ClawHub
Back to skill

Security audit

hourly-report

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it has under-disclosed reporting integrity and unsafe browser/network behavior that users should review before installing.

Install only after reviewing and preferably fixing the crawl mode and data-provenance behavior. Use API mode for production, avoid simulated financial metrics in real reports, restrict liveUrl to Douyin and webhooks to DingTalk, keep Chromium sandboxing enabled where possible, store secrets outside command-line arguments, and pin dependencies with a lockfile.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
hourly-report.js:11
Finding

Unrestricted User-Supplied URLs Enable SSRF and Unauthorized Report Exfiltration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
hourly-report.js:37
Finding

Chromium Security Sandbox Is Explicitly Disabled for Untrusted Page Rendering

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
hourly-report.js:69
Finding

Douyin Client Secret Is Transmitted in a GET Request Query String

Content
View full analysis
Remediation
View remediation

other

Error
Location
hourly-report.js:249
Finding

Failed API Transaction Retrieval Is Silently Replaced with Fabricated Data Labeled as API-Sourced

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:109
Finding

Documentation Installs Mutable, Unpinned Runtime Dependencies Without a Lockfile

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

主体功能与声明基本一致：代码会按整点调度、通过抖音开放平台 API 或 Puppeteer 爬取直播数据、格式化为 Markdown 并发送到钉钉群。这与“小时战报”描述高度吻合。但仍存在实质性未声明能力：1）代码额外注册了 23:59 的定时任务，生成并发送“日终总结”，这超出了仅“每小时定点获取并发送小时战报”的描述；2）在爬取模式下成交数据并非真实获取，而是直接生成随机 orders/GMV/conversionRate，且 API 获取失败时也会回退到模拟数据，这会导致发送内容包含伪造业务数据，属于与描述不符的重要行为。另一个次要不一致是声明权限为空，但代码实际会访问外部网络（抖音 API、直播页面、钉钉 webhook）；不过按本任务重点，主要问题仍是未声明功能与数据真实性偏差。

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
const DouyinHourlyReport = require('./hourly-report.js');

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md
}

  /**
   * 获取Access Token
   */
  async getAccessToken() {
    const now = Date.now();

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · hourly-report.js (reported line 63)May include surrounding context.

js
}

  /**
   * 获取Access Token
   */
  async getAccessToken() {
    const now = Date.now();

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · hourly-report.js (reported line 85)May include surrounding context.

js
}

  /**
   * 获取Access Token
   */
  async getAccessToken() {
    const now = Date.now();

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · hourly-report.js (reported line 91)May include surrounding context.

js
}

  /**
   * 获取Access Token
   */
  async getAccessToken() {
    const now = Date.now();

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs users to provide live DingTalk webhook URLs and Douyin API credentials, but does not clearly warn that these secrets and operational data will be transmitted to external services. This increases the risk of accidental credential exposure, misuse of production webhooks, and unintended disclosure of live-stream business metrics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The crawling mode is presented as immediately usable without a clear warning that it relies on automated scraping of a third-party platform. That can create compliance, account restriction, and service-disruption risk, especially if users deploy it in production without understanding platform terms, rate limits, or anti-bot controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file repeatedly formats dates/times with the 'zh-CN' locale and presents all user-facing output in Chinese, which forces a specific language/locale behavior. The code does not provide an opt-in, configuration option, or documented justification that this skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

In crawl mode, transaction metrics are explicitly fabricated with random values, but later presented in the report as normal 成交数据 without any visible disclaimer. This can mislead recipients into making operational or financial decisions based on false business data, which is a security/integrity issue even if it is not code-execution related.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

When API transaction retrieval fails, the code falls back to random simulated values but still labels the report source as '(API)'. This creates a false provenance signal, making recipients trust invented成交数据 as official API output and undermining report integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code sends generated reports containing livestream metadata and engagement metrics to a remote DingTalk webhook via HTTP POST. Although there is a success/failure log, there is no explicit user disclosure or warning in comments/docstrings near the sending behavior about transmitting collected data off-system to a third-party endpoint.

Content

No source excerpt is available for this finding.