ClawHub
Back to skill

Security audit

Max Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill describes owner-controlled MAX messaging and related account tools, with clear limits on sensitive actions and no malicious behavior found in the supplied instructions.

This connects to your real account and retains local messages, contact notes, and indexes. Choose the profile, chats, and download limits deliberately. Use read-only permissions when changes are unnecessary; MCP 'ask' does not guarantee another confirmation. Enable monitoring, remote access, automatic replies, or external AI processing only when wanted. The supplied artifact contains instructions only, so this verdict does not certify the separately installed npm executable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Message retrieval, monitoring, and transcription are consistent with or support the declared messaging purpose. However, persistent workflow management and administrative actions affecting membership and moderation are materially distinct capabilities not disclosed in the description. Owner-approval conditions constrain these actions but do not make them part of the declared read/send functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The commands operate within the declared MAX account context, but expose contact-record and tag-management capabilities not described by the messaging-focused purpose. In particular, modifying aliases and creating, editing, or deleting contact notes are independent account-data operations, not merely supporting implementation details for reading or sending messages. Metadata synchronization could support messaging or search, but it does not account for these additional capabilities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

Listing and filtering mentions can reasonably support the declared message-search functionality, and rebuilding an index may be an implementation detail. However, confirming and rejecting person associations changes mention-resolution records rather than merely reading or sending messages. This identity-resolution capability, particularly its chat-wide application, is not represented in the declared purpose. The snippet does not establish unrelated data access or external exfiltration.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.