ClawHub
Back to skill

Security audit

Memo Api

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent MaiMemo API helper, but it asks users to paste a live account token into chat and can read, export, modify, and delete authenticated study data.

Review this skill before installing. Configure MAIMEMO_TOKEN through a secure environment or secret manager rather than pasting it into chat, and rotate the token if it has already been shared in a conversation. Use it only when you are comfortable letting the agent access MaiMemo study records and perform account-changing actions such as exports, deletes, adding words, and advancing review schedules.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

Bearer Token Requested Through the AI Conversation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–27
Vulnerability Type: Plaintext credential exposure through conversational input
Risk Level: Medium

markdown
- **Token**: env var `$MAIMEMO_TOKEN` — obtain it from either:
  - App: 墨墨背单词 → 开放 API
  - Web: open `https://open.maimemo.com/open/api/v1/tokens/openapi`, log in to the MaiMemo account, ask the user to copy the Token and paste it back, then set it as `$MAIMEMO_TOKEN`
- **Token expiry**: Tokens from the web source are valid for 7 days. If an API call indicates the token is expired/invalid (for example auth failure), tell the user to repeat the web login/copy/paste flow and update `$MAIMEMO_TOKEN`.
- **Auth header**: `Authorization: Bearer $MAIMEMO_TOKEN`

Technical Analysis

The skill explicitly instructs the agent to ask the user to paste a live MaiMemo bearer token into the conversation. Although the token is subsequently intended to be stored in the MAIMEMO_TOKEN environment variable, transmitting it through chat first exposes it to the model context and potentially to conversation history, application telemetry, debugging records, monitoring systems, or other log-retention infrastructure.

A bearer token does not require additional proof of identity. Any party that obtains it can use the documented authorization header until the token expires or is revoked. The documented web-issued token remains valid for seven days, creating a meaningful exploitation window.

The credential provides access to authenticated API operations documented throughout the project, including private study-data queries and state-changing operations. No evidence indicates that the skill intentionally sends the token to an unrelated domain; the vulnerability is the insecure credential-acquisition workflow itself.

Attack Path

  1. A user invokes the skill without an existing MAIMEMO_TOKEN environment variable.
  2. Following SKILL.md, the agent directs the user to generate a MaiMemo Ope ...[truncated 1372 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction asking users to paste tokens into the AI conversation.
  2. Require MAIMEMO_TOKEN to be configured out of band through a trusted local environment configuration, platform secret manager, or dedicated credential-entry interface that does not expose its value to the model.
  3. Instruct the agent only to check whether the environment variable is available, never to request or display its contents.
  4. Ensure command output, error messages, debugging data, and telemetry redact the Authorization header and token value.
  5. Avoid shell tracing or verbose HTTP modes that could print authorization headers.
  6. If a token has already been pasted into a conversation, advise the user to revoke or rotate it immediately and configure the replacement through the secure channel.
  7. Prefer narrowly scoped and short-lived credentials if the MaiMemo platform supports them.
  8. Document a secure setup flow, for example: generate the token in MaiMemo, store it directly in the execution platform’s secret manager, verify only that MAIMEMO_TOKEN is present, and then invoke the API without echoing the credential.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (24)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/interpretations-api.md (reported line 58)May include surrounding context.

md
**Response**: `{ "interpretation": Interpretation }`

### DELETE /interpretations/{id} — Delete interpretation

No body. No response body.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/notepads-api.md (reported line 63)May include surrounding context.

md
**Response**: `{ "notepad": Notepad }`

### DELETE /notepads/{id} — Delete notepad

**Response**: `{ "notepad": Notepad }`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/notes-api.md (reported line 56)May include surrounding context.

md
**Response**: `{ "note": Note }`

### DELETE /notes/{id} — Delete note

No body. No response body.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/phrases-api.md (reported line 60)May include surrounding context.

md
**Response**: `{ "phrase": Phrase }`

### DELETE /phrases/{id} — Delete phrase

**Response**: `{ "phrase": Phrase }`

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is broad enough to activate on generic study or vocabulary conversations, which can cause unintended invocation of the skill. In this skill, unintended activation matters because the skill can access account-linked study data and perform write actions such as adding words or exporting records, increasing the chance of privacy-impacting or surprising behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill advertises export of study data but does not prominently warn that this may expose personal learning history, schedules, and performance metadata. Without an explicit privacy warning and confirmation step, users may trigger sensitive data retrieval or export without understanding the scope of disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
env:
        - MAIMEMO_TOKEN
      binds:
        - curl
---

# MaiMemo Open API

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file mixes English headings with required Chinese examples and a fixed Chinese tag set such as 简明, 详细, and exam-specific labels. Because the documentation does not state that the API is region-specific or offer any language/locale alternative, it can be read as imposing a specific locale on all users.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/interpretations-api.md (reported line 16)May include surrounding context.

Response: { "interpretations": [Interpretation, ...] }

bash
curl -s "https://open.maimemo.com/open/api/v1/interpretations?voc_id=VOC_ID" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/notepads-api.md (reported line 18)May include surrounding context.

Response: { "notepads": [BriefNotepad, ...] }

bash
curl -s "https://open.maimemo.com/open/api/v1/notepads?limit=10&offset=0" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/notes-api.md (reported line 16)May include surrounding context.

Response: { "notes": [Note, ...] }

bash
curl -s "https://open.maimemo.com/open/api/v1/notes?voc_id=VOC_ID" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/phrases-api.md (reported line 16)May include surrounding context.

Response: { "phrases": [Phrase, ...] }

bash
curl -s "https://open.maimemo.com/open/api/v1/phrases?voc_id=VOC_ID" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/study-api.md (reported line 43)May include surrounding context.

bash
# Unfinished words
curl -s -X POST "https://open.maimemo.com/open/api/v1/study/get_today_items" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"is_finished": false, "limit": 1000}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/study-api.md (reported line 69)May include surrounding context.

bash
# Total words in plan
curl -s -X POST "https://open.maimemo.com/open/api/v1/study/query_study_records" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"as_count": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/study-api.md (reported line 93)May include surrounding context.

bash
# Add words without advancing
curl -s -X POST "https://open.maimemo.com/open/api/v1/study/add_words" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/study-api.md (reported line 129)May include surrounding context.

  • advanced_count: Number successfully advanced (may be less if words not in plan)
bash
curl -s -X POST "https://open.maimemo.com/open/api/v1/study/advance_study" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The export example encourages bulk retrieval of all study records without any privacy, consent, retention, or minimization warning. Because study history can reveal learning habits, schedules, and potentially sensitive personal profiling data, normalizing full export increases the chance of over-collection and downstream leakage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document gives conflicting authorization/feature-gating guidance: it says add_words with advance enables immediate review with 'no level limit', while elsewhere immediate review is described as requiring level 10+. Inconsistent security or entitlement semantics can cause callers to rely on behavior that bypasses intended product restrictions, or build flows that unintentionally probe for privilege boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/vocabulary-api.md (reported line 16)May include surrounding context.

Response: { "voc": { "id": "...", "spelling": "..." } }

bash
curl -s "https://open.maimemo.com/open/api/v1/vocabulary?spelling=apple" \
  -H "Authorization: Bearer $MAIMEMO_TOKEN"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The file title and multiple example values use Chinese text, which may impose a specific language context without stating that the API or examples are locale-specific. The policy requires either user choice/opt-in or a clearly documented justification for a language constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file documents a DELETE operation for notepads but provides no warning that the action may remove user data or be irreversible. Under the markdown-specific warning criteria, descriptions of behaviors affecting user data should disclose that risk to users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The NotepadStatus and NotepadType descriptions are written exclusively in Chinese, but the document does not explain that this is a region-specific or localized API reference. This can constitute an undocumented language/locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents a DELETE operation that removes notes, but it provides no warning that the action is destructive or may remove user data. Under the markdown-specific warning criterion, descriptions of behaviors affecting user data should include a caution so users understand the impact before invoking the operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file documents a DELETE endpoint for deleting a phrase, but it provides no user warning about the destructive nature of the operation or whether deletion is reversible. For markdown files, omission of warnings about behaviors that could affect user data should be flagged.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.