ClawHub
Back to skill

Security audit

XUNBEE Message Inbox

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only XUNBEE inbox helper for retrieving a user's own short-lived email/SMS messages and verification codes.

Install only if you trust XUNBEE and intend an agent to read your own short-lived inbox messages or OTPs. Use a read-only, expiring messages:read key, keep it in private skill settings or an environment variable, avoid broad inbox listings, and do not override XUNBEE_BASE_URL unless you control or explicitly trust that HTTPS server.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Credential Access

High
Category
Privilege Escalation
Content
*.py[cod]
.pytest_cache/
.venv/
.env
.env.*
.clawhub/
*.zip
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High
Category
analysis-evasion
Content
Human-facing documentation: [简体中文](README.md) | [English](README_EN.md).
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
Human-facing documentation: [简体中文](README.md) | [English](README_EN.md).
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill requires environment access and outbound network access to a bearer-token protected API, but it does not explicitly declare a tool scope or allowed-tools policy. That omission weakens sandboxing and review controls because the runtime may grant broader capabilities than strictly needed, increasing the blast radius if the script or future edits are compromised.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- The user's API key with the `messages:read` scope
- Optional `channel`, `source_ref`, and `keyword` filters

Keep the key in `XUNBEE_API_KEY`; do not ask the user to paste it into chat or
place it in URLs, screenshots, command arguments, logs, or shared output. The
client sends HTTPS requests to `https://cc.akuwan.cn` by default.
`XUNBEE_BASE_URL` may override that destination only when the user explicitly
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This code retrieves message inbox contents from a remote service and prints either full message JSON or a verification code directly to stdout. While the script has CLI help text, it does not include any warning, comment, or disclosure that these outputs may contain sensitive communications or one-time codes, which is relevant for a code file performing privacy-impacting network access and data disclosure.

Natural-Language Policy Violations

Low
Confidence
86% confidence
Finding
The primary README content is presented in Simplified Chinese, with English only offered as an alternate link. This can be a language/locale policy concern when users are not first given a neutral or opt-in language choice in the main document.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
README_EN.md:152

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
README.md:144