ClawHub
Back to skill

Security audit

Public APIs Skill Creator

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate purpose, but its generated API scripts can embed untrusted URLs into executable code and may send bearer tokens to unvalidated destinations.

Review generated skills and scripts before running them. Avoid using --try on catalog links you have not verified, do not set API_TOKEN for generated scripts unless you have confirmed the exact HTTPS host and endpoint, and treat generated examples as untrusted templates that may need escaping and endpoint validation first.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/create_skill.sh:85
Finding

Executable Code Injection Through Unescaped Generated Scripts

Content
View full analysis
"$TARGET/scripts/call.sh" < "$TARGET/scripts/python_example.sh" < "$TARGET/scripts/call.sh" < "$TARGET/scripts/python_example.sh" < len(r) else p print(r[p-1].get('link','')) PY ) if [[ -n "$BEST_LINK" ]]; then bash "$BASE_DIR/gen_usage.sh" --name "$BEST_NAME" --url "$BEST_LINK" --auth "$BEST_AUTH" fi ``` ### Technical Analysis `API_URL` is supplied through command-line input or selected from remotely downloaded `public-apis` catalog content. It is inserted directly into generated Bash and Python source code without context-appropriate escaping. Shell argument quoting during the invocation of `create_skill.sh` does not make the value safe after it is written into a new executable file. A URL containing quotation marks, newlines, comment syntax, or additional language statements can te ...[truncated 1239 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/create_skill.sh:102
Finding

Bearer Credential Disclosure to Unvalidated Destinations

Content
View full analysis
"$TARGET/scripts/call.sh" < "$TARGET/scripts/python_example.sh" <
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/solve_task.sh:98
Finding

Server-Side Request Forgery Through Optional URL Probe

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/solve_task.sh:103
Finding

Predictable Temporary File Enables Symlink Clobbering

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gen_usage.sh:22
Finding

Generated Usage Examples Permit Deferred Source-Code Injection

Content
View full analysis
" EOF fi echo echo "## Python" if [[ "$AUTH" == "No" ]]; then cat <"} r = requests.get("$URL", headers=headers, timeout=20) print(r.status_code) print(r.text[:500]) EOF fi echo echo "## JavaScript (fetch)" if [[ "$AUTH" == "No" ]]; then cat <" } }); const text = await res.text(); console.log(res.status, text.slice(0, 500)); EOF fi ``` ### Technical Analysis The generator places `URL` directly into Bash, Python, and JavaScript examples without escaping it for any of those language contexts. A crafted value containing quotes, newlines, comments, or statements can escape the intended string literal. `gen_usage.sh` prints rather than executes these snippets, so exploitation is deferred. However, the declared purpose is to produce minimum viable usage examples, and users or Agents are expected to copy or execute that output. The authenticated variants also encourage users to insert a bearer credential without validating the destination. ### Attack Path 1. An attacker controls or influences the URL selected from the remote catalog, or supplies a crafted `--url` argument. 2. `gen_usage.sh` emits the value inside one or more executable-language examples. 3. ...[truncated 647 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The English description indicates broader automation than what is concretely evidenced, creating a trust gap between declared and actual behavior. For agent-executed skills, such discrepancies are security-relevant because they undermine reviewability and can conceal side effects such as shell execution, network calls, or file generation beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The English description indicates broader automation than what is concretely evidenced, creating a trust gap between declared and actual behavior. For agent-executed skills, such discrepancies are security-relevant because they undermine reviewability and can conceal side effects such as shell execution, network calls, or file generation beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The English description indicates broader automation than what is concretely evidenced, creating a trust gap between declared and actual behavior. For agent-executed skills, such discrepancies are security-relevant because they undermine reviewability and can conceal side effects such as shell execution, network calls, or file generation beyond user expectations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises and invokes shell, network, file read, and file write capabilities but does not declare any explicit tool scope or permission boundaries. This creates an over-privileged execution model where an agent may run filesystem and network operations implicitly, increasing the chance of unintended data access, arbitrary file creation, or unsafe command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad everyday terms like '找接口/找API' and '公共API/免费API', which can cause the skill to activate in loosely related conversations. Unintended invocation is risky here because the skill can run shell commands, perform network access, and generate files, so accidental activation may lead to unnecessary external requests or workspace modifications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash
bash {baseDir}/scripts/gen_usage.sh \
  --name "Open-Meteo" \
  --url "https://api.open-meteo.com/v1/forecast?latitude=39.9&longitude=116.4&hourly=temperature_2m" \
  --auth "No"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/list_all_apis.sh (reported line 27)May include surrounding context.

sh
mkdir -p "$CACHE_DIR"

update_cache() {
  curl -s "https://api.github.com/repos/public-apis/public-apis/contents/README.md" | \
    python3 - "$CACHE_FILE" <<'PY'
import sys, json, base64, re
out = sys.argv[1]

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_api.sh (reported line 34)May include surrounding context.

sh
mkdir -p "$CACHE_DIR"

update_cache() {
  curl -s "https://api.github.com/repos/public-apis/public-apis/contents/README.md" | \
    python3 - "$CACHE_FILE" <<'PY'
import sys, json, base64, re
out = sys.argv[1]

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script emits user-facing status text in Chinese, such as the cache update message, without any indication that the language is configurable or optional. This is a natural-language locale policy concern because the skill imposes a specific language on all users rather than allowing opt-in or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Multiple result and error messages are hard-coded in Chinese, including cache completion, no-results, search summary, and field labels. Because the script does not offer users a language or locale choice, it violates the stated policy criterion against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This script creates directories and writes multiple files into the target skill path, which modifies the user's filesystem. Although the script's purpose is to scaffold a skill, there is no upfront warning, confirmation prompt, or explicit disclosure comment near the write operation about the files that will be created under the chosen output directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The script generates call.sh and python_example.sh files that perform HTTP requests to the provided API URL, and in the authenticated branch they transmit a bearer token from the environment. While network access is expected for an API skill, this generator does not include any warning in the generated SKILL.md about outbound requests or token transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The generated usage output includes the fixed heading "使用示例", which forces Chinese-language output regardless of user preference. This is a natural-language locale policy issue because the script does not offer a language choice or explain a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script includes user-facing comments and runtime output in Chinese, such as the usage description and printed status text, without offering a language choice or documenting that the skill is intentionally Chinese-only. That creates a natural-language locale policy concern under the rule requiring user opt-in or justified locale constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.