T09 · Insecure Skill Coding Practices
Error
- Location
scripts/exec-token.js:58- Finding
Shell Command Injection and API Key Exposure in exec-token
- Content
View full analysis
- Remediation
View remediation
Security audit
NewAPI
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent for New API account management, but it handles real API keys with broad shell execution and overbroad environment access that users should review before installing.
Install only if you are comfortable giving the skill access to your New API management token, token keys, config files you point it at, the local clipboard, and shell commands you explicitly ask it to run. Avoid exec-token for untrusted commands or shared machines; prefer applying keys to a narrow config file, keep New API credentials out of broad project .env files, and review the unpinned install source before updating.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/env.js:16- Finding
Project .env Loader Imports Unrelated Secrets into Child Process Environment
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/api.js:68- Finding
Raw API Error Responses Are Printed Without Sanitization
- Content
View full analysis
= 400) { console.error(`HTTP ${res.status} Error:`); console.error(text); process.exit(1); } ``` The token-response sanitization is reached only after the error branch: ```js if (shouldMask(urlPath)) { try { const data = JSON.parse(text); console.log(sanitize(JSON.stringify(walk(data)))); } catch { console.log( '{"success":false,"message":"token response omitted because masking failed"}' ); } ``` ### Technical Analysis The script reads an API response into `text` and prints it verbatim whenever the HTTP status is 400 or greater. This occurs before the token-specific masking and generic sanitization logic. Error bodies are controlled by the configured remote server and may contain sensitive response fields, debugging data, reflected input, proxy diagnostics, token values, or authorization-related details. A malicious or compromised endpoint can deliberately return an error status with secret-looking data so that it is written directly to stderr and becomes visible in terminal logs, automation logs, or the AI conversation context. The vulnerability also applies when a legitimate server unintentionally includes sensitive diagnostics in an error response. ### Attack Path 1. The Agent invokes `api.js` against a token or other management endpoint. 2. The configured server, reverse proxy, or upstream service returns an HTTP error. 3. The response body contains a token, credential, reflected request value, or sensitive diagnostic information. 4. `api.js` prints the complete body to stderr without calling `sanitize`. 5. The calling environment captures the output in model-visible context or persistent logs. ### Impac ...[truncated 433 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/inject-key.js:55- Finding
Heuristic Config Scanning Can Disclose Secrets from Arbitrary Files
- Content
View full analysis
"); process.exit(1); } const resolved = path.resolve(filePath); if (!fs.existsSync(resolved)) { console.error(`ERROR: File not found: ${resolved}`); process.exit(1); } const content = fs.readFileSync(resolved, "utf-8"); console.log(sanitize(content)); process.exit(0); } ``` The sanitizer uses a limited set of regular expressions and returns unmatched lines unchanged: ```js function sanitize(content) { // Rule 1: sk- prefixed tokens let result = content.replace(/sk-[A-Za-z0-9_\-]{4,}/g, "sk-"); // Rule 2: Bearer tokens result = result.replace(/Bearer\s+[A-Za-z0-9_.\-\/+=]{4,}/g, "Bearer "); // Rule 3: Credentials in connection strings (user:pass@host pattern) result = result.replace( /[A-Za-z0-9_.\-]+:[A-Za-z0-9_.\-]+@[^\s]+/g, "" ); // Rule 4: Values of sensitive-named fields (line-by-line) result = result .split("\n") .map((line) => { const jsonMatch = line.match( /^(\s*"([^"]+)"\s*:\s*)"([^"]*)"(.*)$/ ); if (jsonMatch) { const [, prefix, key, , suffix] = jsonMatch; if (SENSITIVE_PATTERN.test(key)) { return `${prefix}""${suffix}`; } return line; } const yamlMatch = line.match( /^(\s*([\w.\-]+)\s*:\s*)(.+)$/ ); if (yamlMatch) { const [, prefix, key, value] = yamlMatch; if (SENSITIVE_PATTERN.test(key) && value.trim() !== "" && value.trim() !== "|" && value.trim() !== ">") { return `${prefix}`; } ret ...[truncated 2665 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md New API calls should go through the provided scripts (`api.js`, `copy-key.js`, `inject-key.js`, `exec-token.js`) rather than using `curl`, `wget`, `fetch`, or o
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Q: Can I ask the AI to show me my real token key?** A: No. The AI is strictly prohibited from reading or displaying raw keys. The only supported way to retrieve a real key is `/newapi copy-token`, which copies it to your clipboard silently. **Q: Where do I find my access token and user ID?** A: Log in to the New API web console and open Personal Settings. Generate an access token there; your user ID is shown on the same page. **Q: What's the difference between access token and API token?**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Q: Can I ask the AI to show me my real token key?** A: No. The AI is strictly prohibited from reading or displaying raw keys. The only supported way to retrieve a real key is `/newapi copy-token`, which copies it to your clipboard silently. **Q: Where do I find my access token and user ID?** A: Log in to the New API web console and open Personal Settings. Generate an access token there; your user ID is shown on the same page. **Q: What's the difference between access token and API token?**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Q: Can I ask the AI to show me my real token key?** A: No. The AI is strictly prohibited from reading or displaying raw keys. The only supported way to retrieve a real key is `/newapi copy-token`, which copies it to your clipboard silently. **Q: Where do I find my access token and user ID?** A: Log in to the New API web console and open Personal Settings. Generate an access token there; your user ID is shown on the same page. **Q: What's the difference between access token and API token?**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Q: Can I ask the AI to show me my real token key?** A: No. The AI is strictly prohibited from reading or displaying raw keys. The only supported way to retrieve a real key is `/newapi copy-token`, which copies it to your clipboard silently. **Q: Where do I find my access token and user ID?** A: Log in to the New API web console and open Personal Settings. Generate an access token there; your user ID is shown on the same page. **Q: What's the difference between access token and API token?**
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The skill includes self-update instructions that fetch the latest remote skill code. Even though this is framed as normal maintenance, self-modification/update paths increase risk because a compromised upstream repository or unexpected update could change the skill's behavior without prior review.
- Content
md **Q: How do I configure a third-party CLI that needs `config set ... <key>`?** A: Use `/newapi exec-token <token_id> <command...>`. Write the full command but use the placeholder `__NEWAPI_TOKEN_{id}__` where the real key would go. The script replaces the placeholder and executes the command — the real key never enters the AI conversation. For example: `/newapi exec-token 42 openclaw config set provider.openai.apiKey __NEWAPI_TOKEN_42__`. **Q: How do I install or update this skill?** A: Run `npx skills add https://github.com/QuantumNous/skills --skill newapi`. This fetches the latest version from the [skills repository](https://github.com/QuantumNous/skills). ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
Every API request uses Access Token auth with these headers:
text Authorization: Bearer <NEWAPI_ACCESS_TOKEN>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * Shared configuration loader for new-api scripts. * * Loads .env files (project root first, then skill dir) and validates * the three required variables. Exports { BASE_URL, ACCESS_TOKEN, USER_ID }. * * Priority (higher overrides lower):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * Shared configuration loader for new-api scripts. * * Loads .env files (project root first, then skill dir) and validates * the three required variables. Exports { BASE_URL, ACCESS_TOKEN, USER_ID }. * * Priority (higher overrides lower):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * Shared configuration loader for new-api scripts. * * Loads .env files (project root first, then skill dir) and validates * the three required variables. Exports { BASE_URL, ACCESS_TOKEN, USER_ID }. * * Priority (higher overrides lower):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * Shared configuration loader for new-api scripts. * * Loads .env files (project root first, then skill dir) and validates * the three required variables. Exports { BASE_URL, ACCESS_TOKEN, USER_ID }. * * Priority (higher overrides lower):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const projectRoot = findProjectRoot(process.cwd()); // Lower priority first, higher priority overwrites undefined keys loadEnv(path.join(projectRoot, ".env")); loadEnv(path.join(skillDir, ".env")); const BASE_URL = process.env.NEWAPI_BASE_URL;
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const projectRoot = findProjectRoot(process.cwd()); // Lower priority first, higher priority overwrites undefined keys loadEnv(path.join(projectRoot, ".env")); loadEnv(path.join(skillDir, ".env")); const BASE_URL = process.env.NEWAPI_BASE_URL;
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill references operations involving network access and potentially sensitive credential handling, but it does not declare any explicit tool scope such as permissions or allowed-tools. Without a restrictive scope, an agent may invoke broader environment or network capabilities than intended, increasing the chance of secret exposure or unauthorized outbound requests if the skill or downstream docs are abused.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ENV: `OPENAI_API_KEY=__NEWAPI_TOKEN_42__` - TOML: `api_key = "__NEWAPI_TOKEN_42__"` Also set the base URL field if needed — use the value from `NEWAPI_BASE_URL` environment variable with `/v1` appended (e.g., `https://api.example.com/v1`). The base URL is NOT a secret and can be written directly. **Step 3 — Apply the real key**:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown skill description instructs the agent to extract and display personal account data including username, display name, email, group, and request count. The file does not include any user-facing warning that the action reveals potentially sensitive account information, which is required for markdown files when behavior could affect user privacy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented success message is explicitly in Chinese:
Token <token_id> 的密钥已复制到剪贴板。. This imposes a specific language choice in the skill's user-facing behavior without offering a language preference or documenting a justified locale restriction.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill promotes copying the real token to the local clipboard silently but does not warn that clipboard contents may be readable by other local applications, clipboard history tools, remote desktop software, or shared workstations. This can lead to accidental credential disclosure even though the token is not shown in chat.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation describes executing arbitrary user-supplied commands after substituting a real secret into them, but does not explicitly warn about command injection, shell expansion, logging, process-list exposure, or writing secrets into config/history. This is especially risky because the feature bridges secret handling with command execution, increasing the chance of credential leakage or unsafe command execution.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The documentation instructs users to install or update the skill via
npx skills add ...without pinning an exact package or repository version. That creates a supply-chain risk: future upstream changes or a compromised package/repository could deliver modified code at install time.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation explicitly instructs users to execute arbitrary shell commands after substituting a real token into the command line. Even though the script is described as sanitizing output, this pattern can still expose secrets through process arguments, shell history, child-process behavior, or unsafe user-supplied commands, and the docs do not adequately warn about those risks. In a skill specifically designed to help copy and apply API keys, this omission makes accidental credential leakage more likely.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest does mention securely copying keys to config files or commands, which justifies handling secrets, but it does not explicitly justify executing host shell commands via child_process. Here the script uses execSync both to discover installed binaries and to run a clipboard command, introducing host command execution capability beyond straightforward API/key management logic.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Line L70 prints the completion message only in Chinese, which imposes a specific language on users with no opt-in or fallback. The file contains no indication that this skill is intentionally region-specific or that users can select their preferred locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L65 specifies a fixed Chinese success message (
已将 Token {token_id} 的密钥写入 {file_path}) with no indication that the user can choose language or locale. This is a natural-language policy issue because it imposes a specific language without opt-in or documented justification.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script emits its final user-facing status message only in Chinese: "已将 Token ... 的密钥写入 ...". This imposes a specific language on users without any visible language selection, fallback, or documentation justifying a locale-specific constraint.
- Content