ClawHub
Back to skill

Security audit

WorkBuddy安全稳定运行专家团

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local WorkBuddy security and recovery helper, with no evidence of hidden network use, exfiltration, or automatic destructive behavior.

Install only if you want a local WorkBuddy security and recovery assistant. Run the audit/recovery scripts deliberately, review output paths first, and use --execute only after confirming the recovery sandbox location and available disk space.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'dst' from os.environ.get (line 78, credential/environment) → shutil.copy (file write)

Medium
Category
Data Flow
Content
shutil.copytree(s, dst)
            else:
                os.makedirs(os.path.dirname(dst), exist_ok=True)
                shutil.copy(s, dst)
            copied += 1
        except Exception as e:
            print("  复制失败 %s: %s" % (s, e))
Confidence
83% confidence
Finding
The destination path used for copying is rooted in SB, which is derived from the TEMP environment variable. An attacker who can influence the process environment can redirect the recovery sandbox to an arbitrary filesystem location, causing this script in --execute mode to write recovered files outside the intended temp area. In this recovery context, the copied data includes identity, memory, expert package, connector metadata, and workspace snapshots, so misdirected writes could disclose sensitive data or overwrite files in unexpected locations.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises and references operational scripts and behaviors that imply shell, file read/write, and environment access, yet it declares no permissions. This creates a dangerous mismatch between user expectations, platform enforcement, and actual capability assumptions: if the runtime grants ambient tool access, the skill may perform sensitive local inspection or modification without explicit consent boundaries.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The module docstring states the script is '只读，不修改包内任何文件', but the implementation creates directories and writes security_results.json. This is not code-execution or data-theft behavior, but it is a real integrity and trust issue because operators may rely on the read-only claim when running the script in sensitive environments.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger list includes broad phrases such as security check, encryption, keys, backup, and system slowdown, which are common in ordinary conversation. Over-broad activation can cause the skill to engage in sensitive security-oriented workflows unexpectedly, increasing the chance of unnecessary credential scanning, configuration inspection, or disruptive recommendations in contexts where the user did not intend that behavior.

Static analysis

No suspicious patterns detected.