ClawHub
Back to skill

Security audit

Volcengine Prepare

Security checks for vulnerabilities and agentic risk

Overview

The skill appears related to deployment analysis, but it over-reads sensitive repository files and includes under-disclosed live cloud availability checks.

Install only if you are comfortable letting the skill inspect local repository files, including environment/config files, and call Volcengine CLI/API checks. Prefer running it on a sanitized copy of a repo, remove real .env files first, and verify any cloud CLI credentials are limited to read-only availability queries.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
This is a mismatch because the repository analysis script aligns well with the declared purpose, but the second script adds behavior not disclosed in the description: it performs live regional availability probes against Volcengine services, including CR, by calling external APIs through the ve CLI. That is more than merely analyzing the project and preparing a recommendation from repository contents. While service availability checks could support deployment planning, the description does not mention external probing, region-based checks, or CR at all, so this is hidden capability under the stated criteria.

Credential Access

High
Category
Privilege Escalation
Content
all_code="$all_code $(cat "$f" 2>/dev/null || true)"
  done < <(find . -maxdepth 5 \( -name "*.js" -o -name "*.ts" -o -name "*.py" \
    -o -name "*.go" -o -name "*.java" -o -name "*.rs" -o -name "*.rb" -o -name "*.php" \
    -o -name "*.env" -o -name "*.env.example" \
    -o -name "application.yml" -o -name "application.properties" \) 2>/dev/null | head -100)

  port=$(echo "$all_code" | grep -oiE 'port\s*[=:]\s*[0-9]+' | grep -oE '[0-9]+' | head -1)
Confidence
95% confidence
Finding
The script reads up to 100 source and configuration files, explicitly including .env and .env.example, into an in-memory string to infer the app port. In a repo-analysis skill, this needlessly ingests secrets from untrusted repositories and can expose them through process memory, downstream logging, crashes, or later prompt/tool output, even though only a port value is needed.

Credential Access

High
Category
Privilege Escalation
Content
local search_content=""

  # Config files
  for f in compose.yaml compose.yml docker-compose.yml docker-compose.yaml .env .env.example \
    .env.sample config.yml config.yaml application.yml application.properties \
    appsettings.json; do
    [ -f "$f" ] && search_content="$search_content $(cat "$f" 2>/dev/null || true)"
Confidence
97% confidence
Finding
The dependency detection logic concatenates entire contents of sensitive configuration files, including .env, .env.example, and appsettings/config files, into a single variable for regex scanning. Because this skill analyzes arbitrary local directories or repos before deployment, it broadens secret exposure to credentials, tokens, connection strings, and API keys unrelated to the intended dependency classification.

Static analysis

No suspicious patterns detected.