ClawHub
Back to skill

Security audit

Seal and License Workflows or Skill Packages (Anti-Piracy, Node-Authorized Delivery)

Security checks for vulnerabilities and agentic risk

Overview

The skill’s local packaging and licensing workflow matches its stated purpose, and its demo file writes and authentication are disclosed.

Trust the MGC runtime and package author before executing sealed scripts; encryption does not make code safe. Keep source backups before reimporting packages, and protect any existing demo-named Desktop/home files. Install using a quoted requirement such as pip install 'mgc-blackbox>=1.5.4'.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The file is labeled as an example demonstrating module and standalone-script compatibility, which relates to the declared import/subprocess support. However, its actual standalone behavior is an undeclared Desktop/home-directory file write. No packaging, encryption, source binding, licensing, or sealed-execution implementation appears in this chunk. This assessment is limited to the supplied code and does not establish what the rest of the skill implements.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 483)May include surrounding context.

md
MGC_TOKEN = f.read().strip()

def call_remote_script(info_owner, ext02=None):
    return requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": MGC_TOKEN},
        json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 483)May include surrounding context.

md
MGC_TOKEN = f.read().strip()

def call_remote_script(info_owner, ext02=None):
    return requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": MGC_TOKEN},
        json={

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 483)May include surrounding context.

md
MGC_TOKEN = f.read().strip()

def call_remote_script(info_owner, ext02=None):
    return requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": MGC_TOKEN},
        json={

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · example/script_c.py (reported line 31)May include surrounding context.

python
target = here / "config_a.py"

    # ── subprocess: literal list form (MGC ext08 recognizes this) ──
    proc = subprocess.run(
        [sys.executable, str(target), "--user", user, "--greeting", greeting, "--print"],
        capture_output=True, text=True,
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · example/script_d.py (reported line 39)May include surrounding context.

python
# 2. C (subprocess) — runs in a sealed subprocess
    c_target = here / "script_c.py"
    proc = subprocess.run(
        [sys.executable, str(c_target), "--user", user, "--greeting", greeting],
        capture_output=True, text=True,
    )