Security audit

ClawHub 全新技能发布攻略

Security checks for vulnerabilities and agentic risk

Overview

This skill is a publishing guide, but it exposes apparent live IMA credentials and recommends broad publishing commands that could affect more than the intended skill.

Do not install or reuse this guide as-is. Treat the exposed IMA key as compromised, rotate it, replace all credentials with placeholders or environment-variable references, and avoid `sync --all` from a shared skills directory unless the dry-run manifest has been reviewed and the directory contains only intended release artifacts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:191
Finding: Hard-Coded IMA API Credentials Exposed in a Distributable Skill
Content: View full analysis
', content: '## New section\n\nContent...' }, { clientId: '66f4b780fc9d552fb2d6bb1a785fda3f', apiKey: '[REDACTED EXPOSED API KEY]' }); ``` The API key is redacted in this report to avoid further disclosure. The unredacted value is present in the audited file at lines 192, 206, and 221. ### Technical Analysis A reusable IMA API credential is stored directly in a Markdown file intended to be included in a publicly distributable Skill package. It is also embedded in copy-and-paste executable JavaScript examples. Anyone who obtains the package can extract the credential without requiring local system access. This violates secret-management and least-exposure principles and directly contradicts the document's own guidance that publishing packages must not contain real API keys. Removing the secret only from a later revision is insufficient because previous package versions, caches, mirrors, logs, and local clones may retain it. The credential must therefore be treated as compromised. Its current validity was not tested during this audit. ### Attack Path 1. An attacker downloads or otherwise obtains the published Skill package. 2. The attacker opens `SKILL.md` and extracts the plaintext client identifier and API key. 3. The attacker reproduces the documented `imaApi` requests or constructs equivale ...[truncated 1066 chars]
Remediation: View remediation
', apiKey: '' } ``` 7. Add automated secret scanning to local pre-commit checks and the publishing pipeline. 8. Configure the replacement credential with the minimum required API permissions, a limited lifetime where supported, and rotation procedures. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:34
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation
``` 2. Document the expected official registry and verify package ownership before installation. 3. Prefer a project-local development dependency with a lockfile where practical. 4. Use npm provenance and integrity verification mechanisms supported by the release workflow. 5. Review package lifecycle scripts and the dependency tree before approving version updates. 6. Perform installation under a non-administrative account and avoid elevated privileges. 7. Establish an explicit update process so new versions are reviewed and tested before the documentation changes its pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:145
Finding: Bulk Synchronization Can Publish Unrelated or Sensitive Skill Directories
Content: View full analysis
Remediation: View remediation
\ --slug \ --name "" \ --version \ --changelog "" ``` 2. If synchronization is required, run it from an isolated staging directory containing only the intended release package. 3. Make a dry run mandatory in every workflow, including the README quick-start path. 4. Require explicit human review of the dry-run manifest before publishing. 5. Run automated secret scanning, path scanning, and allowlist checks against the exact release directory. 6. Fail the release if unexpected files or additional Skill packages are detected. 7. Build publishing artifacts in a clean temporary staging area instead of publishing directly from a long-lived shared workspace. 8. Document a recovery process covering package removal, credential rotation, and incident review if unintended content is published. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document explicitly embeds a real-looking ClientID and API key while simultaneously instructing users to keep publish packages free of secrets. Even if presented as an example, hardcoded credentials in a public skill guide can be copied, abused to access the IMA service, or normalized into unsafe operator behavior, directly contradicting the stated security model.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This guide includes what appears to be usable IMA credentials in plaintext and provides ready-to-run example calls that consume them. In the context of a publishing/distribution guide, that makes the issue more dangerous because readers are encouraged to reuse the values directly, increasing the likelihood of credential compromise and unauthorized note operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title and instructional content present the skill guidance entirely in Chinese, and the document does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:206