ClawHub
Back to skill

Security audit

Discogs Claw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Discogs price lookup, but users should treat the Discogs token as sensitive because the script passes it to curl headers.

Install only if you are comfortable sending record search queries to Discogs with your Discogs personal access token. Use a token with the minimum permissions available, avoid running it on shared machines where other users can inspect process arguments, and rotate the token if it may have been exposed. The publisher should improve the examples to use safer secret handling and fix the error JSON escaping.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/discogs.sh:31
Finding

Discogs API Token Exposed Through Process Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/discogs.sh:31-52
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

bash
SEARCH_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$SEARCH_URL")

PRICE_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$PRICE_URL")

STATS_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$STATS_URL")

Technical Analysis

The script expands DISCOGS_TOKEN directly into the command-line arguments supplied to curl. While the authenticated requests are necessary for the declared Discogs lookup functionality, placing the token in the process argument vector is not necessary.

Depending on the operating system's process-isolation configuration, command-line arguments may be observable through process inspection interfaces, monitoring agents, audit logs, debugging wrappers, or process-accounting systems. The token is exposed for the lifetime of each of the three curl processes. Systems that restrict process visibility reduce the practical risk, but the implementation should not rely on that environmental protection.

The static pre-scan also identified credential paths documented in SKILL.md:20. The executable script does not read those paths and only consumes DISCOGS_TOKEN from its environment, so no unauthorized credential-file access was confirmed. The documented file-based setup option is inconsistent with the implementation but does not itself create credential access beyond the Skill's requirements.

Attack Path

  1. A victim invokes the Skill with a valid DISCOGS_TOKEN.
  2. The script launches an authenticated curl request.
  3. Shell expansion places the complete authorization header, including the token, in the curl process argument v ...[truncated 800 chars]
Remediation
View remediation

Remediation Suggestions

Avoid placing authentication material directly in curl command-line arguments.

  • Provide the authorization header through a protected input mechanism, such as a temporary curl configuration or header file created with mode 0600.
  • Create temporary files only in a trusted directory using mktemp, set a restrictive umask, and register a trap that removes them on normal exit and interruption.
  • Launch curl with DISCOGS_TOKEN removed from its inherited environment after preparing the protected authentication input.
  • Prefer a credential helper or API client capable of keeping credentials out of both the process argument vector and inherited environment.
  • Rotate any token suspected of having been exposed.
  • Run the Skill under an account and execution environment that restrict process inspection and command telemetry.

A hardened implementation should also retain HTTPS certificate verification and ensure that authentication is sent only to the fixed https://api.discogs.com origin.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/discogs.sh:42
Finding

Attacker-Controlled Query Is Interpolated into JSON Without Escaping

Content
View full analysis

Vulnerability Details

File Location: scripts/discogs.sh:42
Vulnerability Type: Improper output encoding and JSON injection
Risk Level: Low

Vulnerable Code

bash
echo "{\"error\": \"No vinyl release found for query: '$QUERY'. Please try a more specific search term.\"}"

Technical Analysis

QUERY originates from untrusted JSON input:

bash
QUERY=$(echo "$INPUT_JSON" | jq -r '.query // empty')

Although jq safely parses the original input, the extracted string is later inserted directly into a manually constructed JSON document. Characters such as double quotes, backslashes, and control characters are not escaped for the JSON context.

A crafted query can therefore make the output syntactically invalid or terminate the intended error string and introduce attacker-controlled JSON properties. This branch is reached when the Discogs search response contains no release identifier. The issue affects output integrity rather than shell execution: the variable remains inside a quoted shell expansion, so the identified code does not by itself provide command injection.

Attack Path

  1. An attacker supplies a valid input object whose query contains JSON-significant characters or a crafted fragment.
  2. The script parses the value with jq and stores the decoded content in QUERY.
  3. The Discogs search returns no matching release, causing execution to enter the error branch.
  4. The script inserts the unescaped query into a manually quoted JSON string.
  5. The caller receives malformed JSON or an object whose structure contains attacker-controlled content.
  6. A downstream agent or application may fail parsing, misinterpret injected fields, or propagate manipulated output.

Impact Assessment

Exploitation can compromise the integrity and availability of the Skill's output. It may cause downstream JSON parsing failures, workflow disruption, misleading error data, or injection of a ...[truncated 321 chars]

Remediation
View remediation

Remediation Suggestions

Construct every JSON response with jq rather than manual string interpolation:

bash
jq -n --arg query "$QUERY" \
  '{error: ("No vinyl release found for query: " + $query + ". Please try a more specific search term.")}'

Additional hardening should include:

  • Rejecting non-string query values explicitly.
  • Applying a reasonable maximum query length.
  • Checking jq and curl exit statuses before processing their output.
  • Returning a consistent machine-readable error schema.
  • Using jq -e to validate generated output during testing.
  • Adding regression tests containing quotes, backslashes, Unicode, newlines, and attempted JSON-property injection.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill's declared purpose understates its actual behavior by omitting authenticated API use and additional marketplace data retrieval, creating a transparency and consent problem for both users and policy systems. When a skill uses a credentialed external request without clearly declaring that behavior, it can bypass review expectations and expose tokens or user queries to third-party services under a narrower-looking description.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The file explicitly instructs use of a personal access token for authentication but does not pair that guidance with safe secret-handling practices. In documentation aimed at end users, this can facilitate credential misuse or leakage even if the token is only intended for a legitimate API call.

Content

Scanner excerpt · references/api.md (reported line 7)May include surrounding context.

md
## Authentication

All requests must be authenticated using a Discogs Personal Access Token.

- **Header**: `Authorization: Discogs token={YOUR_TOKEN}`
- **User-Agent**: A unique User-Agent string is required (e.g., `OpenclawSkill/1.0`).

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises shell-based behavior but does not declare any explicit tool scope or permissions, which weakens policy enforcement and makes it harder for an agent runtime to constrain what the skill may execute. In practice this can lead to over-broad execution capability being granted to a skill that reaches out to external services and processes user input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation instructs users to authenticate with a personal access token and shows it in request headers, but it does not explicitly warn that the token is sensitive, must not be committed, logged, or shared, and should be stored securely. In a skill context where users may copy-paste curl examples, this omission increases the chance of accidental credential exposure through shell history, screenshots, repositories, or logs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The example curl command demonstrates transmitting an authorization token to an external service but provides no surrounding warning about protecting that secret. In practice, users often copy examples verbatim, and placing secrets in shell commands can expose them via terminal history, process inspection, screenshots, or shared snippets.

Content

Scanner excerpt · references/api.md (reported line 32)May include surrounding context.

Example Request

bash
curl "https://api.discogs.com/database/search?q=Daft+Punk&type=release&format=Vinyl" \
  -H "User-Agent: OpenclawSkill/1.0" \
  -H "Authorization: Discogs token=YOUR_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The sample request sends an authorization token to Discogs and again omits guidance on secure token handling. Because this is executable example content, it can encourage unsafe operational practices such as embedding secrets directly in commands or exposing them through logs/history.

Content

Scanner excerpt · references/api.md (reported line 63)May include surrounding context.

Example Request

bash
curl "https://api.discogs.com/marketplace/price_suggestions/4570366" \
  -H "User-Agent: OpenclawSkill/1.0" \
  -H "Authorization: Discogs token=YOUR_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This executable curl example includes an authorization header for an external request without any warning about secret handling. As with the other examples, the main risk is accidental disclosure of the token through copy-paste usage patterns, shell history, logs, or shared terminal output.

Content

Scanner excerpt · references/api.md (reported line 97)May include surrounding context.

Example Request

bash
curl "https://api.discogs.com/releases/4570366/stats" \
  -H "User-Agent: OpenclawSkill/1.0" \
  -H "Authorization: Discogs token=YOUR_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 22)May include surrounding context.

md
# Step 1: Search for the release
# We search specifically for Vinyl format releases
SEARCH_URL="https://api.discogs.com/database/search?q=${ENCODED_QUERY}&type=release&format=Vinyl"

# Perform search with User-Agent and Authorization headers
SEARCH_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$SEARCH_URL")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 47)May include surrounding context.

md
# Step 1: Search for the release
# We search specifically for Vinyl format releases
SEARCH_URL="https://api.discogs.com/database/search?q=${ENCODED_QUERY}&type=release&format=Vinyl"

# Perform search with User-Agent and Authorization headers
SEARCH_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$SEARCH_URL")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 57)May include surrounding context.

md
# Step 1: Search for the release
# We search specifically for Vinyl format releases
SEARCH_URL="https://api.discogs.com/database/search?q=${ENCODED_QUERY}&type=release&format=Vinyl"

# Perform search with User-Agent and Authorization headers
SEARCH_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$SEARCH_URL")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 91)May include surrounding context.

md
# Step 1: Search for the release
# We search specifically for Vinyl format releases
SEARCH_URL="https://api.discogs.com/database/search?q=${ENCODED_QUERY}&type=release&format=Vinyl"

# Perform search with User-Agent and Authorization headers
SEARCH_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$SEARCH_URL")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/discogs.sh (reported line 28)May include surrounding context.

sh
# Step 1: Search for the release
# We search specifically for Vinyl format releases
SEARCH_URL="https://api.discogs.com/database/search?q=${ENCODED_QUERY}&type=release&format=Vinyl"

# Perform search with User-Agent and Authorization headers
SEARCH_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$SEARCH_URL")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/discogs.sh (reported line 45)May include surrounding context.

sh
# Step 1: Search for the release
# We search specifically for Vinyl format releases
SEARCH_URL="https://api.discogs.com/database/search?q=${ENCODED_QUERY}&type=release&format=Vinyl"

# Perform search with User-Agent and Authorization headers
SEARCH_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$SEARCH_URL")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/discogs.sh (reported line 50)May include surrounding context.

sh
# Step 1: Search for the release
# We search specifically for Vinyl format releases
SEARCH_URL="https://api.discogs.com/database/search?q=${ENCODED_QUERY}&type=release&format=Vinyl"

# Perform search with User-Agent and Authorization headers
SEARCH_RESULT=$(curl -s -H "User-Agent: OpenclawSkill/1.0" -H "Authorization: Discogs token=${DISCOGS_TOKEN}" "$SEARCH_URL")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This shell script sends the user-supplied query to the Discogs API and includes the DISCOGS_TOKEN in an Authorization header, but there is no user-facing notice beyond inline code comments. For code files, comments alone do not satisfy the warning requirement when network calls transmit user or system data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script performs further authenticated HTTP requests to Discogs price and stats endpoints using the same token, again without any visible runtime disclosure to the user. These requests continue transmitting data externally, and the file provides no print/log message or prompt informing the user of that behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The setup instructions tell users how to provide a Discogs token but do not warn that both the token and the search query are sent to Discogs, which reduces informed consent and increases the risk of accidental data disclosure. While this is common for API-backed skills, failing to say so is still a security and privacy weakness, especially if users may input sensitive queries.

Content

No source excerpt is available for this finding.