ClawHub
Back to skill

Security audit

AI短信发送工具

Security checks for vulnerabilities and agentic risk

Overview

This SMS skill does what it advertises, but its credential handling and endpoint controls are unsafe enough to require review before installation.

Install only if you are comfortable reviewing or hardening the script first. Prefer OpenClaw-managed secrets, avoid the .env file path, do not run it from a writable or shared skill directory, and ensure SMS credentials can only be sent to the official Chuanglan HTTPS endpoint.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
send-sms.sh:58
Finding

Arbitrary Shell Command Execution Through Sourced .env File

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
send-sms.sh:82
Finding

Credential Exfiltration Through Unrestricted API Endpoint Override

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
send-sms.sh:99
Finding

JSON Injection and Request Corruption Through Unescaped Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:50
Finding

Plaintext Credential File Guidance Without Permission Hardening

Content
View full analysis
.env echo "CHANGLAN_PASSWORD=你的API密码" >> .env ``` ### Technical Analysis The documentation instructs users to write a reusable API account and password to a plaintext `.env` file. It does not set a restrictive `umask`, apply mode `0600`, verify ownership, warn against committing or packaging the file, or recommend a managed secret store. The actual exposure depends on the user's current umask and directory permissions. On systems with permissive defaults, the file may be readable by other local accounts. Plaintext files are also more likely to be copied into backups, support archives, or packages. ### Attack Path 1. A user follows the documented setup commands. 2. The `.env` file is created using the user's existing umask and stores the account password in plaintext. 3. The file is left readable to unintended local users, copied into a backup, included in an archive, or otherwise exposed. 4. Another party reads the Chuanglan credentials. 5. The credentials are reused against the SMS service, subject to provider-side controls such as IP allowlisting. ### Impact Assessment Exposure compromises the confidentiality of reusable SMS service credentials. An attacker may be able to submit unauthorized messages, consume the account's SMS balance, generate financial costs, or access account-related capabilities. IP allowlisting may limit remote use but does not eliminate the credential disclosure or abuse from an allowed host. ]]>
Remediation
View remediation
.env chmod 600 .env ``` - Require ownership checks before loading the file. - Add `.env` to version-control, packaging, backup, and diagnostic-upload exclusion lists. - Warn users never to share or commit the file. - Document credential rotation procedures for suspected exposure. - Avoid placing secrets in a package directory when a user-specific protected configuration directory is available. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The documentation instructs users to write the SMS account credential into a local .env file inside the skill directory. Storing secrets in a plaintext file increases the risk of accidental disclosure through permissive file permissions, backups, syncing, local compromise, or inadvertent inclusion in archives or repositories.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash
cd ~/.claude/skills/sms-chuanglan
echo "CHANGLAN_ACCOUNT=你的API账号" > .env
echo "CHANGLAN_PASSWORD=你的API密码" >> .env

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

This line continues the plaintext .env credential storage pattern by appending the API password to a file in the skill directory. Passwords stored this way are easier to leak through filesystem access, debugging artifacts, sync services, backups, or source-control mistakes, especially because the skill docs normalize this insecure pattern.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

bash
cd ~/.claude/skills/sms-chuanglan
echo "CHANGLAN_ACCOUNT=你的API账号" > .env
echo "CHANGLAN_PASSWORD=你的API密码" >> .env

使用方式

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · send-sms.sh (reported line 6)May include surrounding context.

sh
set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ENV_FILE="${SCRIPT_DIR}/.env"

usage() {
    echo "用法: send-sms.sh --phone <手机号> --template <模板ID> [--vars <变量JSON>]"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
usage
fi

# 读取配置（优先环境变量，其次 .env 文件）
load_config() {
    # 优先使用环境变量
    if [[ -z "$CHANGLAN_ACCOUNT" ]] || [[ -z "$CHANGLAN_PASSWORD" ]]; then

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · send-sms.sh (reported line 56)May include surrounding context.

sh
usage
fi

# 读取配置（优先环境变量，其次 .env 文件）
load_config() {
    # 优先使用环境变量
    if [[ -z "$CHANGLAN_ACCOUNT" ]] || [[ -z "$CHANGLAN_PASSWORD" ]]; then

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · send-sms.sh (reported line 72)May include surrounding context.

sh
usage
fi

# 读取配置（优先环境变量，其次 .env 文件）
load_config() {
    # 优先使用环境变量
    if [[ -z "$CHANGLAN_ACCOUNT" ]] || [[ -z "$CHANGLAN_PASSWORD" ]]; then

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · send-sms.sh (reported line 81)May include surrounding context.

sh
usage
fi

# 读取配置（优先环境变量，其次 .env 文件）
load_config() {
    # 优先使用环境变量
    if [[ -z "$CHANGLAN_ACCOUNT" ]] || [[ -z "$CHANGLAN_PASSWORD" ]]; then

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Using source on a .env file executes the file as shell code rather than safely parsing key-value pairs. If an attacker can modify that file, they can achieve arbitrary command execution when the script runs, making this substantially more dangerous than ordinary secret loading.

Content

Scanner excerpt · send-sms.sh (reported line 60)May include surrounding context.

sh
load_config() {
    # 优先使用环境变量
    if [[ -z "$CHANGLAN_ACCOUNT" ]] || [[ -z "$CHANGLAN_PASSWORD" ]]; then
        # 尝试读取 .env 文件
        if [[ -f "$ENV_FILE" ]]; then
            source "$ENV_FILE"
        fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises and depends on shell-capable binaries (curl, jq, openssl) but does not declare an explicit tool/permission scope. That creates an avoidable trust gap: consumers and platforms cannot clearly constrain or review what execution capabilities the skill expects, increasing the chance of unintended command execution or overbroad runtime access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This skill sends phone numbers, template identifiers, and variable content to an external SMS provider, yet the documentation does not clearly warn that personal data and potentially sensitive message contents leave the local environment. Users may unknowingly transmit PII, OTPs, or business-sensitive data to a third party without considering privacy, consent, retention, or compliance requirements.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · send-sms.sh (reported line 134)May include surrounding context.

sh
fi

    # 调用 API
    local response=$(curl -s -m 30 -X POST "${CHANGLAN_API_URL}" \
        -H "Content-Type: application/json" \
        -d "${request_body}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script sends the recipient phone number, account identifier, and password in an HTTP POST request to a third-party SMS service. Although the script's purpose is to send SMS, there is no explicit warning, confirmation, or prior disclosure in the file that sensitive user data and credentials will be transmitted off-host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

All usage/help and error messaging in the script is hard-coded in Chinese, and the file provides no option to select another language or indicate that the script is intentionally limited to Chinese-speaking users. This is a natural-language policy concern because it enforces a specific locale without user choice or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest description and command metadata are written only in Chinese, which can impose a language constraint on users without any opt-in or documented justification. Under the policy rule, language or locale restrictions should either offer user choice or clearly state a justified region-specific scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.