ClawHub
Back to skill

Security audit

Bic Awr Analyze - 佰晟问诊

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly discloses that it uploads user-provided database AWR reports to BIC-QA's API for analysis, with no hidden execution or unrelated behavior found.

Install only if you are comfortable sending AWR reports to BIC-QA for remote analysis. Review or redact sensitive database, host, SQL, or workload details before upload, and store the API key only on machines you trust.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This line establishes that the skill’s core function is to send database performance reports to an external HTTPS endpoint for processing. Because the uploaded artifact may contain sensitive database metadata and performance details, the external transmission itself is a genuine security concern rather than a harmless reference.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
将数据库性能报告提交到 **BIC-Skills AWR 分析 API**（HTTPS），由服务端异步处理，分析结果通过邮件发送。

**Base URL（AWR）**：`https://api.bic-qa.com/skills/awr`

## Setup

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

Persisting credentials via a config file and suggesting environment variable use establishes ongoing session/credential availability beyond a single action. In agent contexts, durable secrets increase the blast radius if the host or process context is later compromised.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

方式 A — 配置文件（推荐）：

bash
mkdir -p ~/.bic/config
chmod 700 ~/.bic/config
echo "your_api_key_here" > ~/.bic/config/api_key
chmod 600 ~/.bic/config/api_key

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

Persisting credentials via a config file and suggesting environment variable use establishes ongoing session/credential availability beyond a single action. In agent contexts, durable secrets increase the blast radius if the host or process context is later compromised.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

方式 A — 配置文件(推荐):

bash
mkdir -p ~/.bic/config
chmod 700 ~/.bic/config
echo "your_api_key_here" > ~/.bic/config/api_key
chmod 600 ~/.bic/config/api_key

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
mkdir -p ~/.bic/config
chmod 700 ~/.bic/config
echo "your_api_key_here" > ~/.bic/config/api_key
chmod 600 ~/.bic/config/api_key

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

mkdir -p ~/.bic/config chmod 700 ~/.bic/config echo "your_api_key_here" > ~/.bic/config/api_key chmod 600 ~/.bic/config/api_key

text

**方式 B — 环境变量：**

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The API template documents sending report contents to a remote service, which is a real outbound data transfer channel. In the context of AWR analysis, this may expose sensitive database identifiers, workload characteristics, SQL text, or host information to an external processor.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
## API 调用模板

AWR 接口为 **HTTP POST**，发往 **`https://api.bic-qa.com/skills/awr`**。支持 **multipart 上传文件**（推荐）或 **JSON + 服务端可访问路径**。

### 方式一：multipart 上传文件（推荐）

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The curl example shows direct upload of a local report file together with a bearer credential to an external domain. That is a concrete exfiltration mechanism for potentially sensitive files, and the risk is heightened because the skill encourages routine use of the remote upload path.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

bash
# All requests go ONLY to the official BIC-QA API (api.bic-qa.com)
curl -s -X POST "https://api.bic-qa.com/skills/awr" \
  -H "Authorization: Bearer ${BIC_QA_KEY}" \
  -F "dbtype=oracle" \
  -F "lang=zh" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The curl example shows direct upload of a local report file together with a bearer credential to an external domain. That is a concrete exfiltration mechanism for potentially sensitive files, and the risk is heightened because the skill encourages routine use of the remote upload path.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

bash
# All requests go ONLY to the official BIC-QA API (api.bic-qa.com)
curl -s -X POST "https://api.bic-qa.com/skills/awr" \
  -H "Authorization: Bearer ${BIC_QA_KEY}" \
  -F "dbtype=oracle" \
  -F "lang=zh" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This example sends a server-accessible file path plus authorization to the remote API, indicating the service may retrieve or process local files referenced by path. Even if intended for same-host deployments, it still facilitates external handling of sensitive report data and could lead to over-sharing if users misunderstand the trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

适用于 运行 bic-skills 的环境能读取该路径 的场景（例如代理与文件在同一机器）。公开云 API 若无法访问本机路径，请优先用 方式一。

bash
curl -s -X POST "https://api.bic-qa.com/skills/awr" \
  -H "Authorization: Bearer ${BIC_QA_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"file":"/path/to/awr_report.html","dbtype":"oracle","lang":"zh"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The workflow formally instructs the agent to upload the report to a third-party API as part of normal operation. Since AWR content can reveal sensitive operational details, making external transmission the default workflow is a real security risk in enterprise environments.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md
## 工作流程建议

1. 确认用户意图为上传/分析 AWR（或兼容）报告，并确定 `dbtype` 与 `lang`。  
2. 使用已配置的 API Key，优先以 **multipart** 将文件提交至 `POST https://api.bic-qa.com/skills/awr`。  
3. 根据响应提示用户异步查收邮件，勿虚构即时完整报告内容。

## 相关资源

Static analysis

No suspicious patterns detected.