ClawHub
Back to skill

Security audit

宏观经济数据

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only macroeconomic data query helper for a fixed internal API, with some transport and scoping cautions but no evidence of deception, persistence, credential access, or destructive behavior.

Install only if you expect this skill to contact the internal service at 10.168.1.162:8000 and you trust that network/API. Avoid sending sensitive query parameters, and prefer an HTTPS/authenticated version with encoded parameters and explicit timeouts for production or financial decision workflows.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
macro_api.py:5
Finding

Plaintext HTTP Transport Permits API Response Interception and Tampering

Content
View full analysis

Vulnerability Details

File Location: macro_api.py:5, 82-89
Vulnerability Type: Plaintext network communication
Risk Level: Medium

Vulnerable Code

python
BASE_URL = "http://10.168.1.162:8000"
python
try:
    resp = requests.get(url)
    data = resp.json()
except Exception as e:
    print(f"Error fetching API: {e}")
    sys.exit(1)

print(json.dumps(data, indent=2, ensure_ascii=False))

Technical Analysis

The client communicates with the macroeconomic-data service over unencrypted HTTP. HTTP provides neither server authentication nor transport integrity. An attacker with a suitable network position could observe requests, impersonate the internal service, or alter responses before they reach the client.

The fixed RFC1918 destination reduces exposure compared with a public endpoint, but it does not make the connection trustworthy. Local-network compromise, malicious gateways, ARP spoofing, DNS-independent traffic redirection, or compromise of adjacent infrastructure could still permit interception. Because the response is parsed and printed without independent authenticity checks, modified financial data would be presented as if it came from the intended service.

Attack Path

  1. The attacker obtains a privileged network position between the client and 10.168.1.162, such as through a compromised local gateway or local-network traffic redirection.
  2. A user invokes the skill to query macroeconomic data.
  3. The script sends an unencrypted HTTP request to port 8000.
  4. The attacker intercepts the request or impersonates the service and returns attacker-selected JSON.
  5. The script parses and prints the manipulated response without detecting that its integrity or origin has been compromised.

Impact Assessment

An attacker could disclose requested endpoint names and query parameters and manipulate the returned macroeconomic or financial records. This can compromi ...[truncated 348 chars]

Remediation
View remediation

Remediation Suggestions

  • Serve the API over HTTPS and replace the base URL with an https:// endpoint.
  • Use a certificate issued by a trusted internal or public certificate authority and retain certificate verification.
  • If private PKI is required, configure the Requests client with the appropriate trusted CA bundle rather than disabling verification.
  • Consider certificate pinning or mutually authenticated TLS where the integrity of financial data is especially important.
  • Make the endpoint configurable through a controlled configuration mechanism while validating that only approved HTTPS origins are accepted.
  • Add a finite request timeout and call resp.raise_for_status() before processing the body.

T09 · Insecure Skill Coding Practices

Note
Location
macro_api.py:64
Finding

Unvalidated Path and Query Construction Can Alter Requests to the Internal API

Content
View full analysis

Vulnerability Details

File Location: macro_api.py:64-79, 100-112
Vulnerability Type: Improper input validation and unsafe URL construction
Risk Level: Low

Vulnerable Code

python
def call_api(endpoint, params=None):
    """Call API"""
    if endpoint not in ALLOWED_ENDPOINTS:
        print(f"Error: endpoint '{endpoint}' not allowed.")
        sys.exit(1)

    url = f"{BASE_URL}/db/Macroeconomics/table/{endpoint}"

    if params:
        if isinstance(params, dict):
            # Append JSON dictionary parameters to query
            for k, v in params.items():
                url += f"?{k}={v}" if "?" not in url else f"&{k}={v}"
        elif isinstance(params, int):
            # Use integer as limit
            url += f"/limit/{params}"
        elif isinstance(params, str):
            # Use string as date
            url += f"/date/{params}"
        else:
            print("Error: params must be dict, int, or date string (YYYY-MM-DD)")
            sys.exit(1)
python
if len(sys.argv) >= 3:
    arg = sys.argv[2]
    try:
        # Try JSON
        params = json.loads(arg)
    except:
        try:
            # Try integer
            params = int(arg)
        except:
            # Treat as date string
            params = arg

call_api(endpoint, params)

Technical Analysis

Dictionary keys and values are inserted directly into the query string without URL encoding, key allowlisting, or type validation. Consequently, reserved URL characters in a supplied value can introduce additional query parameters or fragments and change how the internal server interprets the request.

Likewise, any argument that is neither valid JSON nor an integer is treated as a date. The code does not verify the documented YYYY-MM-DD format before inserting the value directly into the URL path. Crafted separators, traversal-like segments, query delimiters, or ...[truncated 1818 chars]

Remediation
View remediation

Remediation Suggestions

  • Parse date arguments with strict date handling, such as datetime.date.fromisoformat, and reject values that do not exactly conform to the supported format.

  • Require limits to be positive integers and enforce a reasonable upper bound.

  • Define an explicit allowlist of supported query-parameter names and validate each value against its expected type and permitted range.

  • Pass query data through Requests' encoding support:

    python
    response = requests.get(url, params=validated_params, timeout=10)

  • Build path components only from validated typed values. Where dynamic path segments remain necessary, encode them safely and reject path separators, traversal components, query delimiters, and fragments.

  • Replace bare except: clauses with specific exceptions such as json.JSONDecodeError and ValueError.

  • Add response.raise_for_status() and handle malformed or unexpectedly large responses safely.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents and appears to require network access to a FastAPI service at a private IP address, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and policy-control gap: an agent or reviewer cannot reliably tell from the manifest that using the skill may initiate network communication, which can lead to unintended data egress or access to internal services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
76% confidence
Finding

The skill name, description, and most of the dataset mapping content are written in Chinese, while the file does not state that the skill is intentionally Chinese-only or provide an opt-in language choice. That can violate the language/locale policy when a specific language is imposed without user selection or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The markdown explicitly instructs use of a networked service via http://10.168.1.162:8000 but does not warn users that invoking the skill will contact a network endpoint. Even though the target is described as local/private, silent network access can surprise users, expose prompts or query contents to another service, and potentially interact with an internal system that has different trust assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The docstring and inline user-facing text/comments are written in Chinese, indicating a fixed language choice without any visible opt-in or locale selection mechanism. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This code issues an outbound HTTP request using a user-supplied endpoint and optional parameters, which may transmit user-provided data to an internal service. While the script has basic usage/error prints, it does not visibly warn the user that it will contact http://10.168.1.162:8000 or disclose the request target at execution time.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.