ClawHub
Back to skill

Security audit

AI电商专家｜多图统一商品颜色

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-related to IMIVA ecommerce image generation, but it needs Review because it runs an unpinned external MCP package with broad environment and tool access tied to a user account token.

Install only if you trust the IMIVA npm package and are comfortable giving it an MCP token that may create paid ecommerce content tasks. Prefer a least-privilege token, run it from an environment without unrelated secrets, confirm credits before task creation, and consider pinning the npm package version before use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
86% confidence
Finding
The script launches `npx -y @infimind/ecom-content-cli@latest`, which fetches and executes the latest package version at runtime. This creates a supply-chain risk: a compromised upstream package, dependency, or registry response would be executed with the current user's privileges and with `MCP_TOKEN` present in the child process environment. In this skill context, the tool is explicitly intended to handle enterprise ecommerce workflows, so compromise could expose credentials or manipulate content operations at scale.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes shell commands, reads local files via user-provided paths, and consumes environment variables for authentication, but it does not declare those capabilities or permissions. That creates a transparency and containment problem: an agent or user may invoke a skill believing it is narrowly scoped, while it can access sensitive local resources and secrets needed to operate the MCP client.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a specialized color-unification workflow, but its instructions also expose generic MCP client behavior such as listing all tools and calling arbitrary IMIVA tools through a generic wrapper. This scope expansion can enable privilege creep and unintended access to any capability available to the token, making the effective blast radius much larger than the advertised single-purpose function.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
82% confidence
Finding
`os.environ.copy()` forwards the entire parent environment into the spawned `npx` process, not just the variables needed for operation. If the child package or one of its dependencies is malicious or compromised, it can access unrelated secrets from the environment in addition to `MCP_TOKEN`. This is more dangerous here because the subprocess is a dynamically fetched external package.

Static analysis

No suspicious patterns detected.