ClawHub
Back to skill

Security audit

HiFleet Claw

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate HiFleet vessel-position lookup skill, but it needs Review because it documents sending a HiFleet token in a URL and uses broad activation terms.

Install only if you trust the HiFleet API use case and can protect the HiFleet token. Prefer storing the token in a protected environment variable or secret manager, avoid pasting real tokens into chat or completed URLs, and make sure logs, traces, errors, and shared diagnostics redact usertoken.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
ship-position/SKILL.md:96
Finding

HiFleet Authentication Token Exposed in URL Query String

Content
View full analysis
Remediation
View remediation
`, if the HiFleet API supports one. 2. If the provider requires `usertoken` as a query parameter: - Configure the HTTP client and agent runtime to redact the parameter value from request logs, traces, exceptions, and tool-call output. - Never display or return the completed URL to users. - Disable verbose HTTP logging in production. - Configure proxies, gateways, and observability systems to remove or mask `usertoken`. - Avoid placing completed requests in shell history or persistent request collections. 3. Store the token only in an approved secret manager or protected environment variable. Do not store it in source-controlled project configuration. 4. Use short-lived, least-privilege tokens restricted to the required vessel-position endpoint where supported. 5. Document token rotation and revocation procedures, and rotate any token suspected of appearing in logs. 6. Add automated tests that verify URLs, errors, and diagnostic output contain a redacted value such as `usertoken=[REDACTED]` rather than the credential. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Ship Position skill uses broad activation terms such as '位置/location' and '在哪/where is', which can easily match normal conversation and unintentionally invoke a skill that retrieves vessel location data. Because the implementation note also mentions use of a configured user token, accidental activation could expose sensitive operational data or trigger unintended backend queries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The Archive skill includes generic triggers like '船舶信息/ship info' and 'manager', which are broad enough to collide with ordinary maritime discussion. This can cause unintended activation and disclosure or retrieval of vessel/company profile data beyond the user's actual intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The Port skill trigger list contains common terms like 'arrival', 'departure', and '港口信息/port info' that may appear in many unrelated logistics or status requests. Over-broad matching can invoke the skill unexpectedly and surface port planning or operational details the user did not explicitly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The Performance skill is triggered by generic operational terms like 'speed', 'main engine', and 'efficiency', which are common across many maritime conversations. This weak boundary increases the risk of accidental activation and exposure of vessel performance metrics or reports that may be commercially sensitive.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The Route skill includes broad terms like 'distance' and 'route', which can appear in ordinary navigation, planning, or general Q&A. Without stronger activation boundaries, the skill may run unexpectedly and produce route-planning output or query historical routing data when that was not intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Shipping skill uses highly generic business terms like 'market', 'shipping', and 'news', making it especially prone to false activation from routine conversation. In a platform serving maritime operations, this could lead to unintended retrieval of market intelligence or industry data and create noisy or misleading behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The Weather & Sea Conditions skill uses generic terms like 'weather', 'wind', and 'visibility', which commonly occur in ordinary conversation and many other maritime workflows. Unintended activation is more dangerous here because weather advice can influence navigation decisions, so accidental or context-poor responses may have operational safety implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description says to use the skill when the user asks for vessel/ship position, latest position by MMSI, or 船位/位置/报位. Terms like “位置” and “报位” are broad in ordinary maritime conversation, and the file does not provide exclusion conditions or negative examples clarifying when the skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to send MMSI and a user-provided authorization token to a third-party API but does not clearly warn the user that their query data and secret credential will be transmitted externally. This creates a meaningful transparency and privacy risk, especially because tokens may be supplied at request time and could be mishandled or exposed through logs, debugging, or downstream systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This skill is explicitly designed to transmit vessel identifiers and an authorization token to an external third-party endpoint. External transmission is expected in context, but it remains security-relevant because the request includes a secret in the query string, which is more easily leaked via logs, proxies, browser history, or observability tooling.

Content

Scanner excerpt · ship-position/SKILL.md (reported line 28)May include surrounding context.

md
| 项目 | 值 |
|------|-----|
| **简要描述** | 获取（岸基+卫星+移动）船舶最新位置信息 |
| **请求 URL** | `https://api.hifleet.com/position/position/get/token` |
| **请求方式** | `GET` |

### 请求 Query 参数

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The call-flow section instructs constructing a GET request with usertoken embedded directly in the URL. Putting secrets in URLs is dangerous because URLs are commonly logged by servers, API gateways, reverse proxies, monitoring systems, and client tooling, increasing the likelihood of credential disclosure and unauthorized reuse.

Content

Scanner excerpt · ship-position/SKILL.md (reported line 113)May include surrounding context.

md
1. **检查 token**：若未配置 `usertoken`，返回提示并终止。
2. **校验 MMSI**：请求必须包含有效 `mmsi`（9 位数字字符串）。
3. **发起请求**：`GET https://api.hifleet.com/position/position/get/token?mmsi={mmsi}&usertoken={usertoken}`
4. **解析结果**：根据 `result === "ok"` 与 `list` 解析位置与船舶信息；若 `result !== "ok"`，按错误处理并提示用户。

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The example request demonstrates secret usage in the URL, normalizing an insecure pattern that operators may copy into implementations, tests, and troubleshooting commands. This increases the chance that valid tokens will be pasted into terminals, tickets, chat logs, or telemetry systems where they can be harvested.

Content

Scanner excerpt · ship-position/SKILL.md (reported line 122)May include surrounding context.

text
# 获取 MMSI 413829443 的最新船位
GET https://api.hifleet.com/position/position/get/token?mmsi=413829443&usertoken=${HIFLEET_USER_TOKEN}

解析后向用户展示时，建议包含：船名、MMSI、最后更新时间、经纬度（度）、航速、航向、目的港、状态。