ClawHub
Back to skill

Security audit

Meme Collector 热梗收集器

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says by collecting Chinese meme entries and writing them to Dify, but it handles a Dify API key through command-line arguments and performs remote writes without strong guardrails.

Review before installing. Use only a dataset-scoped, least-privilege Dify token, avoid placing the API key directly in command lines or chat, rotate any token previously exposed in shell history or logs, and confirm generated meme entries before allowing batch upload to your Dify knowledge base.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dify_ops.py:126
Finding

Dify API Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/dify_ops.py:126; insecure invocation examples also appear in SKILL.md:30 and SKILL.md:60
Vulnerability Type: API credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

python
parser.add_argument("--api-key", required=True)

The Skill documentation instructs users to invoke the script as follows:

bash
python3 scripts/dify_ops.py --dataset-id $DATASET_ID --api-key $API_KEY --proxy $PROXY list
bash
python3 scripts/dify_ops.py --dataset-id $DATASET_ID --api-key $API_KEY --proxy $PROXY batch --json-file /tmp/new_memes.json

Technical Analysis

The script requires a reusable Dify API credential to be supplied as a command-line argument. After shell expansion, the credential becomes part of the process argument vector. It may consequently be exposed through:

  • Process inspection interfaces and system-monitoring tools while the command is running.
  • Shell history if users enter or expand the credential directly in a recorded command.
  • Process accounting, diagnostic collection, audit logs, or automation logs that capture command lines.

The script sends the credential only to the fixed HTTPS endpoint https://api.dify.ai/v1, and TLS verification is not disabled. Sending an authorization token to Dify is necessary for the declared knowledge-base functionality. The vulnerability is therefore not the intended Dify network transmission, but the insecure local credential-delivery mechanism.

Attack Path

  1. A user follows SKILL.md and runs the script with --api-key $API_KEY.
  2. The shell expands the environment variable into the command's process arguments.
  3. A local user, monitoring agent, process-accounting system, or exposed automation log captures the command line.
  4. The observer extracts the bearer token.
  5. The attacker submits the recovered token to the Dify API.
  6. Subject to the token's assigned permissions, the ...[truncated 760 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key command-line option and obtain the credential from a protected secret source, such as:

    • A secret manager.
    • A restricted-permission configuration file.
    • A dedicated environment variable, while ensuring it is not printed or inherited unnecessarily.
    • Standard input through getpass.getpass() for interactive execution.

  2. For example, replace the argument with protected environment-variable retrieval:

python
import os

api_key = os.environ.get("DIFY_API_KEY")
if not api_key:
    parser.error("DIFY_API_KEY must be configured securely")

  1. Update SKILL.md so documented commands do not contain --api-key or interpolate credentials into the command line.

  2. Ensure logs, exceptions, diagnostics, and status output never include the bearer token.

  3. Use a dataset-scoped, least-privilege token where Dify supports it. Avoid broader administrative credentials.

  4. Rotate any token previously passed through command lines if process metadata, shell history, or automation logs may have been accessible.

  5. Restrict access to runtime environments and CI/CD logs, and configure secret masking as defense in depth.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The documented purpose claims automatic collection of memes, but the actual described implementation centers on generic Dify dataset listing and batch-writing via a local script, while the claimed web collection capability is not concretely implemented in the skill file. This mismatch is dangerous because reviewers and users may approve the skill under inaccurate assumptions, enabling broader data-management actions than the description suggests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill performs file-reading and network-dependent operations but does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it harder for a host agent or reviewer to understand and constrain what external access the skill requires before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs writing collected content into an external Dify knowledge base without an explicit warning that it will modify remote data. This can lead to unintended or unauthorized changes if a user triggers the skill without understanding that it performs state-changing operations rather than just analysis or collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill asks for an API key and proxy details and then uses them for remote API operations, but it provides no guidance on safe credential handling, storage, or redaction. This increases the risk of secrets being exposed in chat history, logs, shell history, or downstream tooling during execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The note instructs the agent to use search_lang: "zh" and country: "CN" to force Chinese-language, China-specific results. This is a natural-language locale policy constraint and the file does not present it as an option or require user consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/dify_ops.py (reported line 17)May include surrounding context.

python
import requests


BASE_URL = "https://api.dify.ai/v1"


def get_session(proxy=None):

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file presents all instructions and field definitions exclusively in Chinese, which effectively imposes a language requirement on users. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code emits several user-facing progress and summary messages only in Chinese, such as the existing-document count and batch completion output. Because the file provides no opt-in, fallback, or documented locale constraint, it may violate a language/locale policy requiring user choice or neutrality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.