ClawHub
Back to skill

Security audit

Review Responder

Security checks for vulnerabilities and agentic risk

Overview

The review-response templates are coherent, but the package also includes an under-disclosed utility script that can persist and export user-supplied text locally.

Review before installing. The response templates themselves are ordinary, but avoid passing customer, order, credential, or internal business data to the bundled generic utility unless you accept local plaintext retention. The publisher should remove the unrelated utility or clearly document storage paths, retention, deletion behavior, and consent.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:5
Finding

Undisclosed Persistent Plaintext Storage of User-Supplied Data

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:5-8, scripts/script.sh:30, scripts/script.sh:52-53, and scripts/script.sh:88-89
Vulnerability Type: Persistent plaintext storage and logging of potentially sensitive input
Risk Level: Medium

Vulnerable Code

bash
DATA_DIR="${REVIEW_RESPONDER_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/review-responder}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"
bash
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }
bash
cmd_add() {
    echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo "  Added: $*"
    _log "add" "${1:-}"
}
bash
run) shift; cmd_run "$@" ;;
add) shift; cmd_add "$@" ;;

Technical Analysis

The script creates a persistent data directory whenever it runs. Its add command stores all supplied arguments in data.log, while _log records command data in history.log. The run command also passes its first user-supplied argument to _log.

The Skill is presented as a customer-review response assistant, so arguments may reasonably contain review text, customer identifiers, order details, complaint information, or other business data. The documentation does not disclose that the generic utility persists such input. The script does not redact sensitive fields, request explicit storage consent, define retention limits, or establish restrictive permissions through umask 077 or explicit chmod operations. Resulting access permissions therefore depend on the caller's environment and inherited umask.

Although cmd_remove reports that an item was removed, it does not alter either stored file:

bash
cmd_remove() {
    echo "  Removed: $1"
    _log "remove" "${1:-}"
}

Consequently, users may incorrectly believe that stored information has been deleted.

Attack Path

  1. A user or agent invokes scripts/script.sh and supplies customer-review or order-rela ...[truncated 1484 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove scripts/script.sh if it is unrelated to the declared review-response functionality.

  2. Require explicit user consent before storing any supplied content, and clearly document the storage path, purpose, format, and retention period.

  3. Avoid recording raw command arguments. Log only non-sensitive event metadata or redact customer identifiers, review content, order information, credentials, and tokens.

  4. Create storage with restrictive permissions before writing files:

    bash
    umask 077
mkdir -p -- "$DATA_DIR"
touch -- "$DB" "$DATA_DIR/history.log"
chmod 700 -- "$DATA_DIR"
chmod 600 -- "$DB" "$DATA_DIR/history.log"

  5. Implement a functional deletion command that identifies and removes the requested record, verifies the result, and returns a failure status if deletion does not occur.

  6. Add retention controls that automatically expire historical records and provide an explicit command to erase all stored data.

  7. Validate REVIEW_RESPONDER_DIR before use and document that changing it can direct stored data to another filesystem location.

  8. Add tests confirming that sensitive arguments are not logged, files receive restrictive permissions, and deletion actually removes the selected data.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill metadata and documentation claim a narrowly scoped review-response assistant, but the observed behavior reportedly includes unrelated local storage, history logging, and arbitrary item-management features. That mismatch is dangerous because it can mislead users into granting trust to a skill that performs broader data handling than advertised, increasing the risk of unexpected data collection, persistence, or misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script materially deviates from the declared skill purpose and instead provides a generic local data logging CLI with arbitrary add/search/export behavior. In an agent-skill context, this mismatch is dangerous because it can enable unexpected collection, storage, and disclosure of user or workflow data under the guise of a review-response assistant, defeating user expectations and security review assumptions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The invocation guidance lists generic phrases such as '评价回复、好评、差评、客户评价、电商评价' and 'Use when responding to customer reviews' without clear constraints, explicit trigger phrases, or negative examples. These broad terms could match ordinary discussion about reviews rather than a deliberate request to invoke the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This skill embeds all user-facing guidance, templates, and command descriptions in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when they are clearly documented and justified or when users are offered a language choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The inline documentation explicitly labels the tool as a multi-purpose utility tool, contradicting the advertised review-response functionality. This kind of deceptive or misleading presentation increases the chance that operators will invoke or approve the skill without realizing it performs broader local data-management actions than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

All command arguments are persistently written to history.log without any user-facing notice or consent. In a review assistant context, arguments may include customer text, internal notes, tokens, or other sensitive operational data, so undisclosed retention increases privacy and data leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The add command stores user-supplied content in a persistent file, but the help text does not disclose that entered content will be retained locally. Because this skill is presented as a review-response assistant, users may input reviews, draft replies, or sensitive business data and not expect silent persistence or later export/search access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The natural-language description is presented bilingually, but the file does not explain whether outputs will be forced into a particular language or whether the user can choose their preferred language. This can create a locale-policy concern if the skill defaults to one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guidance section and best practices are entirely in Chinese, which can impose a language requirement on users without any opt-in or stated justification. The policy for this audit flags language or locale constraints when the skill does not offer user choice or explain that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.