ClawHub
Back to skill

Security audit

base-station-antenna-monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a purpose-aligned patent report generator, but it under-discloses alternate data inputs and renders external patent fields into HTML without escaping.

Review before installing. Use only trusted patent JSON or trusted MCP-sourced data, because crafted patent fields could alter the generated HTML report. Verify where the report will be written, especially if EUREKA_PYTHON_OUTPUT_DIR is set, and do not treat the report as verified live MCP data unless the data source is clear.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'output_path' from os.environ.get (line 885, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
os.makedirs(out_dir, exist_ok=True)
        output_path = os.path.join(out_dir, os.path.basename(args.output))

    with open(output_path, "w", encoding="utf-8") as f:
        f.write(html)
    print(f"[OK] HTML报告已生成: {output_path}")
Confidence
89% confidence
Finding
The script derives the output directory from the environment variable EUREKA_PYTHON_OUTPUT_DIR and then writes a file there without validating that the resolved path stays within an approved workspace. In a multi-tenant or untrusted execution environment, an attacker who can influence environment variables could redirect report output to unintended filesystem locations, causing unauthorized file creation or overwriting of writable files.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill claims to automatically retrieve recent patent data from an external MCP service, but the actual behavior reportedly also accepts externally supplied patent data via local JSON input and the PATENT_DATA_JSON environment variable without disclosing that in the skill description. This mismatch is dangerous because it can mislead users and reviewers about the true trust boundary, enabling unreviewed or manipulated input to be injected into generated reports and potentially used for data spoofing, report tampering, or unsafe downstream rendering if the HTML output is not sanitized.

Static analysis

No suspicious patterns detected.