ClawHub
Back to skill

Security audit

Blog Topic Research

Security checks for vulnerabilities and agentic risk

Overview

This blog-research skill is mostly purpose-aligned, but it should be reviewed because it can automatically use environment-provided paid DataForSEO credentials via a raw curl call despite initially describing itself as content-only.

Install only if you are comfortable with the skill using web research tools and, when DATA_FOR_SEO_API_BASE64 is present, making paid DataForSEO API calls with that credential. Prefer running it without that environment variable unless you intentionally want enrichment, and rotate or scope the DataForSEO credential if it may have been exposed in command logs or process telemetry.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:226
Finding

DataForSEO Basic Credential Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 226–233
Vulnerability Type: Plaintext credential exposure in process arguments
Risk Level: Medium

Vulnerable Code

bash
curl -s -X POST "https://api.dataforseo.com/v3/dataforseo_labs/google/keyword_overview/live" \
  -H "Authorization: Basic $DATA_FOR_SEO_API_BASE64" -H "Content-Type: application/json" \
  -d '[{"keywords":["<kw1>","<kw2>","..."],"location_code":2840,"language_code":"en"}]'

The environment variable is explicitly defined as a reusable credential:

text
The env value is `base64(login:password)` and is used verbatim as the HTTP Basic credential.

Technical Analysis

The Skill instructs the agent to expand DATA_FOR_SEO_API_BASE64 directly inside a curl command-line argument. The expanded Authorization header may consequently be visible to local process-inspection facilities, execution telemetry, shell tracing, command audit systems, or wrappers that log argument vectors.

Base64 encoding provides no confidentiality: anyone who obtains the value can decode the underlying login:password pair or replay the Basic credential directly. The outbound request itself is necessary for the optional DataForSEO enrichment feature and targets the declared official API; the issue is the insecure credential-passing mechanism rather than unexplained network exfiltration.

Attack Path

  1. A user configures DATA_FOR_SEO_API_BASE64 with valid DataForSEO credentials.
  2. The Skill performs keyword enrichment and invokes the documented curl command.
  3. The shell expands the variable into the Authorization argument before starting curl.
  4. A local user, monitoring agent, command wrapper, audit service, or other process with sufficient process-inspection access captures the expanded argument while the request is running or from retained telemetry.
  5. The observer extracts or replays the Basic credential.
  6. The observer authenticates to DataForSEO as the victim ...[truncated 654 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not place the expanded Authorization header directly in command-line arguments.
  2. Prefer a maintained API client that reads the credential from a protected environment variable internally without exposing it through the process argument vector.
  3. If curl must be used, provide sensitive configuration through a permission-restricted temporary file or private standard-input mechanism, subject to platform support:
    • Create the file with owner-only permissions such as mode 0600.
    • Avoid predictable file names and symlink-following behavior.
    • Delete the file immediately after use, including on errors or interruption.
  4. Disable shell tracing around credential-bearing operations and ensure command wrappers, CI systems, and audit tooling redact Authorization headers and DATA_FOR_SEO_API_BASE64.
  5. Prefer scoped, revocable API tokens over reusable username/password credentials if DataForSEO supports them.
  6. Run the Skill under a dedicated low-privilege account and restrict access to process metadata and execution logs.
  7. Rotate the DataForSEO credential if the current command has already been used in an environment where arguments or commands are retained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md
Extract four fields:

1. **`problem_summary`** - 1-2 sentences in writer-voice describing the symptom + trigger. Factual, no marketing copy. Example: *"n8n's HTTP Request node returns 401 when an OAuth2 credential's access token has expired and the refresh-token grant is missing the `offline_access` scope."* Pull verbs and nouns from the body; don't paraphrase the title.

2. **`confirmed_fixes[]`** - list of `{kernel, source}` entries. Each kernel is one short phrase capturing the action (env var to set, version to downgrade to, setting toggle, code edit). The source URL is where the fix is reported (forum reply, vendor doc, GitHub commit, changelog entry). Walk the thread replies, accepted-answer block, vendor "common errors" page. **Skip noise**: ignore "have you tried restarting" or fixes contradicted by later replies. If the issue is genuinely still open with no working fix, leave `confirmed_fixes[]` empty - the writer will frame the post around "what's known so far" rather than fabricating a fix.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file claims the skill is 'content-only' and primarily uses WebFetch/WebSearch, but later instructs the agent to read environment credentials and issue a curl request to an external API. This mismatch can mislead users and reviewers about the real permissions and side effects, causing them to approve a skill with broader capabilities than disclosed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Referencing and operationalizing https://api.dataforseo.com/ confirms the skill is designed to communicate with an external service outside the agent's core browsing workflow. The danger is not the domain itself, but the undocumented expansion of data flow and billing surface area, especially when combined with environment-sourced credentials.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

The env value is base64(login:password) and is used verbatim as the HTTP Basic credential. Batch all candidate primary keywords into one keyword_overview call (it accepts up to 700 keywords per request, ~$0.01 total — far cheaper than per-keyword lookups):

bash
curl -s -X POST "https://api.dataforseo.com/v3/dataforseo_labs/google/keyword_overview/live" \
  -H "Authorization: Basic $DATA_FOR_SEO_API_BASE64" -H "Content-Type: application/json" \
  -d '[{"keywords":["<kw1>","<kw2>","..."],"location_code":2840,"language_code":"en"}]'

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Referencing and operationalizing https://api.dataforseo.com/ confirms the skill is designed to communicate with an external service outside the agent's core browsing workflow. The danger is not the domain itself, but the undocumented expansion of data flow and billing surface area, especially when combined with environment-sourced credentials.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

The env value is base64(login:password) and is used verbatim as the HTTP Basic credential. Batch all candidate primary keywords into one keyword_overview call (it accepts up to 700 keywords per request, ~$0.01 total — far cheaper than per-keyword lookups):

bash
curl -s -X POST "https://api.dataforseo.com/v3/dataforseo_labs/google/keyword_overview/live" \
  -H "Authorization: Basic $DATA_FOR_SEO_API_BASE64" -H "Content-Type: application/json" \
  -d '[{"keywords":["<kw1>","<kw2>","..."],"location_code":2840,"language_code":"en"}]'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example request sets "language_code":"en", which imposes an English-language locale choice in the skill's behavior. The document does not offer the user a language choice or explain that the skill is intentionally limited to English-only research contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The skill expands from passive content research into optional use of a paid third-party API and explicit credential-backed network access. That is not inherently malicious, but it does introduce external data transmission, billing risk, and secret-handling requirements that materially change the trust boundary of the skill.

Content

No source excerpt is available for this finding.