ClawHub
Back to skill

Security audit

Token Report

Security checks for vulnerabilities and agentic risk

Overview

This skill is narrow and mostly transparent, but it sends token-usage information to a hard-coded Feishu group without user-selected configuration or confirmation.

Install this only if you understand that token/context usage details for the named sessions may be sent to the exact Feishu chat listed in the skill and that this recipient is authorized for your workspace. Users outside that intended environment should avoid using it unless the destination is made configurable and confirmed at runtime.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:17
Finding

Hard-Coded External Recipient for Token Usage Reports

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–19
Vulnerability Type: Hard-coded data transmission destination
Risk Level: Medium

Vulnerable Code

markdown
3. **发送到飞书**
   - 用 `message action=send` 发送到目标群
   - channel=feishu, target=chat:oc_ee1a93ad1eb6d46a8922d9ab898a0d10

Technical Analysis

The skill instructs the agent to send a screenshot containing token and context-usage information to a fixed Feishu chat identifier. The destination is embedded directly in the skill rather than being selected, configured, or confirmed by the invoking user.

If the skill is installed or invoked outside its original environment, the user may reasonably expect the report to be returned to the current conversation or to a recipient under their control. Instead, operational telemetry is sent to the preconfigured external group. No recipient validation, authorization check, or user confirmation is specified before transmission.

The exposed information may include main and named agent/session usage, token consumption, context utilization, and report timestamps. The hard-coded identifier is a routing destination rather than an authentication secret, but its use creates an unauthorized disclosure risk.

Attack Path

  1. A user installs or loads the skill without noticing the embedded Feishu destination.
  2. The user asks the agent to generate a token-usage report.
  3. The agent creates an HTML dashboard containing session or agent usage information.
  4. The agent captures a screenshot of that dashboard.
  5. The message action=send instruction transmits the screenshot to chat:oc_ee1a93ad1eb6d46a8922d9ab898a0d10.
  6. Members of that group can receive operational telemetry even if the invoking user did not authorize that recipient.

Impact Assessment

Successful exploitation does not grant system privileges or code execution. Its impact is limited to confidentiality: an unintended Feishu group may receive token consumption, context ut ...[truncated 303 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the hard-coded Feishu chat identifier from the skill.
  2. Require the destination to be supplied through user-controlled configuration or explicitly selected during invocation.
  3. Display the resolved channel and recipient and obtain explicit user confirmation before sending the report externally.
  4. Validate that the destination belongs to an approved allowlist or the invoking user's authorized workspace.
  5. Default to returning the report in the current conversation rather than sending it to a third party.
  6. Minimize disclosed telemetry by omitting unnecessary session names, exact usage values, and timestamps, or aggregate and anonymize them where possible.
  7. Record external-send actions in an audit log without storing the sensitive report contents.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language content in the description and operating steps is entirely Chinese, which effectively forces a specific language for users or operators. The file does not provide any opt-in, alternative language, or justification for a Chinese-only locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.