Security audit

ht-skills

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Haotian library API client that uses a bearer token to manage remote documents and images, with normal integration risks but no hidden or malicious behavior found.

Install this only if you want OpenClaw to manage your Haotian library account content. Keep server_base_url/HT_SKILL_SERVER_URL set to the trusted official HTTPS service, protect the API token like a password, rotate it if exposed, and review agent-initiated write or upload actions before allowing them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: lib/api_client.py:33
Finding: Bearer Token Disclosure Through Unrestricted API Endpoint Configuration
Content: View full analysis
` to any configured destination. This includes an attacker-controlled HTTPS server or a plaintext HTTP endpoint. The same behavior affects ordinary API calls and multipart image uploads. The default configuration uses HTTPS and is not itself malicious. Exploitation requires the attacker to influence the process environment or project configuration. Nevertheless, configuration injection, unsafe automation, copied configuration instructions, or another component modifying the environment can t ...[truncated 2225 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Non-Reproducible Dependency Resolution for Security-Sensitive HTTP Client
Content: View full analysis
=2.28.0 ``` Related installation guidance in `SKILL.md:104` also permits resolution of an arbitrary current release: ```bash pip install requests ``` ### Technical Analysis The dependency declaration specifies only a minimum version and has no upper bound, exact pin, or package hash. Each installation can therefore resolve to a different future version of `requests` and its transitive dependencies. This does not establish that the currently available `requests` package is malicious or vulnerable. The risk is that installations are not reproducible and can consume a future compromised, vulnerable, or incompatible release without another review of this Skill. The package is particularly security-sensitive because it handles the bearer token, document content, and image uploads. A compromised dependency executes in the same Python process and inherits access to the process environment, local files available to that process, API credentials, and outbound network access. ### Attack Path 1. A user follows the installation instructions or installs from `requirements.txt`. 2. The package resolver queries the configured Python package index. 3. Because only a lower version bound is specified, the resolver selects the newest compatible release available at installation time. 4. If a future release, transitive dependency, configured mirror, or package-index account is compromised, malicious code can be installed without any project source change. 5. The malicious dependency executes during import or HTTP operations. 6. It can access `HT_SKILL_TOKEN`, request headers, document bodies, image data, and other resources available to the Skill process. 7. The malicious code can exfiltrate those values or alter API requests and responses. This path depends on a future upstre ...[truncated 733 chars]
Remediation: View remediation
--hash=sha256: ``` 4. Install from the locked file rather than instructing users to run an unconstrained `pip install requests`. 5. Use a trusted package index or controlled internal mirror and configure index allowlisting. 6. Add automated dependency vulnerability scanning and a deliberate update process. Dependency updates should regenerate hashes, run tests, and receive review before release. 7. Run the Skill inside a minimally privileged virtual environment or container so that a compromised dependency has limited filesystem and credential access. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Tainted flow: 'headers' from os.environ.get (line 126, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · lib/api_client.py (reported line 129)May include surrounding context.
python
headers = {"Authorization": f"Bearer {token}"} form_data = {k: v for k, v in (data or {}).items() if v is not None} try: resp = requests.post(url, files=files, data=form_data or None, headers=headers, timeout=timeout) resp_data = resp.json() if resp.content else {} if resp.status_code >= 400: err = resp_data.get("error") or resp_data.get("detail") or resp.text or f"HTTP {resp.status_code}"

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Yes, this is a mismatch. The declared description presents a fully featured skill for managing collections, documents, retrieval, and image assets. However, the actual code shown is only an empty lib/init.py file with no logic, no API calls, no triggers, and no resource access. Based on the supplied code chunk alone, the skill does not perform the stated functions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Yes, there is a mismatch. The description claims extensive functionality across document management, retrieval, and image handling, but the provided code chunk is effectively empty (__init__.py with only an encoding header). There is no implementation corresponding to any of the declared capabilities. This is a material description-versus-behavior mismatch because the actual code does not perform the stated purpose at all.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The client performs outbound HTTP requests, including authenticated requests with a bearer token, but the capability is reportedly undeclared. In this skill context, network access is central to functionality, which makes lack of declaration more dangerous because the skill can transmit content, metadata, and credentials to a remote service without transparent permissioning.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The client performs outbound HTTP requests, including authenticated requests with a bearer token, but the capability is reportedly undeclared. In this skill context, network access is central to functionality, which makes lack of declaration more dangerous because the skill can transmit content, metadata, and credentials to a remote service without transparent permissioning.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The client performs outbound HTTP requests, including authenticated requests with a bearer token, but the capability is reportedly undeclared. In this skill context, network access is central to functionality, which makes lack of declaration more dangerous because the skill can transmit content, metadata, and credentials to a remote service without transparent permissioning.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill documentation is presented entirely in Chinese from the title onward, with no indication that users may interact in other languages or that Chinese is a required, justified locale for a region-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language content of the skill, including the top-level description and all operating instructions, is exclusively in Chinese. This can violate a language/locale policy when the skill forces one language for all users without documenting a choice, opt-in, or region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring and metadata are written entirely in Chinese, indicating a language-specific skill surface without any visible opt-in, fallback, or justification for a region-specific use case. This matches the policy concern for forcing a specific language or locale absent documented user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code performs a network API call that transmits user-supplied document content and metadata to the server via POST /api/documents. Within this file there is no confirmation prompt, visible user-facing warning, or explanatory comment/docstring disclosing that local content may be uploaded to a remote service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The docstring, argument parser description, and help text are all presented only in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the stated policy, language constraints should either be optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script's user-facing description and CLI help text are entirely in Chinese, with no indication that users may choose another language or locale. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language strings in the file, including the module docstring and CLI descriptions, are entirely in Chinese, with no indication that the language is optional or that the skill is intended only for a Chinese-speaking or region-specific context. This can violate language/locale policy when a specific language is imposed without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and author text are written only in Chinese, indicating the skill is presented in a single language without offering the user a language or locale choice. The policy requires avoiding forced language/locale constraints unless the limitation is explicitly optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language strings in the docstring and argument parser description/help are only in Chinese, which implies a fixed language/locale experience. Under the policy, language constraints should offer user choice or be clearly documented as a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's human-facing description, argument help text, and error message are all written exclusively in Chinese, with no indication that another language is available. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring and CLI description/help strings are entirely in Chinese, creating a fixed language experience for users with no opt-in, alternative locale, or documented region-specific justification. The policy for natural-language content requires avoiding forced language/locale constraints unless the skill explicitly offers choice or clearly documents the locale limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language strings in the module docstring and CLI help are exclusively in Chinese, with no indication that another language can be selected or that the locale is intentionally restricted. Under the policy rule, forcing a specific language without user opt-in can be a language/locale policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This Python file issues a PATCH request that changes a document's collection membership, which is a file/data ownership modification and may have user-impacting consequences. The code provides no confirmation prompt, visible warning, or explanatory comment near the operation beyond the generic CLI description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and user-facing CLI help text are written only in Chinese, indicating a fixed language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code performs a PATCH request to rename an image group, which changes remote user data, but the file provides no user-facing confirmation prompt, log/print disclosure, or comment/docstring warning about the action. For a code file, a network operation that modifies data should have some visible disclosure unless the warning is documented elsewhere, which is not evident in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs a network upload of user-selected local file data via a multipart HTTP request. Although the script name and CLI description imply uploading, there is no confirmation prompt, explicit disclosure message, or inline warning near the transmission step about sending file contents and optional metadata to a remote service.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified as requests>=2.28.0, which is not pinned to an exact version. This makes builds non-reproducible and can cause the environment to resolve to different versions over time, including versions with newly disclosed vulnerabilities or breaking changes. In a skill that performs document management, retrieval, and image upload over networked services, the HTTP client library is security-relevant because it likely handles authentication, external requests, and file transfers.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The manifest references requests without an exact version, while the package has multiple historical advisories. Because the installed version cannot be determined from this requirement, there is a real supply-chain risk that an affected version could be installed, especially in fresh or automated environments. Given this skill's documented use of network access, uploads, and knowledge retrieval, a vulnerable HTTP client could expose credentials, weaken TLS/request handling, or leak sensitive data depending on the resolved version.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script's natural-language interface elements, including the module docstring, argument descriptions, and error output, are all presented only in Chinese. That can constitute a language policy violation when the skill does not offer any language or locale choice or document that it is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.