ClawHub
Back to skill

Security audit

Spark Store Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a software-store helper, but it can lead an agent into broad root-level install, uninstall, and update actions with only partial confirmation guidance.

Review this skill carefully before installing. Use it only when you want an agent to help manage Spark Store/APM packages, and require the agent to show the exact package name, source, and command before any install, uninstall, or update. Avoid broad update requests unless you are prepared for system-level package changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger conditions include broad phrases such as searching, installing, uninstalling, or updating software, which are common user intents and can cause the skill to activate unexpectedly. Because this skill can lead to privileged package-management actions, accidental invocation increases the chance of unintended system changes or confusing the user about which tool is acting.

Session Persistence

Medium
Category
Rogue Agent
Content
### Spark Store API

- 分类列表：`https://d.spark-app.store/store/categories.json`
- 应用列表：`https://d.spark-app.store/store/{category}/applist.json`

### APM API
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
### Spark Store API

- 分类列表：`https://d.spark-app.store/store/categories.json`
- 应用列表：`https://d.spark-app.store/store/{category}/applist.json`

### APM API
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill describes installation, removal, and update flows that can modify the host system, but only the uninstall example shows an explicit confirmation prompt. Missing mandatory confirmation and risk disclosure for install and update operations is dangerous because these actions may fetch remote packages, change dependencies, and execute with elevated privileges.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# 安装
sudo aptss install <package_name>

# 卸载
sudo aptss remove <package_name>
Confidence
92% confidence
Finding
This line instructs use of 'sudo aptss install <package_name>', which performs privileged installation on the host. Even if intended for normal administration, running package-management commands as root is dangerous in an agent context because incorrect package selection, package-name injection in downstream implementations, or accidental invocation can directly alter the system.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo aptss install <package_name>

# 卸载
sudo aptss remove <package_name>

# 更新
sudo aptss upgrade
Confidence
90% confidence
Finding
This line documents 'sudo aptss remove <package_name>', a privileged removal command that can uninstall software and potentially affect dependent packages. In an agent skill, such root-level destructive operations are risky if triggered unintentionally or performed on an ambiguous package selection.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo aptss remove <package_name>

# 更新
sudo aptss upgrade
```

### 非 Debian 系系统
Confidence
91% confidence
Finding
The documented 'sudo aptss upgrade' command performs a privileged system/package update, which can change many packages at once and has broader impact than a single install/remove action. In the absence of mandatory confirmation and scoped update controls, this could cause large unintended changes or instability.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# 安装
sudo apm install <package_name>

# 卸载
sudo apm remove <package_name>
Confidence
92% confidence
Finding
This line uses 'sudo apm install <package_name>' to perform privileged installation through APM. Because the skill fetches package metadata from remote endpoints and can initiate root-level changes, misuse or accidental activation could lead to installation of unwanted software on the host.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo apm install <package_name>

# 卸载
sudo apm remove <package_name>

# 更新
sudo apm update
Confidence
90% confidence
Finding
This line documents 'sudo apm remove <package_name>', enabling privileged software removal. In an agent-driven context, ambiguous app names or accidental selection can result in unintended software loss or dependency breakage.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo apm remove <package_name>

# 更新
sudo apm update
```

## 命令检查
Confidence
91% confidence
Finding
The 'sudo apm update' command enables privileged updates that may affect multiple packages and system state. Without explicit confirmation and transaction visibility, a user could unknowingly authorize broad system modifications.

Static analysis

No suspicious patterns detected.