Security audit

龙虾数字人

Security checks for vulnerabilities and agentic risk

Overview

The skill’s video-generation purpose is coherent, but it should be reviewed because it sends credentials over plain HTTP and persists them inside scheduled watcher commands.

Install only if you trust the EasyClaw/Chanjing platform and are comfortable sending media, scripts, and callback details to it. Prefer a short-lived API token, avoid shared machines, rotate the token after use, and be aware that this version uses HTTP defaults and cron watcher commands that may expose credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no permissions, yet its documented behavior clearly requires sensitive capabilities including environment variable access, filesystem access, shell execution, and network communication. This mismatch is dangerous because it hides the true execution surface from reviewers and policy enforcement, making it easier for the skill to access secrets such as API tokens and perform external actions without explicit user or platform approval.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code reads platform credentials from environment variables and appends them as command-line arguments inside a scheduled prompt that tells another agent to run the command verbatim. This unnecessarily propagates secrets into job definitions, agent-visible message content, process arguments, and potentially logs, greatly increasing the chance of credential disclosure.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The script creates, edits, and removes recurring OpenClaw cron jobs that cause an agent to execute a local watcher command on a schedule. That persistence and delegated execution capability is materially more powerful than the declared video-generation purpose, making the skill context more suspicious and increasing the risk of misuse for unauthorized automation or covert monitoring.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide instructs users to input highly sensitive credentials (`app_id`, `secret_key`, and an `API Token`) and even shows them embedded in configuration examples, but it does not warn users to keep them secret, avoid committing them to source control, or prevent exposure in logs and screenshots. In a skill that relies on external platform authentication, this omission increases the chance of credential leakage and subsequent unauthorized use of the user's account or API quota.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The client is configured to use plain HTTP for both the API base URL and the user portal URL while also sending authentication headers such as X-API-Token, X-API-Key, and X-API-Secret. This exposes credentials and all request/response data to interception or modification by any attacker on the network path, enabling account compromise and tampering with generated media workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script accepts API token, key, and secret values directly as command-line arguments, which can expose sensitive credentials through process listings, shell history, job scheduler metadata, or system monitoring tools. In a cron/watcher context, this is more dangerous because long-lived automated jobs often run unattended on shared systems where other users or operators may be able to inspect running commands or stored job definitions.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script collects and transmits user-supplied script text, audio/background media references, and a callback URL to remote platform APIs, but provides no in-file disclosure, consent prompt, or validation around what data will leave the local environment. In an agent/skill context, this is risky because users may provide sensitive voice, image, or callback endpoint data without realizing it will be uploaded or persisted by an external service, increasing privacy and SSRF-style exposure if callback URLs are attacker-controlled.

Static analysis

No suspicious patterns detected.