ClawHub
Back to skill

Security audit

Brand Visibility Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its brand-monitoring purpose, but it sends sensitive business queries to external services and includes an under-documented Tavily API service with weak default authentication.

Review before installing if your brand, competitor, campaign, or client terms are confidential. Use --no-push unless you intentionally want Feishu delivery, avoid sensitive test data, and do not run api/geo_api.py publicly without replacing the placeholder API key, adding real authentication/rate limits, and protecting TAVILY_API_KEY.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares only `allowed-tools: Bash(python3)` but the documented behavior clearly implies broader capabilities: reading environment variables, reading/writing local files, invoking network endpoints, and shell execution. This mismatch reduces transparency and can mislead users or policy enforcement about what the skill can actually access or transmit.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill description presents itself as a brand visibility monitor for AI platforms, but the documented behavior expands into third-party verification, external search aggregation via Tavily, paid-tier gating, and even an external API service not disclosed in the top-level summary. This description-behavior mismatch is dangerous because users may authorize or run the skill without understanding that their queries, API keys, or brand-monitoring data could be routed to additional services.

Intent-Code Divergence

Low
Confidence
89% confidence
Finding
The API authentication model relies on a hardcoded placeholder key in application code, which is weak and likely to be reused, guessed, or accidentally shipped unchanged. In a service exposed over the network, this can permit unauthorized access to the search endpoint and abuse of the backend Tavily quota using the operator's credentials.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The module exposes local functions that directly set the subscription tier to pro or enterprise by editing the local quota state, with no server-side authorization or cryptographic proof. This allows any local caller or modified workflow to bypass paid-feature enforcement, undermining licensing controls and making the documented verification model ineffective.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The documentation states that paid tiers are unlocked via API-key verification, but the implementation also permits tier elevation through local file mutation and helper functions. That mismatch creates a real authorization flaw because operators may assume entitlement checks are enforced remotely when they are not.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README instructs users to configure a Feishu webhook for report delivery but does not clearly disclose that brand-monitoring results and related metadata will be transmitted to an external Feishu service. In this skill’s context, reports may contain commercially sensitive brand, competitor, or monitoring information, so silent third-party transmission creates a real data-sharing and privacy risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README tells users to set a Tavily API key for the paid version but does not warn that brand queries and potentially related analysis data may be sent to Tavily for real-time search. Because this skill is specifically designed for brand visibility and competitor monitoring, those queries can be sensitive business intelligence, making undisclosed external transmission a meaningful security and privacy concern.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger set includes broad generic phrases like `GEO`, `AI可见性`, and `品牌监控`, which can cause the skill to activate in unrelated contexts. Overbroad invocation increases the chance of unintended execution, accidental external requests, and unexpected handling of sensitive brand or business data.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation states that data may be transmitted to Tavily, Feishu, and a verification API, but it does not provide a prominent, explicit privacy warning describing what user data, brand names, reports, or credentials are shared externally. In a monitoring skill, that omission matters because brand queries, competitive analysis terms, and webhook/API secrets may be sensitive business information.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
When AI_ENDPOINT is configured, the code sends the brand name and summarized search-result snippets to an external AI service without any consent flow, disclosure, data-classification check, or minimization controls. In a brand-monitoring skill, those snippets may contain sensitive business intelligence or third-party content, creating privacy, confidentiality, and compliance exposure.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script automatically submits user-supplied keywords to multiple third-party AI services without an explicit privacy notice, consent gate, or data classification check. In this skill context, users may input brand, campaign, customer, or competitive terms that are sensitive, so silent transmission to external platforms can cause confidentiality and compliance exposure.

External Transmission

Medium
Category
Data Exfiltration
Content
- ✅ 我们服务器中转，无需本地环境
- ✅ 稳定高效，不封IP

> 购买专业版/企业版后，请在 [https://yk-global.com](https://yk-global.com) 获取API密钥，使用 `--api-key YOUR_KEY` 参数运行即可解锁全部功能。验证接口：`POST https://api.yk-global.com/v1/verify`，验证失败自动降级到免费版，不阻断使用。

## 支持的AI平台
Confidence
85% confidence
Finding
External transmission to `https://api.yk-global.com/v1/verify` is not inherently malicious, but it is a real security-relevant behavior because it sends data off-host to a third party for licensing/version verification. In this skill’s context, that can expose API keys, usage metadata, or brand-monitoring activity if not carefully minimized and clearly disclosed.

Static analysis

No suspicious patterns detected.