ClawHub
Back to skill

Security audit

notify-hub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-channel notification tool; it handles sensitive credentials and outbound messages, but those behaviors fit its stated purpose.

Install only if you want an agent to send messages or files to your configured chat/email destinations. Treat webhook URLs, bot tokens, and SMTP passwords as credentials, keep the config file private, use dry-run for previews, and avoid using broad broadcast targets or file attachments unless the content and recipients are explicit.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'DEFAULT_CONFIG' from os.environ.get (line 29, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
def save_config(cfg):
    os.makedirs(os.path.dirname(DEFAULT_CONFIG), exist_ok=True)
    with open(DEFAULT_CONFIG, "w", encoding="utf-8") as f:
        json.dump(cfg, f, ensure_ascii=False, indent=2)
    try:
        os.chmod(DEFAULT_CONFIG, 0o600)  # 凭据敏感，仅本人可读
Confidence
82% confidence
Finding
The config file path is taken from the NOTIFY_CONFIG environment variable and then written without validation. In environments where an attacker can influence process environment or invocation context, this can redirect credential-bearing output to an unintended file path, causing credential disclosure, overwriting sensitive user files, or symlink-based abuse.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises and instructs use of capabilities including network access, local config storage, and shell execution via a Python script, but does not declare permissions. This creates a trust and review gap: operators may invoke a skill that can send external messages and handle secrets without an explicit permission model, increasing the chance of unintended data exfiltration or misuse.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases are very broad and overlap with ordinary user requests to send, notify, remind, or broadcast messages. That makes accidental activation more likely in unrelated contexts, which is dangerous here because the skill performs outbound dispatch to multiple third-party channels and can broadcast sensitive content widely.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The tutorial explicitly tells users to place a Feishu webhook URL and secret into a command line invocation for automated delivery, but it provides no warning that these are sensitive credentials or that pushed content is sent to an external third-party service. In the context of a notification/broadcast skill, this increases the chance of credential leakage through shell history, screenshots, copied docs, or misuse of the webhook to send unauthorized messages.

Vague Triggers

High
Confidence
95% confidence
Finding
The manifest registers many generic trigger phrases such as “通知”, “推送”, “广播”, and “notify” that overlap with ordinary user messaging intents. In an agent ecosystem, this can cause the skill to be selected too broadly and automatically route arbitrary content to external communication channels, increasing the risk of unintended data exfiltration, spam, or misuse across multiple destinations.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code accepts an arbitrary local file path from message data and, if the file exists, reads and emails it as an attachment without any path allowlist, sandboxing, or confirmation. In an agent context, this can enable unintended local file exfiltration if upstream input is influenced by a user or another untrusted component, making the dispatch skill materially more dangerous because its role is to transmit data off-host.

Static analysis

No suspicious patterns detected.