ClawHub
Back to skill

Security audit

智能体长期记忆评测台

Security checks for vulnerabilities and agentic risk

Overview

The main benchmark is coherent, but a self-test advertised as local can use existing API keys and contact an external model service without a separate opt-in.

Review before installing or running in an environment that already has SiliconFlow, DeepSeek, or REAL_API_KEY credentials set. The default benchmark run is local, but avoid running tools/security_test.py with those keys in the environment unless you are comfortable with a possible external model request and small API usage. Use explicit output paths or a disposable workspace if you do not want result files overwritten.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises and instructs use of environment variables, local file reads/writes, and optional network access, but the metadata shown in this file does not declare corresponding permissions or capabilities. That mismatch can mislead users and hosting platforms about the skill's actual behavior, reducing informed consent and weakening sandbox/policy enforcement.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The report is internally inconsistent: it claims zero findings and a perfect score, but later assigns a non-zero risk level (P2). In a security assurance document, such contradictions can mislead users about the actual safety posture and undermine trust in the review process, even if they do not directly enable code execution.

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
The file explicitly mandates a fixed branding form ("品牌署名统一用「注册老炮」，不得出现个人真名、在职公司或内部路径") without any user opt-in or clear security justification. In an agent skill, this can override user or system-preferred output conventions, conceal attribution details, and pressure downstream agents to follow publisher-controlled messaging rather than user intent.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The documentation states that bundled tools write artifacts such as security_results.json and generate radar output, but it does not prominently warn users before execution that local files will be created or overwritten. While low severity, undocumented file creation can surprise users, clutter workspaces, or overwrite existing artifacts if filenames collide.

External Transmission

Medium
Category
Data Exfiltration
Content
or os.environ.get("DEEPSEEK_API_KEY"))
    if not key:
        return "未答出(无API密钥)"
    base = os.environ.get("REAL_API_BASE", "https://api.siliconflow.cn/v1").rstrip("/")
    model = os.environ.get("REAL_MODEL", "deepseek-ai/DeepSeek-V3")
    prompt = (f"你是严谨的记忆问答助手。仅依据给定上下文作答，"
              f"上下文无依据时回答\"未知\"。\n\n上下文:\n{transcript}\n{history}\n\n问题:{q}\n答:")
Confidence
86% confidence
Finding
When the API backend is enabled, the script transmits the full transcript, history block, and questions to an external LLM service. In a benchmark tool this may be expected, but it still creates data egress risk because potentially sensitive evaluation content is sent off-host to a third party.

Static analysis

No suspicious patterns detected.