ClawHub
Back to skill

Security audit

BizyAir 文件上传

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: uploads user-selected files to BizyAir and can list BizyAir resources, but users should avoid exposing API keys in chat or command-line arguments.

Install only if you intend to send selected files to BizyAir/OSS and make the resulting URLs usable outside your machine. Use a narrowly scoped BizyAir API key, prefer BIZYAIR_API_KEY or a secret manager, avoid pasting keys into chat or passing them with --api-key, and consider pinning dependencies in a virtual environment before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:12
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: README.md:12
Vulnerability Type: Unpinned package installation
Risk Level: Medium

Vulnerable Code

bash
pip install requests alibabacloud-oss-v2

Technical Analysis

The documented installation command retrieves the latest available versions of requests and alibabacloud-oss-v2 without version constraints or integrity hashes. Consequently, installations are not reproducible, and package code may change after this Skill has been reviewed.

Both packages execute under the privileges of the user running the Skill. If a future release or its transitive dependency is compromised, malicious code could execute during installation or when imported by scripts/upload.py. No evidence indicates that the currently named packages are malicious; the vulnerability is the absence of dependency pinning and integrity verification.

Attack Path

  1. An attacker compromises the distribution account, release process, or transitive dependency of one of the required packages.
  2. The attacker publishes a malicious package version to the configured Python package index.
  3. A user follows the documented unpinned installation command.
  4. pip downloads the malicious version because no approved version or hash is enforced.
  5. Malicious package code executes during installation or when scripts/upload.py imports the package.

Impact Assessment

A compromised dependency could execute arbitrary code with the privileges of the user installing or running the Skill. This could expose the BizyAir API key, selected upload files, accessible local files, environment variables, and other credentials available to that user. It could also alter uploaded content or redirect network traffic.

The issue does not independently grant elevated operating-system privileges; its scope is limited to the permissions and data available to the affected process and user account.

Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed dependency lock file containing exact versions for all direct and transitive dependencies.

  2. Require package hashes, for example:

    bash
    python -m pip install --require-hashes -r requirements.txt

  3. Generate hashes only from packages obtained through a trusted index and reviewed release process.

  4. Configure CI to scan locked dependencies for known vulnerabilities and unexpected package changes.

  5. Update dependencies through an explicit review process rather than automatically installing the newest release.

  6. Document the supported Python version and use an isolated virtual environment.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upload.py:290
Finding

BizyAir API Key Can Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Locations: scripts/upload.py:290-296; README.md:42-43
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

python
parser.add_argument("--api-key", help="BizyAir API Key（默认从环境变量 BIZYAIR_API_KEY 读取）")
parser.add_argument("--list", action="store_true", help="查询已上传的资源列表")
parser.add_argument("--page", type=int, default=1, help="列表页码（默认 1）")
parser.add_argument("--page-size", type=int, default=20, help="每页数量（默认 20）")

args = parser.parse_args()

api_key = args.api_key or get_api_key()

The corresponding documented usage is:

bash
# 使用指定 API Key
python3 scripts/upload.py /path/to/file.png --api-key "your_key"

Technical Analysis

Accepting a secret through --api-key places the credential in the process argument vector. Depending on operating-system access controls, process arguments may be visible to other local users, monitoring agents, diagnostic tooling, audit systems, process supervisors, or container orchestration metadata.

The documented command can also persist the key in interactive shell history. The environment-variable fallback is preferable to command-line arguments, but retaining and documenting the CLI option preserves the unsafe exposure path.

The script does not print the key itself, and the network requests send it only as a Bearer credential to the declared HTTPS BizyAir API. The identified weakness is therefore local credential handling rather than hidden network exfiltration.

Attack Path

  1. A user follows the documented example and supplies a real BizyAir API key using --api-key.
  2. The complete command is stored in shell history or exposed in the process argument list while the upload is running.
  3. A local user, monitoring service, support bundle, or compromised process with access to that information captures the key.
  4. The attacker reuse ...[truncated 760 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key command-line option and its documentation.

  2. Continue supporting BIZYAIR_API_KEY for non-interactive use, while documenting the exposure considerations of inherited process environments.

  3. For interactive use, read the credential without echoing it:

    python
    from getpass import getpass

api_key = os.environ.get("BIZYAIR_API_KEY") or getpass("BizyAir API key: ")

  4. For persistent use, integrate with an operating-system credential store or secrets manager and restrict access to the stored secret.

  5. Ensure logs, exceptions, telemetry, and support bundles redact authorization headers and API-key values.

  6. Recommend narrowly scoped, revocable API keys and document immediate rotation if a key has previously been supplied on the command line.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Tainted flow: 'headers' from os.environ.get (line 213, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload.py (reported line 67)May include surrounding context.

python
print(f"📋 步骤一：获取上传凭证...")

    response = requests.get(UPLOAD_TOKEN_URL, headers=headers, params=params)

    if response.status_code != 200:
        print(f"❌ 获取上传凭证失败: HTTP {response.status_code}")

Tainted flow: 'headers' from os.environ.get (line 213, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload.py (reported line 177)May include surrounding context.

python
"object_key": object_key
    }

    response = requests.post(COMMIT_RESOURCE_URL, headers=headers, json=data)

    if response.status_code != 200:
        print(f"❌ 提交资源失败: HTTP {response.status_code}")

Tainted flow: 'headers' from os.environ.get (line 213, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload.py (reported line 221)May include surrounding context.

python
"page_size": page_size
    }

    response = requests.get(LIST_RESOURCES_URL, headers=headers, params=params)

    if response.status_code != 200:
        print(f"❌ 查询列表失败: HTTP {response.status_code}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README describes uploading local files to BizyAir but does not clearly warn users that selected files are transmitted to an external third-party service. This can lead to accidental disclosure of sensitive local content because users may invoke the skill without understanding the privacy and data-transfer implications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill performs sensitive actions involving environment variables and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This increases the chance that an agent may invoke broader capabilities than users expect, especially in a file-upload skill that accesses local files, reads API keys, and transmits data to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says it uploads local files and returns accessible URLs, but it does not prominently warn that files are sent to external BizyAir/OSS infrastructure and may be accessible outside the local environment. In this context, users could unknowingly disclose sensitive images, audio, video, or metadata by treating the action as a local transformation rather than external publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users that they can provide the API key in conversation, but it does not warn that conversational channels may be logged, retained, or exposed to other tools and operators. Encouraging users to paste credentials into chat materially increases the risk of secret leakage and subsequent unauthorized access to the BizyAir account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JSON eval file contains natural-language prompts and expected outputs exclusively in Chinese, implying the skill is expected to operate in that language by default. Under the policy, forcing a specific language without user choice or a documented region-specific justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes this skill as a BizyAir file upload helper used to upload local resources and obtain accessible URLs. However, this eval explicitly tests listing the user's existing BizyAir input resources, which is a broader remote resource management/query capability not described in the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The second eval case specifies both the user prompt and the expected output in Chinese, reinforcing a mandatory locale expectation. There is no indication in this file that users may choose another language or that the locale restriction is justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This eval expects error guidance in Chinese when API credentials are missing. Because the file provides no opt-in or locale-scope explanation, it appears to require a specific language in violation of the stated policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description emphasizes upload assistance, but the code also supports enumerating previously uploaded resources. In an agent context, this expands data access beyond user expectations and can expose historical file names and URLs, which may contain sensitive information or become a privacy leak.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/upload.py (reported line 177)May include surrounding context.

python
"object_key": object_key
    }

    response = requests.post(COMMIT_RESOURCE_URL, headers=headers, json=data)

    if response.status_code != 200:
        print(f"❌ 提交资源失败: HTTP {response.status_code}")

Tainted flow: 'data' from requests.get (line 234, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/upload.py (reported line 177)May include surrounding context.

python
"object_key": object_key
    }

    response = requests.post(COMMIT_RESOURCE_URL, headers=headers, json=data)

    if response.status_code != 200:
        print(f"❌ 提交资源失败: HTTP {response.status_code}")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The CLI exposes a --list mode that is not reflected in the stated purpose of the skill, creating a capability mismatch. In agent environments, hidden or under-declared enumeration features are risky because they can be invoked to discover prior assets unrelated to the current upload request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README title and instructions are entirely in Chinese, and there is no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context. Per the policy criteria, forcing a single language without user opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.