ClawHub
Back to skill

Security audit

商机雷达-比招标更早发现机会

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed business-lead search integration that uses a vendor API, may create a trial account after consent, and writes local reports and an API key file.

Install this only if you are comfortable sending opportunity search terms to Zhiliao Biaoxun, allowing an optional trial-account registration that sends platform, CPU architecture, and a hashed MAC-derived identifier after consent, and storing a returned API key and HTML reports under your home directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares environment requirements but no explicit permissions, while the content instructs the agent to read local files (`~/.zlbx/config.json`) and write HTML reports to a user directory. This creates a transparency and consent gap: the agent may access or modify local resources beyond what a user expects from a 'business opportunity radar' skill.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The stated purpose is opportunity discovery, but the skill also generates offline HTML reports containing embedded branding, platform links, and export features. That extra behavior is not clearly reflected in the core description, which can mislead users about what artifacts are created and what content is inserted into them.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The document instructs the agent to perform automatic account registration and trial provisioning, which materially exceeds the skill’s declared purpose of business-opportunity discovery. Expanding scope into account lifecycle actions increases security and privacy risk because the agent is directed to collect device-derived data and create external service accounts, creating side effects unrelated to the user’s immediate analytical task.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill directs collection of platform, CPU architecture, and a hashed MAC-derived identifier for device deduplication, then sends that material to an external service. Even with hashing and partial minimization, this is still device fingerprinting outside the core lead-discovery purpose, and the skill context makes it more dangerous because users would not reasonably expect hardware-derived telemetry when asking for market opportunities.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The SID generation and auto-login/recharge flow introduces payment or account-funding enablement that is unrelated to the stated opportunity-radar functionality. This broadens the skill from information retrieval into authenticated account actions and monetization funnels, which raises phishing, consent, and account-takeover risk if mishandled.

Vague Triggers

High
Confidence
88% confidence
Finding
The trigger rules are extremely broad, including cases where the user did not explicitly mention business opportunities, causing the skill to auto-activate for overlapping sales, research, or project-discovery language. Over-broad activation can lead to unintended API calls, unexpected quota consumption, and unnecessary transmission of user queries to an external service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document describes reading a local config file, writing local reports, and automatically registering by sending device-derived identifiers such as `mac_hash`, yet it also says to suppress extra prompts once a source is found. This weakens informed consent and can result in local access and external data transmission occurring before the user has clearly approved them.

External Transmission

Medium
Category
Data Exfiltration
Content
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串
>
> 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`，
> 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`**
> （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。
>
Confidence
91% confidence
Finding
requests.post(url, json=

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.