ClawHub
Back to skill

Security audit

AllToken — Slash Commands

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AllToken API helper, but it needs review because it can make paid external requests from loose trigger phrases and tells the agent to run scripts from predictable shared temporary paths.

Install only if you are comfortable with user prompts, search queries, and generation requests being sent to AllToken using your API key. Prefer explicit slash commands, confirm before any inferred natural-language trigger, and avoid running the provided recipes from fixed /tmp paths; use a private temporary directory or managed script runner instead.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:73
Finding

Predictable Shared Temporary Script Paths Enable Local File Replacement or Symlink Attacks

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73, 137, 194, 247, 295, and 327
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code Snippets

markdown
**Recipe** — save as `/tmp/at_chat.py`, run with `python3 /tmp/at_chat.py <model> <prompt...>`:
markdown
**Recipe** — save as `/tmp/at_image.py`:
markdown
**Recipe** — save as `/tmp/at_video.py`:
markdown
**Recipe** — save as `/tmp/at_search.py`:
markdown
**Recipe** — save as `/tmp/at_models.py`:
markdown
**Recipe** — save as `/tmp/at_cost.py`:

Technical Analysis

The Skill instructs the host agent to write executable Python programs to predictable filenames in the globally shared /tmp directory and then execute them. Fixed temporary paths are vulnerable to symlink attacks and time-of-check/time-of-use file replacement on systems where another user or compromised process can modify /tmp.

An attacker can pre-create a documented path as a symbolic link, potentially causing the agent's write operation to overwrite another file accessible to the agent. Alternatively, an attacker can replace the temporary script after it is written but before Python opens it, causing attacker-controlled code to execute with the agent process's permissions.

Exploitability depends on the host's file-creation semantics, /tmp protections, local attacker access, and the privileges under which the agent operates. The flaw is most relevant on multi-user systems or hosts where another process is already compromised.

Attack Path

  1. A local attacker identifies a predictable filename such as /tmp/at_chat.py.
  2. Before the agent creates the recipe, the attacker places a symbolic link at that path targeting a file writable by the agent. Alternatively, the attacker waits for script creation and races to replace it before execution.
  3. The agent follows ...[truncated 1288 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not use fixed filenames directly under shared /tmp.
  • Create a private temporary directory with Python's tempfile.TemporaryDirectory() and restrictive owner-only permissions.
  • Create scripts using tempfile.NamedTemporaryFile() or an equivalent atomic, exclusive-create operation.
  • Avoid closing and reopening temporary scripts by pathname where practical. Retain a trusted file descriptor or verify the file's identity before execution.
  • Reject symbolic links and confirm that the resulting file is a regular file owned by the expected user.
  • Set permissions to owner-only access, such as mode 0700 for the private directory and 0600 for script files.
  • Execute the verified script from the private directory and remove the directory immediately afterward.
  • Where supported by the host agent, execute the recipe from an in-memory or securely managed script channel instead of writing executable content to a shared temporary filesystem.
  • Run the agent under a dedicated, minimally privileged account so exploitation cannot access unrelated files or credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Allowing trigger matches anywhere in a user's message creates overly broad activation, so ordinary discussion, quoted text, or attacker-crafted content can cause unintended execution of networked commands. In this skill, unintended activation can send prompts and API-backed requests to an external service using the user's API key, creating data leakage and unexpected spend risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Ambiguous natural-language trigger phrases like 'generate an image via alltoken' or 'how much did that cost' can be matched in contexts where the user is not actually requesting execution. This increases the chance of prompt/command confusion that leads the agent to transmit user content externally or consume paid API quota without clear intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

md
"stream": True,
    "stream_options": {"include_usage": True},
}).encode()
req = urllib.request.Request("https://api.alltoken.ai/v1/chat/completions",
    data=body, method="POST",
    headers={"Authorization": f"Bearer {os.environ['ALLTOKEN_API_KEY']}", "Content-Type":"application/json"})
try:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The /alltoken-cost presentation guidance says that for streaming chat, the agent should prefer the exact figure from an after-[DONE] SSE comment line. However, the /alltoken-chat recipe at L102-L115 explicitly skips SSE comment lines with line.startswith(":") and only extracts text deltas and usage tokens, so the documented authoritative cost source is not actually available from this skill's code path.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.

md
If the user wants to *build* something instead of one-shot calls, hand off to `alltoken`:

> "If you want me to scaffold a whole agent project around this, load `skills/alltoken/SKILL.md`."

## Resources

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
61% confidence
Finding

The instruction mandates a single recognition behavior for all users and does not mention any user-configurable language or locale preferences. While not a severe issue, it hard-codes natural-language handling behavior rather than offering opt-in or context-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.