ClawHub
Back to skill

Security audit

Secret's Safe

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent security guidance skill about handling API keys, with no hidden execution or exfiltration behavior found.

Reasonable to install as a documentation skill, but treat its curl examples as guidance for avoiding LLM/log exposure, not complete host-level secret protection. Prefer official CLIs or client libraries that read credentials directly from the environment, and use narrowly scoped, short-lived API keys where possible.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:66
Finding

Secrets Are Exposed Through Process Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:66-69; references/env-injection-examples.md:13-16, 41-43, 52-56, 86-91
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium
Category: T09: Insecure Skill Coding Practices

Vulnerable Code

SKILL.md:66-69:

bash
MY_SERVICE_API_KEY="$MY_SERVICE_API_KEY" curl -s \
  -H "Authorization: Bearer $MY_SERVICE_API_KEY" \
  https://api.myservice.com/v1/data

references/env-injection-examples.md:13-16:

bash
curl -s https://api.openai.com/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o","messages":[{"role":"user","content":"Hello"}]}'

references/env-injection-examples.md:41-43:

bash
curl -s https://api.stripe.com/v1/customers \
  -u "$STRIPE_SECRET_KEY:"

references/env-injection-examples.md:52-56:

bash
curl -s -X POST https://slack.com/api/chat.postMessage \
  -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"channel\":\"#general\",\"text\":\"Hello\"}"

references/env-injection-examples.md:86-91:

bash
curl -s -X POST "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_ACCOUNT_SID/Messages.json" \
  --data-urlencode "From=+15551234567" \
  --data-urlencode "To=+15559876543" \
  --data-urlencode "Body=Hello" \
  -u "$TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN"

Technical Analysis

The shell expands the referenced environment variables before starting curl. Consequently, bearer tokens, API keys, and basic-auth credentials become literal values in the curl process argument vector.

Environment injection prevents credentials from being hardcoded in Skill text, but it does not make secrets safe when they are subsequently interpolated into command-line options such as -H or -u. Depending on operating-sy ...[truncated 2373 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not present curl -H "Authorization: Bearer $TOKEN" or curl -u "$SECRET:" as fully secret-safe. Explicitly document that shell expansion places these values in process arguments.
  2. Prefer service clients or application code that reads credentials directly from inherited environment variables and constructs authorization headers internally.
  3. Where a supported official CLI automatically reads a documented environment variable, use that mechanism rather than passing the credential as an option.
  4. If curl is unavoidable, provide an operating-system-appropriate pattern that supplies sensitive configuration through a protected file descriptor or another non-argument input channel. Avoid persistent temporary credential files; if a temporary file is indispensable, create it with mode 0600, prevent logging, and delete it reliably with a cleanup trap.
  5. Run commands under a dedicated least-privileged account and restrict process inspection, telemetry collection, and access to diagnostic logs.
  6. Use narrowly scoped, short-lived credentials and rotate any credential suspected of appearing in command-line telemetry.
  7. Revise the comments in SKILL.md so they distinguish protection from LLM-context disclosure from protection against local host-level process observation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
### In `SKILL.md` frontmatter

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md
### In `SKILL.md` frontmatter

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
# Fetches the secret at subprocess level — never echoes to stdout
SECRET=$(security find-generic-password -s "my-service-api-key" -w 2>/dev/null)
if [ -z "$SECRET" ]; then
  echo "ERROR: Secret 'my-service-api-key' not found in keychain." >&2
  exit 1
fi
export MY_SERVICE_API_KEY="$SECRET"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/audit-checklist.md (reported line 53)May include surrounding context.

md
### Output Safety
- [ ] Error messages never reflect credential values
- [ ] Success messages don't include auth tokens from responses (e.g., OAuth access tokens)
- [ ] Log output (if any) strips sensitive fields before writing

### Script Review

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/audit-checklist.md (reported line 70)May include surrounding context.

md
🚨 A skill that asks you to run a shell command to "install a prerequisite"
   that isn't from a known package manager (brew, npm, pip, apt)

🚨 A `curl | bash` or `wget | sh` pattern anywhere in the instructions

🚨 Base64-encoded strings being decoded and executed: `echo "..." | base64 -d | bash`

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/audit-checklist.md (reported line 70)May include surrounding context.

md
🚨 A skill that asks you to run a shell command to "install a prerequisite"
   that isn't from a known package manager (brew, npm, pip, apt)

🚨 A `curl | bash` or `wget | sh` pattern anywhere in the instructions

🚨 Base64-encoded strings being decoded and executed: `echo "..." | base64 -d | bash`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

CORRECT — key stays in environment, never in command string visible to LLM

MY_SERVICE_API_KEY="$MY_SERVICE_API_KEY" curl -s
-H "Authorization: Bearer $MY_SERVICE_API_KEY"
https://api.myservice.com/v1/data

text

**Never instruct the agent to do this:**

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

CORRECT — key stays in environment, never in command string visible to LLM

MY_SERVICE_API_KEY="$MY_SERVICE_API_KEY" curl -s
-H "Authorization: Bearer $MY_SERVICE_API_KEY"
https://api.myservice.com/v1/data

text

**Never instruct the agent to do this:**

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Safe shell wrapper pattern

Create a scripts/run-with-secret.sh in your skill:

bash
#!/usr/bin/env bash

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
## Pattern 3: User Setup Flow (first-run)

If the user hasn't configured a key yet, guide them through setup **without asking for the key in chat**.

### Correct setup prompt to give the user:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

SAFE — write instructions like these:

"The API key is injected as $OPENAI_API_KEY via environment — use it directly." "Run: OPENAI_API_KEY=$OPENAI_API_KEY curl ..." "If $OPENAI_API_KEY is not set, print an error and exit — do not ask the user."

text

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/env-injection-examples.md (reported line 14)May include surrounding context.

text

```bash
# Safe curl
curl -s https://api.openai.com/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/env-injection-examples.md (reported line 15)May include surrounding context.

bash
# Safe curl
curl -s https://api.openai.com/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o","messages":[{"role":"user","content":"Hello"}]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/env-injection-examples.md (reported line 47)May include surrounding context.

text

```bash
curl -s https://api.stripe.com/v1/customers \
  -u "$STRIPE_SECRET_KEY:"
# Note: -u USER:PASS format — key goes in the colon-separated user field, not echoed

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/env-injection-examples.md (reported line 105)May include surrounding context.

text

```bash
curl -s -X POST "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_ACCOUNT_SID/Messages.json" \
  --data-urlencode "From=+15551234567" \
  --data-urlencode "To=+15559876543" \
  --data-urlencode "Body=Hello" \