ClawHub
Back to skill

Security audit

题庄中小学真题题库

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent question-bank integration that uses a bundled CLI, remote API, optional local credentials, and a small trial-token cache with no hidden unrelated behavior found.

Install only if you are comfortable with this skill contacting the Tizhuang question-bank service. Keep QUESTION_SERVICE_URL on the default or another trusted HTTPS endpoint, store license/account tokens only in local environment configuration, and review public share options before exposing answers or removing watermarks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'api_request' from os.getenv (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
url, data=body, headers=request_headers, method=method
    )
    try:
        with urllib.request.urlopen(api_request, timeout=30) as response:
            return json.load(response)
    except urllib.error.HTTPError as error:
        try:
Confidence
95% confidence
Finding
with urllib.request.urlopen(api_request, timeout=30) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs the agent to use environment variables, local file caching/storage, bundled Python scripts, and remote network calls, but there is no declared permissions model or user-visible gating for those capabilities. That creates a real trust-boundary issue: the skill can read local configuration, write cached credentials or session material, and contact external services without explicit permission disclosure, increasing the chance of secret leakage, unintended persistence, or network exfiltration if the surrounding runtime does not enforce controls.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.