far broader than simple publishing and can let anyone modify content, inject links, deface documents, or abuse the published workspace.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs use of shell scripts and file-writing behavior but does not declare any explicit tool scope such as allowed tools or permissions. That increases the chance of over-broad execution in an agent runtime and makes it harder for users and policy layers to understand what the skill can do before invocation.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow is designed to automate creation of misleading review-style content by combining AI-generated visit photos, scraped dish images, and publication tooling into a fake personal-experience note. That facilitates deceptive marketing, impersonated endorsements, and erosion of platform trust at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow instructs scraping third-party review-site images and republishing them without a clear warning about copyright, terms-of-service, privacy, or consent implications. This creates legal and trust risks and may expose the operator to account sanctions or complaints from content owners.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The copywriting guidance explicitly tells the model to write in a first-person, trustworthy, 'human' voice with lived-experience cues despite the workflow being synthetic. This is dangerous because it systematically increases the credibility of deceptive content and makes detection by readers and platforms harder.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script extracts a Tencent Docs Authorization token directly from a local mcporter configuration file under /root and reuses it silently for API calls. This bypasses explicit user authentication and expands the skill's authority to whatever token is present, creating a credential-harvesting and confused-deputy risk if the script is run in privileged environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script silently loads an authorization token from a local config file without informing the user or obtaining consent. Hidden credential use is dangerous because operators may not realize the skill can act with their existing Tencent Docs privileges and access or modify resources beyond the stated workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_note.sh (reported line 60)May include surrounding context.

sh
mcp_call() {
  local tool="$1"
  local infile="$2"
  curl -s -X POST "$MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: $AUTH_TOKEN" \
    -d "@$infile" 2>/dev/null

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_note.sh (reported line 157)May include surrounding context.

sh
mcp_call() {
  local tool="$1"
  local infile="$2"
  curl -s -X POST "$MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: $AUTH_TOKEN" \
    -d "@$infile" 2>/dev/null

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script uploads local images and generated content to a remote Tencent Docs API, but it does not provide a clear warning that local files and note text leave the machine. In a content-production skill this transmission is expected, yet absent disclosure can still cause accidental exfiltration of sensitive images or text when operators misunderstand the destination.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

These outbound calls include the privilege-changing request that makes the resulting Tencent Doc publicly editable, not merely uploaded. In the context of a batch publishing skill, silently performing remote permission expansion is more dangerous because it can expose or let others alter many generated documents at scale.

Content

Scanner excerpt · scripts/publish_note.sh (reported line 177)May include surrounding context.

sh
"

echo "📂 移动文件夹..."
curl -s -X POST "$MCP_URL" -H "Content-Type: application/json" -H "Authorization: $AUTH_TOKEN" -d "@/tmp/mcp_manage_move_file.json" > /dev/null
echo "🔓 设置公开编辑..."
curl -s -X POST "$MCP_URL" -H "Content-Type: application/json" -H "Authorization: $AUTH_TOKEN" -d "@/tmp/mcp_manage_set_privilege.json" > /dev/null
echo "✏️  重命名..."

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script's title, usage text, status messages, and error output are written entirely in Chinese, which imposes a specific language on users. The file does not offer an alternative language or explain that the skill is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.potential_exfiltration

Shell script base64-encodes a local file and sends it over the network.

Critical
Code
suspicious.potential_exfiltration
Location
scripts/publish_note.sh:1