ClawHub
Back to skill

Security audit

Retarus SMS4A

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Retarus SMS helper that uses account credentials to send and check SMS through fixed Retarus API endpoints, with a credential-handling caution but no evidence of hidden or malicious behavior.

Install only if you intend this agent to send SMS and read SMS delivery reports through your Retarus account. Prefer environment injection or a protected secret file, avoid passing passwords on the command line, use dry-run before sending, and make sure account permissions and billing limits match the users who can invoke the skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/sms4a_api.py:63
Finding

Credentials May Be Exposed Through Command-Line Password Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/sms4a_api.py, lines 63–65
Vulnerability Type: Credential exposure through command-line arguments
Risk Level: Medium

python
parser.add_argument("--username", help="SMS4A username")
parser.add_argument("--password", help="SMS4A password")

Technical Analysis

The helper accepts the SMS4A password directly through the --password command-line option. Command-line arguments are not an appropriate secret transport mechanism because they may be exposed through:

  • Shell history files
  • Process inspection tools and operating-system process interfaces
  • Terminal session recording
  • Agent execution logs or telemetry
  • Job schedulers and automation logs
  • Diagnostic output that records invoked commands

The password is subsequently used to construct the HTTP Basic Authentication header. Base64 encoding at scripts/sms4a_api.py:322–323 is required by Basic Authentication and is not encryption:

python
def build_auth_header(username: str, password: str) -> str:
    token = base64.b64encode(f"{username}:{password}".encode("utf-8")).decode("ascii")
    return f"Basic {token}"

The audit found that this header is sent only over HTTPS to fixed Retarus endpoints and is not written to standard output. Therefore, the Base64 operation is not a covert exfiltration channel. The vulnerability is specifically the optional command-line credential input.

Attack Path

  1. An operator or Agent invokes the helper with --password <secret>.
  2. The complete command is retained in shell history, execution telemetry, a process listing, or an automation log.
  3. A local user, monitoring process, log reader, or other party with access to that data obtains the plaintext password.
  4. The attacker combines the password with the corresponding username and authenticates to the Retarus SMS4A service.
  5. Subject to the compromised account's server-side perm ...[truncated 984 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --password command-line option from normal operation.
  2. Continue supporting secret-store-backed environment injection and permission-restricted secret files.
  3. If interactive use is required, obtain the password with Python's getpass.getpass() so it is not echoed or included in process arguments.
  4. Require secret files to be regular files owned by the expected user and reject files with overly permissive modes where supported.
  5. Avoid including credential values in logs, exceptions, dry-run output, or telemetry.
  6. If backward compatibility requires retaining --password, mark it as unsafe, emit a prominent warning, and prohibit its use in Agent-managed or logged environments.
  7. Update SKILL.md to recommend only environment injection, an approved secret store, or a protected secret file rather than presenting command-line passwords as a supported testing method.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'req' from os.getenv (line 300, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/sms4a_api.py (reported line 303)May include surrounding context.

python
req = request.Request(url=url, method=method, headers=headers, data=body)

    try:
        with request.urlopen(req, timeout=timeout) as response:
            raw_body = response.read().decode("utf-8", errors="replace")
            return response.status, decode_body(raw_body)
    except error.HTTPError as exc:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises capabilities that involve reading environment variables, local secret files, and making network requests, but it does not declare any explicit tool scope such as allowed tools or permissions. This weakens policy enforcement and reviewability, making it easier for an agent to access secrets and exfiltrate data over the network without clear, least-privilege constraints.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: retarus-sms4a
description: Send SMS jobs and check SMS delivery status through the Retarus SMS for Applications REST API. Use when Codex or OpenClaw needs to create SMS jobs, inspect per-recipient delivery results for a Retarus job ID, work from the SMS4A OpenAPI schema, or route requests across the `eu`, `de1`, and `de2` datacenters with the required `eu` status fallback to both German datacenters.
---

# Retarus SMS4A

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents authentication via HTTP Basic Auth and multiple ways to source usernames, passwords, and local secret files, but it does not include any warning about exposing credentials in shell history, process arguments, or local files. Because markdown files should warn about behaviors affecting privacy or sensitive data, the omission is a relevant disclosure gap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.