ClawHub
Back to skill

Security audit

zhanfu-playwright

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed local automation helper for the ZhanFu desktop client, with sensitive actions that are expected for that purpose but should be used carefully.

Install only if you intend to let the agent control your local ZhanFu client and shop browsers. Before using destructive or account-changing actions such as clearing cache, setting plugins, changing shop credentials, creating shops, closing shops, or exiting ZhanFu, confirm the exact shop and action. Avoid passing credentials unless you are deliberately logging into your local ZhanFu instance.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (94)

Tainted flow: 'payload' from os.environ.get (line 373, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"args": json.dumps({"page": 1, "limit": 20}),
    }
    try:
        resp = requests.post(
            url,
            json=payload,
            headers={"Content-Type": "application/json"},
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'payload' from os.environ.get (line 373, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"args": json.dumps({"username": username, "password": password, "isboss": True}),
    }
    try:
        resp = requests.post(
            f"http://127.0.0.1:{port}",
            json=payload,
            headers={"Content-Type": "application/json"},
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The description presents a broad WebDriver/Playwright automation capability for 站斧/战斧 and emphasizes the transport model (HTTP before port acquisition, CDP after) and general store/RPA automation use. The supplied code does not perform general automation tasks; instead it only checks whether a security-detection page has passed by inspecting page text, button state, and tab count, optionally waiting and failing on timeout. It does use headed Playwright over CDP, which partially aligns, but the primary purpose is materially narrower and different from the declared description. The code also assumes the WebDriver port is already provided and contains no logic for obtaining that port via HTTP WebDriverModule as described.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The declared description presents a general ZhanFu WebDriver/Playwright automation skill with a specific architecture: use HTTP only to obtain the WebDriver port, then use CDP for the actual business actions. The supplied code does something else: it parses a `--mall-name`, resolves the corresponding mall/browser ID, and invokes `CloseBrowser` over HTTP to close that shop instance. There is no WebDriver port acquisition step, no Playwright usage, and no CDP business execution. While the code is related to ZhanFu/store automation, its actual purpose is a dedicated close-shop helper, not the described WebDriver/Playwright automation flow. Therefore this is a material description-behavior mismatch.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description presents the skill as a WebDriver/Playwright automation capability centered on obtaining a WebDriver port and then driving business logic through CDP. The supplied code does something materially different: it invokes an HTTP command to exit the Zhanfu client entirely. That is a separate operational capability with potentially significant effect, and it is not disclosed in the description. There is no Playwright automation, no CDP workflow, and no evidence that this script's primary purpose is limited to the declared WebDriver-port acquisition behavior. Therefore, the description does not accurately represent this code chunk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The declared description frames the skill as a WebDriver/Playwright automation layer focused on obtaining a WebDriver port and then using CDP to execute automation tasks under certain OS/version/UI constraints. This code does not do that. Instead, it fetches a paginated list of malls/shops from ZhanFu via `GetBrowserList`, handles login/down states, prints the list, and persists it to a cache file. That is a materially different primary purpose from the declared WebDriver-port/CDP automation behavior, so this chunk does not accurately match the description.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The declared description presents a WebDriver/Playwright automation capability centered on obtaining a WebDriver port via HTTP and then executing business logic through CDP, with platform/version constraints and forced headed mode. The supplied code instead implements a login utility: it parses credentials from command-line arguments, invokes an HTTP "Login" API with isboss=true, handles communication/login failures, then calls "GetBrowserList" and stores mall information to cache. This is a materially different primary purpose from the declared Playwright/WebDriver automation flow. While both relate to ZhanFu and use HTTP communication, the actual code performs account authentication and data caching rather than the described browser automation workflow.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The description frames the skill as a WebDriver/Playwright automation bridge: use HTTP only before getting the WebDriver port, then execute business logic through CDP. This code instead exposes administrative management commands over the 站斧 HTTP API. Its primary behavior is profile/store lifecycle and configuration management, not browser automation. The code never retrieves a WebDriver port for later CDP use, never opens a Playwright session, and never performs browser-driven business tasks. Some platform constraints partially align (certain functions are Windows-only; macOS unsupported for those), and communication failure handling exists in one path, but the core declared purpose does not match the supplied code chunk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The description claims a specific architecture: before obtaining the WebDriver port, only HTTP calls to WebDriverModule are used; after obtaining the port, CDP executes business logic. The code does use HTTP first, but it also carries out major business operations over HTTP itself: login, readiness checks, mall lookup, mall creation, browser opening, browser closing, and client exit. CDP/Playwright is only optional via --connect-cdp, not the main or guaranteed business execution path. Additionally, the script includes undeclared local persistence, process lifecycle control, and installation-path resolution behavior. These are material enough that the declared description does not accurately represent the actual behavior.

Ae1

High
Category
analysis-evasion
Content
- **只允许**调用本 Skill 提供的 **HTTP 接口**（见 [reference.md](reference.md)）或 Shell 直接发 HTTP 请求
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- **只允许**调用本 Skill 提供的 **HTTP 接口**（见 [reference.md](reference.md)）或 Shell 直接发 HTTP 请求
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
> **例外（内置脚本）**：打开站斧运行 [`scripts/open_zhanfu.py`](scripts/open_zhanfu.py)；打开店铺运行 [`scripts/open_mall.py`](scripts/open_mall.py)；关店 / 列表 / 关站斧 / 登录 / 创建与插件等分别运行 `
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
> **例外（内置脚本）**：打开站斧运行 [`scripts/open_zhanfu.py`](scripts/open_zhanfu.py)；打开店铺运行 [`scripts/open_mall.py`](scripts/open_mall.py)；关店 / 列表 / 关站斧 / 登录 / 创建与插件等分别运行 `
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
> **例外（内置脚本）**：打开站斧运行 [`scripts/open_zhanfu.py`](scripts/open_zhanfu.py)；打开店铺运行 [`scripts/open_mall.py`](scripts/open_mall.py)；关店 / 列表 / 关站斧 / 登录 / 创建与插件等分别运行 `
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
> **例外（内置脚本）**：打开站斧运行 [`scripts/open_zhanfu.py`](scripts/open_zhanfu.py)；打开店铺运行 [`scripts/open_mall.py`](scripts/open_mall.py)；关店 / 列表 / 关站斧 / 登录 / 创建与插件等分别运行 `
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
all.py`](scripts/open_mall.py)；关店 / 列表 / 关站斧 / 登录 / 创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
all.py`](scripts/open_mall.py)；关店 / 列表 / 关站斧 / 登录 / 创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
/ 列表 / 关站斧 / 登录 / 创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本。阶段 B 页面自动化仍禁止落盘为业务 `.py`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
/ 列表 / 关站斧 / 登录 / 创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本。阶段 B 页面自动化仍禁止落盘为业务 `.py`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本。阶段 B 页面自动化仍禁止落盘为业务 `.py`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本。阶段 B 页面自动化仍禁止落盘为业务 `.py`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本。阶段 B 页面自动化仍禁止落盘为业务 `.py`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本。阶段 B 页面自动化仍禁止落盘为业务 `.py`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本。阶段 B 页面自动化仍禁止落盘为业务 `.py`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
创建与插件等分别运行 `close_mall.py`、`list_malls.py`、`close_zhanfu.py`、`login_zhanfu.py`、`zhanfu_ops.py`。**禁止**另写一次性脚本。阶段 B 页面自动化仍禁止落盘为业务 `.py`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Static analysis

No suspicious patterns detected.