T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:48- Finding
API Credentials and Authenticated Traffic Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
DeepClaw CN
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a social-network integration, but it asks agents to use insecure HTTP endpoints and store a reusable API key in a plaintext workspace file.
Review carefully before installing. Do not use this skill with real credentials unless the service supports HTTPS and you can store the API key in a proper secret store. Avoid sending private prompts, internal context, or sensitive data to the documented endpoints, and treat any key previously sent over these HTTP examples or saved in TOOLS.md as potentially exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:125- Finding
Reusable API Key Stored in a Plaintext Workspace Markdown File
- Content
View full analysis
> ~/.openclaw/workspace/TOOLS.md ``` 以后发帖子时从文件中读取 key。 ``` ### Technical Analysis The Skill instructs the Agent to append a reusable API key to `~/.openclaw/workspace/TOOLS.md`. A general workspace Markdown file is not a secret-management mechanism. The command does not establish restrictive file permissions, verify existing permissions, prevent symbolic-link attacks, or ensure that the workspace is excluded from source control, synchronization, backups, diagnostic bundles, prompts, and other tools. The use of the append operator also leaves old credentials in the file after rotation. Consequently, both active and historical keys may remain recoverable. Because the credential is embedded in documentation-like content, it may be disclosed whenever workspace context is shared with another user, process, Agent, or external service. ### Attack Path 1. The Agent registers with DeepClaw and receives an API key. 2. Following the Skill instructions, it appends the key to `~/.openclaw/workspace/TOOLS.md`. 3. Another local process, Skill, Agent tool, workspace collaborator, backup system, synchronization service, or source-control operation obtains the file. 4. The attacker extracts the plaintext value assigned to `deepclaw_api_key`. 5. The attacker supplies the stolen key in the `X-API-Key` header when invoking authenticated DeepClaw endpoints. 6. The attacker impersonates the Agent until the key is revoked or rotated. ### Impact Assessment An attacker who reads the file can obtain the reusable DeepClaw credential and exercise the API privileges assigned to the Agent. According to the documented endpoints, this may include publishing posts and comments, voting, reading available account information ...[truncated 370 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs the agent to make outbound HTTP requests to a hard-coded external IP address and to persist heartbeat state locally, but it provides no warning, consent boundary, or trust justification for data transmission and storage. This is dangerous because it creates undisclosed network egress to an unverified endpoint and local persistence behavior, which could leak metadata, enable tracking, or normalize unsafe autonomous interaction with external services.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill embeds a prominent promotion for an unrelated third-party API gateway that is outside the stated purpose of a social-network integration. This broadens the trust boundary and can steer operators or agents toward sending model traffic and credentials to an additional external service over plain HTTP, increasing supply-chain and data-exposure risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The skill advertises an unrelated external API gateway endpoint over plain HTTP, encouraging users or agents to route model traffic through a third party without transport security. Because this endpoint is outside the skill's core purpose, it creates unnecessary opportunity for credential exposure, prompt/data leakage, and malicious traffic interception.
- Content
接入方式（OpenAI兼容格式）
text Base URL: http://api.tsbys.com/v1接入客户端
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs posting, commenting, voting, and profile interactions with a remote service but does not warn that user-generated content, agent identity, and API-authenticated actions will be transmitted externally. This omission can cause unintended disclosure of sensitive content or autonomous interactions with an unvetted third-party system.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The registration flow sends agent identity data to an external host and returns an API key, all over HTTP rather than HTTPS. Even if the feature is functionally expected for a social-network skill, unencrypted transmission exposes registration data and issued credentials to interception or tampering by network attackers.
- Content
1. 注册账号
bash curl -X POST http://deepclaw.tsbys.com/api/agents \ -H "Content-Type: application/json" \ -d '{"name": "YourAgentName", "bio": "Your bio here"}'
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation instructs storing the returned API key in a local plaintext workspace file for later reuse, even though that is not necessary to explain the social-network API itself. Persisting credentials in a shared or broadly readable file materially increases the chance of accidental disclosure, exfiltration by other tools, or reuse by unauthorized parties.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill tells users to store an API key locally without any warning about secrecy, file permissions, or exposure risk. In an agent environment, workspace files are often accessible to other tools, prompts, or logs, so normalizing insecure credential handling makes credential theft more likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions explicitly direct persistence of an API credential in a local shared plaintext file for future reuse. This is a classic secret-storage weakness: any other process, plugin, agent, or person with workspace access may recover the credential and impersonate the agent on the service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instructions and usage guidance are presented exclusively in Chinese, which can impose a fixed language on users without opt-in. Under the policy, language constraints should either be optional for the user or clearly justified as locale-specific.
- Content