ClawHub
Back to skill

Security audit

Coze Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Coze CLI helper, but it gives an agent broad remote messaging, upload, deployment, environment, and delete capabilities without enough safety scoping or confirmation guidance.

Review before installing. Use it only when you intend the agent to operate Coze CLI, and require explicit approval before uploads, message sends using files or pipes, production deploys, environment variable changes, project deletion, or commands that expose logs, source code, credentials, or personal data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
94% confidence
Finding

The skill explicitly advertises the ability to 'send messages to projects,' which implies transmitting user-provided content to an external Coze service. In the context of an agent skill with terminal automation, this creates a real data exfiltration path if local files, logs, code, or other sensitive content are sent without strong consent boundaries.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
# Coze CLI Skill

> Interact with [Coze CLI](https://github.com/copilot66/coze-cli) — create/deploy Coze projects, manage spaces and organizations, send messages to projects, generate images/audio/video, and automate Coze workflows via terminal.

## Overview

Exfiltration Commands

High
Category
Prompt Injection
Confidence
96% confidence
Finding

The 'Send Message to Project' section gives concrete commands for sending prompts, file-referenced content, and piped log data to a remote project. This is especially dangerous because examples like piping error logs or referencing local files normalize sending potentially sensitive local data off-host, making exfiltration easier in an automated-agent context.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

Supported types: agent, workflow, app, skill, web, miniprogram, assistant

Send Message to Project

bash
coze code message send "修复登录页面的样式问题" -p <project_id>

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: coze-cli
description: Interact with Coze CLI (@coze/cli) — create/deploy Coze projects, manage spaces and organizations, send messages to projects, generate images/audio/video, and automate Coze workflows via terminal. Triggered when user mentions "coze", "coze cli", "扣子 CLI", or any coze command execution.
---

# Coze CLI Skill

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
---
name: coze-cli
description: Interact with Coze CLI (@coze/cli) — create/deploy Coze projects, manage spaces and organizations, send messages to projects, generate images/audio/video, and automate Coze workflows via terminal. Triggered when user mentions "coze", "coze cli", "扣子 CLI", or any coze command execution.
---

# Coze CLI Skill

Exfiltration Commands

High
Category
Prompt Injection
Confidence
91% confidence
Finding

The 'Send Message to Project' workflow includes examples that can transmit prompts, referenced local file context, and piped log data to a remote Coze project. In this skill context, that is a genuine exfiltration surface because it enables outbound transfer of potentially sensitive local data without any accompanying warning, scoping, or confirmation guidance.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

coze code project get <project_id> # detail

text

### Send Message to Project

```bash
coze code message send "修复登录页面的样式问题" -p <project_id>

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrase definition is broad enough to activate on generic mentions of 'coze' or any coze command execution, which can cause the skill to engage in situations the user did not clearly intend. In a skill that can authenticate, deploy projects, switch organizations/spaces, and send data to remote services, overbroad triggering increases the chance of unintended sensitive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README documents deployment and environment-variable modification commands as routine operations without warnings, approval gates, or guidance on secrets handling. Because these commands can change production behavior, overwrite configuration, or expose credentials through terminal history and logs, presenting them without safeguards makes accidental harmful use more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger text is overly broad because it activates on essentially any mention of Coze or any Coze command execution, which can cause the skill to engage in contexts the user did not clearly intend. In a skill that can deploy projects, modify environment variables, upload files, and send data to external services, ambiguous triggering increases the chance of unintended high-impact actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section shows sending messages with local file references and piped log data to a remote Coze project but does not warn that local content may be transmitted off-host to an external service. Users or agents may unintentionally disclose source code, logs, secrets, or personal data when using these examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The deployment and environment-variable sections document state-changing operations without any caution about production impact, credential handling, or accidental service disruption. In practice, these commands can alter running systems or expose sensitive configuration if used carelessly or triggered automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file upload example omits that the specified local file will be transferred to an external Coze service. Without a warning, users may upload confidential documents or regulated data unintentionally, especially in automated workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents coze code project delete <project_id> as a normal command but provides no warning that it deletes a project and may be irreversible. For markdown files, safety-relevant behaviors affecting user data or system integrity should include a clear warning so users understand the risk before acting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The environment variable section includes commands to view, set, and delete development and production environment variables, which can affect deployed behavior and may involve sensitive secrets. The description lacks any warning about handling credentials carefully, avoiding secret exposure in shell history, or confirming the target environment before modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The markdown instructs users to run coze file upload <path> to upload a local file and obtain a link, but it does not warn that local file contents are transmitted off the system. For markdown files, behaviors that affect privacy or user data should disclose that sensitive files should be reviewed before upload.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.