ClawHub
Back to skill

Security audit

ClawHub发布工具

Security checks for vulnerabilities and agentic risk

Overview

This skill is a publishing helper, but it embeds a ClawHub bearer token and uploads selected local files without preview or explicit account control.

Review this before installing. Use only on a clean skill directory that contains exactly the files intended for publication, and avoid relying on the bundled token; a safer version should require the user's own authentication, show the files to be uploaded, and ask for confirmation before publishing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'upload_url' from requests.post (line 23, network input) → requests.put (network output)

Medium
Category
Data Flow
Content
if upload_url:
        # 上传文件内容
        requests.put(upload_url, data=content, headers={"Content-Type": content_type})
    
    return True
Confidence
96% confidence
Finding
The code takes an upload URL returned by a remote service and immediately performs a PUT to that URL without validating the destination host, scheme, or expected storage provider. If the upstream API is compromised, misconfigured, or intercepted, this can exfiltrate local file contents to an attacker-controlled endpoint, making this an SSRF-style exfiltration sink rather than a harmless upload helper.

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill documentation exposes functionality that reads local files from a user-specified path and publishes them remotely, yet no permissions are declared. This creates a transparency and consent problem: users or higher-level tooling may not realize the skill can access local content and transmit it over the network, increasing the risk of unintended data disclosure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented behavior involves authenticated network access and transmission of local directory contents to a remote service, while the analysis indicates use of an embedded hardcoded token. A hardcoded credential is a serious secret-management flaw because anyone with access to the skill can reuse the token, and combining it with file upload capability raises the risk of unauthorized publication or exfiltration of local content.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script automatically enumerates and uploads all matching files in the specified directory to a remote service with no confirmation, preview, or explicit consent step. In a publishing tool this behavior is contextually risky because users may point it at the wrong directory or include sensitive files such as local notes, configs, or unpublished code that match the extension filter.

Static analysis

No suspicious patterns detected.