ClawHub
Back to skill

Security audit

Hike Planner

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed hiking planner, but real code flaws could allow command execution or writing outside the intended trip folder in edge cases.

Review before installing. This skill stores detailed trip, order, media, and GPS data locally and sends map/query data to third-party services. Use a private output directory, avoid importing untrusted GPX/KML/media files, do not expose generated map HTML publicly, and install optional helper skills only from versions and publishers you trust. The shell-command and path-boundary issues should be fixed before use in shared or high-trust environments.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/render-itinerary-map.js:27
Finding

Shell Command Injection Through the Amap API Key

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/hike-planner.js:227
Finding

Path Traversal Through an Unvalidated Start Date and Derived Trip ID

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/hike-planner.js:815
Finding

Symlink Bypass in Imported File Path Validation

Content
View full analysis
{ const normalizedDir = path.normalize(path.resolve(dir)); return normalized.startsWith(normalizedDir + path.sep) || normalized === normalizedDir; }); if (!isAllowed) { return { valid: false, reason: `文件不在允许的目录范围内` }; } return { valid: true, reason: '' }; } ``` ```javascript const allowedDirs = [trip.outputDir, inboundDir, os.tmpdir()]; const validation = validateFilePath(resolvedPath, allowedDirs); if (!validation.valid) { return { gpxPath: null, trackMapPath: null, error: `安全限制: ${validation.reason}` }; } const destFile = path.join(gpxDir, `${baseName}${ext}`); fs.copyFileSync(resolvedPath, destFile); ``` The media import path uses the same validation approach before calling `fs.copyFileSync`. ### Technical Analysis The validator compares lexical paths produced by `path.resolve` and `path.normalize`. It does not resolve filesystem links with `fs.realpathSync` and does not reject symbolic links with `fs.lstatSync`. Consequently, a path can appear to reside under `outputDir`, the inbound directory, or the system temporary directory while its final symlink target resides elsewhere. `fs.copyFileSync` follows the link and reads the target. The extension check is performed on the symlink pathname rather than the final target. A link named with an approved extension can therefore point to a file of any type. ### Attack Path 1. Create or place a symbolic link in an allowed directory such as the system temporary directory. ...[truncated 787 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate-track-map.py:222
Finding

Stored HTML Injection in Generated Track Maps

Content
View full analysis
{title} 轨迹地图 ...

🗺️{title} 轨迹地图

``` The comparison view also inserts labels directly into HTML and later uses `innerHTML`: ```python compare_rows.append( f'' f'{label}' f'{dist} km' f'⤴{ascent} / ⤵{stats["descent_m"] if stats else "--"} m' f'{max_alt} m' f'{pts}' f'' ) ``` ```javascript var legendHtml = ''; tracks.forEach(function(trk) { legendHtml += '
' + trk.label + ' (' + trk.file + ')
'; }); document.getElementById('legendDynamic').innerHTML = legendHtml; ``` ### Technical Analysis Track titles and comparison labels originate from imported filenames or the optional title argument. These values are not HTML-escaped before being inserted into the generated document. On filesystems that permit angle brackets in filenames, a filename containing an active HTML element can inject markup into the `

` element. In comparison mode, labels and filenames are additionally concatenated into a string assigned to `innerHTML`, which creates another direct script-capable HTML ...[truncated 1016 chars]

Remediation
View remediation
` element, escape script-closing sequences or place JSON in a non-executable data element and parse its `textContent`. - Normalize generated display names to a conservative character set where practical. - Add a restrictive Content Security Policy that disallows inline scripts and inline event handlers. - Add regression tests using angle brackets, quotes, event-handler elements, and script-closing sequences in filenames and titles. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
assets/gpx-parser.py:59
Finding

Unbounded GPX and KML Parsing Enables Resource Exhaustion

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:120
Finding

Unpinned Third-Party Skill Installation Instructions

Content
View full analysis
Remediation
View remediation

other

Note
Location
scripts/generate-track-map.py:272
Finding

Generated Maps Contact an Undeclared OpenStreetMap Endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/hike-planner.js (reported line 689)May include surrounding context.

js
if (r.startDate) {
    const newTripId = generateTripId(trip.destination, r.startDate);
    if (newTripId !== tripId) {
      delete state.trips[tripId];
      trip.tripId = newTripId;
      state.trips[newTripId] = trip;
      state.activeTripId = newTripId;

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description and primary user-facing instructions are written entirely in Chinese, with no indication that other languages are supported or that the user may choose their preferred language. This creates a locale/language constraint in natural-language behavior without explicit opt-in or justification as a region-specific tool.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to install or invoke external dependencies via npx clawhub without pinning a specific version. That creates a supply-chain risk: a newer, compromised, or typo-squatted package version could be fetched and executed unexpectedly, especially because the skill also declares execution capability (curl, python3, node) and relies on networked components.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This dependency installation path is unpinned, so the resolved package version may change over time and could deliver malicious code. In this skill's context, that risk is amplified because the installed helper would process sensitive travel data and may have filesystem/network access through the surrounding agent workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

Referencing flyai via an unversioned npx clawhub install leaves the installation open to supply-chain compromise or breaking changes. Because this dependency is tied to travel search and API-key-backed network access, compromise could expose itinerary data, credentials, or influence downstream outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

Using an unpinned package install for xiaohongshu introduces the same mutable-dependency risk: the code obtained at install time may differ from what was reviewed. Since this plugin may interact with authenticated sessions and external content, a malicious update could steal tokens, exfiltrate data, or manipulate search results.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This manifest provides only a broad descriptive summary and generic keywords such as travel- and route-related terms, but does not define any explicit trigger phrases, scope boundaries, or negative examples. In a manifest file, this can make activation conditions ambiguous and increase the chance of unintended invocation for common travel-related requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The user-facing description and several keywords are written in Chinese, but the manifest does not indicate that the skill is region-specific or that users can choose their language/locale. This may violate language or locale policy by implicitly forcing a specific language presentation without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language text that fixes the interaction language to Chinese in the module docstring and CLI help, which can violate a language/locale policy when no user opt-in or justification is provided. The file does not indicate that the tool is region-specific or offer an alternative language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Natural-language strings in the parser function and main help output are presented only in Chinese, including errors and usage guidance. Because the file gives no user choice of language and no documented regional constraint, this is a policy-relevant locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file contains natural-language instructions that require Chinese-language output conventions and China-specific sources, such as mandating Chinese quotation marks for poetry and prescribing Wikipedia/web_search/xiaohongshu queries, while not offering any user opt-in or language choice. Under the locale policy rule, forcing a specific language/locale without user choice is a policy concern unless clearly justified as region-specific, which is not stated for all uses of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file’s natural-language prompts, errors, notices, and generated content are consistently fixed to Chinese, which forces a specific language/locale on users. The policy allows locale constraints only when clearly documented and justified or when the user is given a choice, neither of which is present in this code file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code automatically enumerates saved media files and embeds links to them in the generated trip plan, making imported screenshots/photos part of the exported artifact. Although saveMediaFile has a confirmation prompt, cmdGeneratePlan/renderPlan do not provide any user-facing warning at the point where those files become referenced in the shareable plan output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The validatePlan docstring says it is used after generation to ensure required sections are present, and the validator explicitly warns when '出行建议' is missing. However, renderPlan never calls renderTravelAdvice and does not add a travel-advice section at all, so the documented/template intent diverges from actual generation behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains natural-language documentation and CLI output entirely in Chinese, including usage instructions and runtime messages. Because the skill does not offer a user language/locale option or explain that it is intentionally China-specific despite using Amap, it creates a language-policy risk for users who did not opt into Chinese-only interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains only Chinese headings, instructions, and examples, which effectively forces a single language/locale for users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The generated page hard-codes lang="zh-CN", and the surrounding UI text is also fixed in Chinese. For a general-purpose track-map generator, this imposes a specific language/locale on all users without opt-in or any documented regional requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The header comment documents the skill as having only six primary commands for progressively filling a TripPlan. In reality, the file implements and exports many more operational commands, including file import, configuration, selection, plan generation, archiving, and live status mutation, so the documentation understates and mischaracterizes the skill's interface.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/hike-planner.js:2761

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/render-itinerary-map.js:33