ClawHub
Back to skill

Security audit

hipc秘钥设置

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple HIPC API key checker/saver that behaves as described, but it stores the key in a plain local file.

Install only if you are comfortable with your HIPC API key being saved in plaintext at ~/hipc_config.json. Avoid using it on shared or synced machines unless you restrict file access, and rotate the key if that file may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs storing an API secret in a local file (`hipc_config.json`) for persistence, but provides no protections such as encryption, restrictive file permissions, secret-store usage, or warnings about credential exposure. If the host is multi-user, the working directory is accessible, logs/backups capture the file, or other skills/processes can read local files, the credential can be stolen and abused to access HIPC resources.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code persists `hipc_secret` in plaintext to a JSON file in the user's home directory without warning the user, encryption, or any permission hardening. If the host is multi-user, compromised, or backed up/synced insecurely, the secret may be exposed and reused to access the associated HIPC service.

Static analysis

No suspicious patterns detected.