ClawHub
Back to skill

Security audit

Bazhuayu Webhook

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its webhook automation purpose, but its setup and migration helpers handle secrets unsafely and include a real local code-execution risk.

Review this before installing. Treat the webhook key like an account credential, avoid running setup-secure.sh with untrusted or copied webhook URLs, avoid storing real keys in .env.example, .env.migrated, shell history, screenshots, or Git, and delete or protect migration backups. Use test/dry-run first and only run live commands when you intend to trigger the configured RPA workflow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
setup-secure.sh:139
Finding

Arbitrary Python Code Execution Through Unsafe Configuration Interpolation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
setup-secure.sh:73
Finding

Webhook Signing Keys Are Entered Visibly, Printed, and Written to Plaintext Helper Files

Content
View full analysis
"$ENV_FILE" chmod 600 "$ENV_FILE" ``` Equivalent behavior exists in the Python initializer: ```python key = input("请输入签名密钥 (Key): ").strip() ``` ```python print(f'export BAZHUAYU_WEBHOOK_KEY="{key}"') for env_name, value in env_params.items(): print(f'export {env_name}="{value}"') ``` The migration script also prints and stores the extracted key: ```bash if [ -n "$CURRENT_KEY" ]; then ENV_CONFIG="$ENV_CONFIG export BAZHUAYU_WEBHOOK_KEY=\"$CURRENT_KEY\"" fi echo "$ENV_CONFIG" ENV_FILE="$SCRIPT_DIR/.env.migrated" echo "$ENV_CONFIG" > "$ENV_FILE" chmod 600 "$ENV_FILE" ``` ### Technical Analysis The signing key is treated as sensitive in the runtime, but the setup workflows undermine that protection in several ways: 1. `read -p` and Python `input()` echo the key while it is typed. 2. The complete key is printed to standard output. 3. The complete key is written to `.env.example` or `.env.migrated`. 4. Users are encouraged to place the key directly into shell startup files. 5. The audited artifact does not contain the `.gitignore` that documentation claims protects these generated files. Mode `600` reduces exposure to other local users but does not protect against: - Terminal recording and scrollback capture. - CI or support logs. - Screen sharing or screenshots. - User-level malware and processes. - Backups and synchroniza ...[truncated 1330 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
migrate-to-env.sh:16
Finding

Migration Leaves Additional Plaintext Copies of the Original Signing Key

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
MANUAL.md:453
Finding

Documentation Recommends Installing an Unused and Unpinned Third-Party Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (57)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · QUICKSTART.md (reported line 66)May include surrounding context.

配置完成后，请手动将 export 命令添加到 ~/.bashrc 或 ~/.zshrc。

📝 方式二：手动配置

步骤 1: 设置环境变量

bash
# 临时设置（当前终端会话）
export BAZHUAYU_WEBHOOK_KEY="你的签名密钥"
export BAZHUAYU_WEBHOOK_URL="https://api-rpa.bazhuayu.com/api/v1/bots/webhooks/xxx/invoke"

# 永久设置（添加到 ~/.bashrc 或 ~/.zshrc）
echo 'export BAZHUAYU_WEBHOOK_KEY="你的签名密钥"' >> ~/.bashrc
echo 'export BAZHUAYU_WEBHOOK_URL="https://api-rpa.bazhuayu.com/api/v1/bots/webhooks/xxx/invoke"' >> ~/.bashrc
source ~/.bashrc

步骤 2: 编辑配置文件

bash
vim config.json

填入配置（key 留空）：

json
{
  "url": "https://api-rpa.bazhuayu.com/api/v1/bots/webhooks/你的 ID/invoke",
  "key": "",
  "paramNames": ["keyword", "url"],
  "defaultParams": {
    "keyword": "默认关键词",
    "url": "https://example.com"
  }
}

步骤 3: 验证配置

bash
python3 bazhuayu-webhook.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 142)May include surrounding context.

md
--prune-empty --tag-name-filter cat -- --all

# 2. 推送更改
git push origin --force --all

# 3. 联系 GitHub/GitLab 支持清除缓存 (如已推送到远程)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The Chinese description frames the skill as a webhook-trigger utility, but the documented workflow includes interactive collection of secrets, creation of local config and .env-related files, permission modification, optional shell environment changes, and migration execution. Even if intended for convenience, these side effects materially expand the trust boundary and could expose or persist sensitive data on disk without users realizing the full scope.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The Chinese description frames the skill as a webhook-trigger utility, but the documented workflow includes interactive collection of secrets, creation of local config and .env-related files, permission modification, optional shell environment changes, and migration execution. Even if intended for convenience, these side effects materially expand the trust boundary and could expose or persist sensitive data on disk without users realizing the full scope.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

md
- **安全指南**: `SECURITY.md` - 安全最佳实践

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · WEBHOOK_SETUP_PREVIEW.html (reported line 115)May include surrounding context.

html
<p>本教程详细介绍如何在八爪鱼 RPA 中创建和配置 Webhook 触发器。</p>

        <!-- 步骤 1 -->
        <div class="step">
            <h2><span class="step-number">1</span>进入触发器管理</h2>
            <ol>

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
70% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · bazhuayu-webhook.py (reported line 103)May include surrounding context.

python
config['key'] = env_key
    
    # 3. 加载环境变量中的参数默认值 (BAZHUAYU_PARAM_*)
    for env_name, env_value in os.environ.items():
        if env_name.startswith('BAZHUAYU_PARAM_'):
            param_name = env_name.replace('BAZHUAYU_PARAM_', '')
            # 转换为驼峰或小写格式

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file is written entirely in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is an intentional, justified region-specific requirement. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · MANUAL.md (reported line 89)May include surrounding context.

bash
# 创建目录
mkdir -p ~/.openclaw/workspace/skills/bazhuayu-webhook
cd ~/.openclaw/workspace/skills/bazhuayu-webhook

# 下载主程序（需要主程序文件）

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manual instructs users to place the Webhook signing key directly in a local config.json file but does not warn about file permissions, secret leakage, or safer secret storage options. Because this key authorizes invocation of remote RPA jobs, exposure could let anyone with filesystem access or access to backups/repositories trigger automation on the user's account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The run examples show simple commands that trigger a remote Webhook-backed RPA task, but the manual does not clearly warn that these commands will execute automation in the user's external RPA environment. In an agent or copy-paste context, this can lead to unintended job execution, side effects on third-party sites, or use of paid/account-bound resources.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · MANUAL.md (reported line 378)May include surrounding context.

  1. 同步系统时间
    bash
    # Linux
sudo ntpdate pool.ntp.org

# 或使用 timedatectl
sudo timedatectl set-ntp true

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · MANUAL.md (reported line 381)May include surrounding context.

  1. 同步系统时间
    bash
    # Linux
sudo ntpdate pool.ntp.org

# 或使用 timedatectl
sudo timedatectl set-ntp true

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · MANUAL.md (reported line 424)May include surrounding context.

  1. 同步系统时间
    bash
    # Linux
sudo ntpdate pool.ntp.org

# 或使用 timedatectl
sudo timedatectl set-ntp true

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · MANUAL.md (reported line 442)May include surrounding context.

  1. 同步系统时间
    bash
    # Linux
sudo ntpdate pool.ntp.org

# 或使用 timedatectl
sudo timedatectl set-ntp true

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · MANUAL.md (reported line 448)May include surrounding context.

  1. 同步系统时间
    bash
    # Linux
sudo ntpdate pool.ntp.org

# 或使用 timedatectl
sudo timedatectl set-ntp true

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The quickstart tells users to run test commands but does not explicitly warn that doing so will send a real request to the configured external Webhook endpoint. In this skill’s context, that can unintentionally trigger a remote RPA job, causing side effects such as data collection, task execution, or unintended automation against external systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The final instruction to run the tool lacks any warning that execution will invoke the configured remote Webhook and trigger the associated RPA workflow. Because this is the final call-to-action in a setup guide, users are especially likely to execute it immediately without understanding that it performs an external action with potentially irreversible operational effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documentation is presented entirely in Chinese from the title onward, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains all user-facing security guidance in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. That creates a natural-language policy concern because it effectively forces a specific language for understanding safety-critical instructions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · MANUAL_SETUP.md (reported line 130)May include surrounding context.

bash
# 设置正确权限 (仅所有者可读写)
chmod 600 config.json

# 验证权限
ls -la config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · MANUAL_SETUP.md (reported line 150)May include surrounding context.

bash
# 设置正确权限 (仅所有者可读写)
chmod 600 config.json

# 验证权限
ls -la config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · RELEASE-2.0.2.md (reported line 56)May include surrounding context.

bash
# 设置正确权限 (仅所有者可读写)
chmod 600 config.json

# 验证权限
ls -la config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · RELEASE-2.0.2.md (reported line 61)May include surrounding context.

bash
# 设置正确权限 (仅所有者可读写)
chmod 600 config.json

# 验证权限
ls -la config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · RELEASE-2.0.2.md (reported line 105)May include surrounding context.

bash
# 设置正确权限 (仅所有者可读写)
chmod 600 config.json

# 验证权限
ls -la config.json