ClawHub
Back to skill

Security audit

招商线索池

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about most behavior, but it needs review because one detail lookup option can reveal phone numbers and silently update real lead records without the same confirmation gate used for other write actions.

Install only for users authorized to operate Hawkeye lead data. Treat the test lane as production-like business data, verify the target domain before use, avoid --plain-phone unless the user explicitly needs and approves plaintext phone access, and remove the stored token when no longer needed.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill explicitly uses network access and environment-variable based configuration/token handling, yet no permissions are declared. This creates a trust gap: a caller may assume the skill is low-risk while it can make authenticated backend requests and consume credentials from the local environment, increasing the chance of unintended data access or mutation.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented behavior exceeds the stated purpose in security-relevant ways: it can retrieve plaintext phone numbers, read/store tokens, and even indicates that a nominally read-only detail operation may trigger state changes. This mismatch is dangerous because users or orchestrators may invoke the skill under the assumption it is only for safe viewing/administration, when it can expose PII and perform side effects on real business data.

Static analysis

No suspicious patterns detected.