ClawHub
Back to skill

Security audit

AI Credit Share Platform Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI Credit Share API client, but it stores and prints sensitive credentials and can perform account or marketplace actions without enough safeguards.

Install only if you are comfortable with a CLI that can perform real AI Credit Share account and marketplace actions. Do not use the default password, avoid printing or sharing config output, restrict ~/.aicreditshare permissions manually, and require explicit confirmation before posting tasks, accepting deliverables, hiring/completing skills, cancelling work, or rotating API keys. Rotate any credentials already created with this version.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/init.sh:38
Finding

Predictable Hardcoded Default Account Password

Content
View full analysis

Vulnerability Details

File Location: scripts/init.sh, lines 38-45
Vulnerability Type: Predictable hardcoded credential
Risk Level: High

Vulnerable Code

bash
get_default_password() {
    if [ -n "$AICREDITSHARE_DEFAULT_PASSWORD" ]; then
        echo "$AICREDITSHARE_DEFAULT_PASSWORD"
    elif [ -f "${HOME}/.aicreditshare/default_password" ]; then
        cat "${HOME}/.aicreditshare/default_password"
    else
        echo "Test123456"  # default password
    fi
}

Technical Analysis

When neither the AICREDITSHARE_DEFAULT_PASSWORD environment variable nor a previously saved password file exists, the initialization script returns the fixed password Test123456. Both registration and login use this function when the caller does not provide a password.

A password embedded in publicly distributed source code provides no meaningful secrecy. Every installation that accepts the default shares the same predictable credential. The password is also structurally weak and can be tested without obtaining local access to the victim's system.

Attack Path

  1. A user runs the documented registration command without supplying a password.
  2. get_default_password selects Test123456.
  3. The script registers the account using the user's email address and this predictable password.
  4. An attacker identifies or obtains the registered email address through platform activity, messages, logs, or other sources.
  5. The attacker attempts to log in using the publicly known default password.
  6. If authentication succeeds, the attacker receives account credentials or a session token and can act as the affected Agent.

Impact Assessment

Successful exploitation can result in account takeover. Depending on platform-side authorization, the attacker may be able to inspect messages, transaction information, account configuration, tasks, skills, and balances. The attacker may also perform authenticat ...[truncated 265 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the hardcoded fallback password entirely.
  • Require users to provide a password explicitly during registration and login, preferably through a non-echoing prompt such as read -r -s.
  • Alternatively, generate a unique cryptographically secure password using a suitable system random source.
  • Enforce minimum password length and strength requirements.
  • Do not place passwords in command-line arguments because they may be exposed through shell history or process inspection.
  • Require password rotation for accounts that may have been created with the shipped default.
  • Add platform-side rate limiting, multi-factor authentication, and detection for attempts using known default credentials.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/init.sh:49
Finding

Plaintext Storage of Passwords, API Secrets, and Session Tokens Without Enforced File Permissions

Content
View full analysis

Vulnerability Details

File Locations: scripts/init.sh, lines 49-52, 89-100, 139-150, and 207-214
Vulnerability Type: Insecure local credential storage
Risk Level: High

Vulnerable Code

bash
save_default_password() {
    local password="$1"
    mkdir -p "${HOME}/.aicreditshare"
    echo -n "$password" > "${HOME}/.aicreditshare/default_password"
}
bash
mkdir -p ~/.aicreditshare
cat > ~/.aicreditshare/config.json << EOF
{
  "agent_id": "$agent_id",
  "api_key": "$agent_api_key",
  "api_secret": "$agent_api_secret",
  "email": "$email",
  "registered": true
}
EOF

save_default_password "$password"

The login path similarly stores the JWT token in config.json and saves the plaintext password:

bash
cat > ~/.aicreditshare/config.json << EOF
{
  "agent_id": "$agent_id",
  "api_key": "$api_key",
  "token": "$token",
  "email": "$email",
  "logged_in": true
}
EOF

save_default_password "$password"

Technical Analysis

The script persistently stores account passwords, API secrets, and JWT tokens as plaintext files under the user's home directory. It does not establish a restrictive umask, set directory permissions to 0700, or set credential-file permissions to 0600.

Consequently, the effective permissions depend on the invoking environment and the user's existing umask. On systems with permissive defaults, credential files may be readable by other local accounts or processes. Backups, diagnostic archives, home-directory synchronization, and accidental file sharing can also disclose these reusable secrets.

Retaining the account password is not necessary for normal HMAC-authenticated API operations after credentials have been issued. This exceeds the minimum sensitive-data retention needed for the declared functionality.

Attack Path

  1. A user registers or logs in through scripts/init.sh.
  2. The script writes the plaintex ...[truncated 1202 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not persist the account password after registration or login.
  • Store secrets in an operating-system credential manager or dedicated secret store instead of plaintext JSON.
  • Before creating any credential files, apply umask 077.
  • Create ~/.aicreditshare with mode 0700.
  • Create config.json and any unavoidable secret files with mode 0600.
  • Verify ownership and permissions before reading existing credential files; refuse to use files owned by another account or accessible to group and other users.
  • Store only credentials strictly required for subsequent operations.
  • Avoid including secret-bearing files in backups, synchronization systems, diagnostic bundles, or version control.
  • Rotate credentials that may already have been stored with unsafe permissions.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/init.sh:59
Finding

Passwords and API Credentials Exposed Through Terminal Output

Content
View full analysis

Vulnerability Details

File Locations: scripts/init.sh, lines 59-65, 78-85, 112-119, 160-168, and 194-203
Vulnerability Type: Sensitive information disclosure through output
Risk Level: High

Vulnerable Code

The registration path prints the account password:

bash
register_agent() {
    local name="$1"
    local email="$2"
    local password="${3:-$(get_default_password)}"

    echo -e "${YELLOW}正在注册新Agent...${NC}"
    echo -e "${YELLOW}使用密码: ${password}${NC}"

It subsequently prints the returned API secret:

bash
echo "================================"
echo -e "${GREEN}Agent ID: $agent_id${NC}"
echo -e "${GREEN}Agent API Key: $agent_api_key${NC}"
echo -e "${GREEN}Agent API Secret: $agent_api_secret${NC}"
echo "================================"

The configuration command outputs the complete secret-bearing configuration file:

bash
show_config() {
    if [ -f ~/.aicreditshare/config.json ]; then
        echo -e "${GREEN}当前配置:${NC}"
        cat ~/.aicreditshare/config.json | jq .

        if [ -f ~/.aicreditshare/default_password ]; then
            echo -e "\n${YELLOW}已保存默认密码${NC}"
        fi
    else
        echo -e "${RED}未找到配置文件，请先注册或登录${NC}"
    fi
}

Secret regeneration also prints the new API secret:

bash
echo "================================"
echo -e "${GREEN}New API Key: $new_api_key${NC}"
echo -e "${GREEN}New API Secret: $new_api_secret${NC}"
echo "================================"

Technical Analysis

Sensitive credentials are written directly to standard output. Terminal output is frequently retained in CI logs, Agent execution transcripts, shell recordings, remote-session logs, support captures, and observability systems. It may also be visible to nearby users or any process collecting command output.

The config command is particularly hazardous because it prints config.json without redacting the API se ...[truncated 1520 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove all output that prints plaintext passwords.
  • Never print complete API secrets, JWTs, or secret-bearing configuration files.
  • Redact credentials in status output, showing at most a short non-sensitive prefix or suffix.
  • Change the config command to display only non-sensitive fields such as Agent ID, email, and login state.
  • If a newly issued secret must be presented once, use an explicit secure credential-delivery workflow and clearly prevent collection by routine logs.
  • Route operational messages separately from sensitive values and ensure debug modes cannot expose authentication material.
  • Review and purge existing CI logs, Agent transcripts, and support artifacts that may contain credentials.
  • Rotate any password, API secret, or JWT that may already have been printed or retained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description presents a broad automation skill for many AI Credit Share Platform operations, but the supplied code only implements account/bootstrap functions: register, login, display local config, and regenerate API keys. There is no code for task posting, task acceptance, skill publishing, hiring, balance checking, or other marketplace operations. Additionally, the script persists credentials and a default password in ~/.aicreditshare, and supports API secret regeneration—behaviors not reflected in the declared description. While registration is covered by the description, the overall declared scope materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Regenerating an API secret is an irreversible remote account action that can immediately invalidate existing integrations and lock out other clients. Exposing this action without confirmation or safety checks makes accidental or automated triggering particularly dangerous in an agent skill context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises task posting as a normal workflow while mentioning a 10% deposit freeze only in a feature summary, not as an explicit transactional warning at the point of use. In a financial/task marketplace skill, this can cause users or downstream agents to trigger actions with monetary consequences they may not have fully understood.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README describes accepting a deliverable as part of normal usage and notes that it pays 95%, but does not present this as a high-visibility financial authorization warning. In this skill's context, an agent or user following documentation could approve a deliverable and release funds without appreciating that the action is effectively irreversible payment approval.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 145)May include surrounding context.

A: Install curl and jq first:

bash
# Ubuntu/Debian
sudo apt install curl jq

# macOS
brew install curl jq

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly says it will save and return newly issued API credentials, but it does not warn that these are highly sensitive secrets or describe how they will be stored and protected. In an agent environment, exposing or persistently storing fresh credentials can lead to account compromise if logs, chat history, memory, or downstream tools are accessible to others.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented API key reset regenerates credentials and invalidates the old key, which is a destructive security-sensitive action that can break existing automations or lock out dependent systems. Because the skill does not require an explicit confirmation step or warn about operational impact, a casual or ambiguous user request could trigger unintended credential rotation and service disruption.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description advertises broad autonomous capabilities like registering accounts, posting and accepting tasks, publishing and hiring skills, and checking balances without stating clear user-trigger boundaries or approval constraints. In an agent ecosystem, this can cause overbroad invocation or user misunderstanding, increasing the chance of unintended account actions, marketplace transactions, or financial operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Comments, status messages, and the full help output are written only in Chinese, with no option to select another language or indication that the tool is intentionally region-specific. This is a natural-language policy issue because it forces a locale on users without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script silently loads API credentials from a local config file and uses them to make authenticated remote requests without prominent disclosure at the point of action. In a skill context, this can lead users or calling agents to trigger financially or operationally meaningful account actions without understanding that stored secrets are being used.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/aics.sh (reported line 57)May include surrounding context.

sh
local signature=$(echo -n "$sign_string" | openssl dgst -sha256 -hmac "$API_SECRET" | cut -d' ' -f2)
    
    if [ "$method" = "GET" ]; then
        curl -s "https://www.aicreditshare.com${path}" \
            -H "X-Agent-Key: ${API_KEY}" \
            -H "X-Agent-Signature: ${signature}" \
            -H "X-Agent-Timestamp: ${timestamp}"

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script exposes authenticated actions beyond the stated skill description, including sending messages, updating profile/webhook settings, and regenerating API secrets. This increases the effective privilege and can surprise users into authorizing account-modifying operations they did not expect from the advertised functionality.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/init.sh (reported line 19)May include surrounding context.

sh
check_dependencies() {
    echo -e "${YELLOW}检查依赖...${NC}"
    
    if ! command -v curl &> /dev/null; then
        echo -e "${RED}错误: curl 未安装${NC}"
        exit 1
    fi

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script retrieves a default password from an environment variable or local file and falls back to a hardcoded password, then persists that password locally. For an initialization script, storing and reusing account passwords materially increases compromise risk, especially because the script also prints the password to the terminal where it may be captured in logs, shell history, or screenshots.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script stores the default password and later writes API credentials and tokens into files under ~/.aicreditshare without setting restrictive permissions or clearly warning about persistent sensitive storage before doing so. Local malware, backup systems, shared accounts, or permissive umask settings could expose these secrets and enable account takeover.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

The script persists agent ID, API key, and API secret in a local config file after registration. Storing long-lived credentials in plaintext creates a straightforward path to credential theft and unauthorized API use if the host, home directory, backups, or permissions are compromised.

Content

Scanner excerpt · scripts/init.sh (reported line 88)May include surrounding context.

sh
echo -e "${YELLOW}⚠️  请立即保存以上凭证，仅显示一次！${NC}"
        
        # 保存到配置文件
        mkdir -p ~/.aicreditshare
        cat > ~/.aicreditshare/config.json << EOF
{
  "agent_id": "$agent_id",

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This line performs a login request to an external service and transmits credentials, which is expected for functionality but still security-relevant. In this skill's context, the risk is elevated because the script also prints and stores secrets locally, so remote authentication combines with weak secret-handling practices to increase the chance of account compromise.

Content

Scanner excerpt · scripts/init.sh (reported line 119)May include surrounding context.

sh
echo -e "${YELLOW}使用密码: ${password}${NC}"
    
    # 使用jq构建JSON，避免注入
    local response=$(curl -s -X POST "https://www.aicreditshare.com/api/agent/login" \
        -H "Content-Type: application/json" \
        -d "$(jq -n \
            --arg email "$email" \

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The script persists session-related material, including a bearer token and API key, into ~/.aicreditshare/config.json after login. A stolen token or API key can enable unauthorized access or follow-on privileged actions such as secret rotation, making local session persistence particularly dangerous here.

Content

Scanner excerpt · scripts/init.sh (reported line 138)May include surrounding context.

sh
echo "================================"
        
        # 保存配置
        mkdir -p ~/.aicreditshare
        cat > ~/.aicreditshare/config.json << EOF
{
  "agent_id": "$agent_id",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script includes a secret-rotation function that performs a privileged account-management action using a stored bearer token. While not inherently malicious, it expands the script's power beyond simple setup/login and can disrupt service or invalidate existing integrations if run unexpectedly or by another local user with access to the config.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The inline/help documentation mixes 'profile' and 'configuration' terminology in a way that misstates intent: profile is documented as getting configuration information, while update-profile changes profile settings and webhook behavior. This is not just incomplete wording; it obscures that the command can modify account/profile settings rather than merely inspect configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

All prompts, help text, and status messages in the script are written in Chinese, which imposes a specific language on users. There is no opt-in, alternate locale support, or documentation indicating that the skill is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script sends registration credentials to a remote service over the network during setup, but it provides no explicit disclosure that user-supplied credentials and generated secrets will be transmitted and stored remotely. In the context of an agent skill, silent credential transmission to a third-party platform increases privacy and trust risk, especially for users who may assume only local initialization occurs.

Content

No source excerpt is available for this finding.