ClawHub
Back to skill

Security audit

WorkBuddy环境安全体检

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent local WorkBuddy health checker, but review is warranted because it scans sensitive local data while its privacy and integrity claims do not fully match the package contents.

Install only if you want a local WorkBuddy audit tool that reads WorkBuddy state, scans skill text for credential-like strings, inspects backup packages, and writes local reports. Review reports before sharing them because backup paths may appear despite the documentation saying otherwise, and treat the package’s self-attestation hash as unreliable until the publisher republishes consistent metadata.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises 'zero network' and 'read-only', but the content instructs running a Python script and writing reports to disk while declaring no permissions. That mismatch is a real security issue because users and policy engines cannot reliably understand or constrain the skill's actual capabilities, especially given detected shell, file read/write, environment, and network-related capabilities.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The script promises that reports will not contain host or personal information, but `render_md()` includes the full backup ZIP path when `zip_path` is present. Because backup paths are derived from the user's home directory or user-supplied locations, the report can disclose usernames, directory structure, and storage locations, which is an information disclosure issue and also violates the tool's own privacy guarantees.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases are broad enough to match routine requests like '安不安全', '稳不稳定', or '维护一下', which can cause the skill to activate unexpectedly in unrelated contexts. Because this skill performs environment inspection and writes reports, over-broad activation increases the chance of unintended sensitive file access or shell execution without sufficiently specific user intent.

Static analysis

No suspicious patterns detected.