ClawHub
Back to skill

Security audit

SkillHub.cn 技能上传操作指南

Security checks for vulnerabilities and agentic risk

Overview

This upload guide is mostly documentation, but it publishes live-looking IMA credentials and tells users to run unreviewed local code with those credentials.

Review before installing or following this guide. Do not reuse the embedded IMA credentials; treat them as compromised and rotate them if they belong to you. Replace the IMA examples with environment-provided secrets and an audited client, avoid loading modules from absolute local paths, prefer a pinned/project-local CLI install, and only send cross-session notifications after explicit user confirmation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:221
Finding

Plaintext API Credential Embedded in Published Documentation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 221-222, 238-239, and 250-251
Vulnerability Type: Hardcoded secret and plaintext sensitive configuration
Risk Level: High

Vulnerable Code

javascript
imaApi('openapi/note/v1/import_doc', {
  content_format: 1,
  title: 'SkillHub Upload Guide',
  content: body
}, {
  clientId: '66f4b780fc9d552fb2d6bb1a785fda3f',
  apiKey: '[REDACTED: PLAINTEXT API KEY PRESENT IN SOURCE]'
}).then(r => { console.log(r); });

The same Client ID and API key are also repeated in the append_doc example at lines 250-251.

Technical Analysis

SKILL.md contains a fixed Client ID and a long API credential directly in the published document and executable examples. Anyone who can download or inspect the skill can recover the original credential without authentication.

This directly contradicts the document's own requirement that publication packages must not contain real API keys. Replacing the file in a later release does not remove the credential from previously downloaded packages, caches, mirrors, or repository history.

The credential's present validity cannot be verified from the audited files. Nevertheless, publishing credential material in plaintext is an insecure coding and secret-management practice. If it remains active, it may permit unauthorized requests to the associated IMA API.

Attack Path

  1. An attacker downloads or views the published skill.
  2. The attacker opens SKILL.md and extracts the Client ID and API key from lines 221-222 or an executable example.
  3. The attacker identifies the API operations disclosed by the document, including openapi/note/v1/import_doc and openapi/note/v1/append_doc.
  4. The attacker submits requests using the exposed credentials.
  5. If the credentials remain valid and authorized, the API processes requests under the credential owner's identity.

Impact Assessment

The obtainable privilege ...[truncated 423 chars]

Remediation
View remediation

Remediation Suggestions

  1. Revoke the exposed API key immediately and issue a replacement with the minimum required permissions.
  2. Remove the Client ID and API key from the current package, repository history, release archives, mirrors, and cached documentation where possible.
  3. Read credentials from environment variables or an approved secret manager:
    javascript
    const clientId = process.env.IMA_CLIENT_ID;
const apiKey = process.env.IMA_API_KEY;

if (!clientId || !apiKey) {
  throw new Error('IMA credentials must be configured by the user');
}
  4. Use unmistakably nonfunctional placeholders in documentation, such as YOUR_IMA_CLIENT_ID and YOUR_IMA_API_KEY.
  5. Add automated secret scanning to the publication process and block releases when credential patterns are detected.
  6. Review API logs for use of the exposed credential and investigate requests originating from unexpected clients or locations.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:228
Finding

Execution of an Unreviewed External Module with Local File Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 228-241
Vulnerability Type: Execution outside the audited package and local-content transmission
Risk Level: High

Vulnerable Code

javascript
const { imaApi } = require('D:\\openclaw-data\\workspace\\skills\\skills\\ima-skills\\ima_api.cjs');
const fs = require('fs');
const content = fs.readFileSync('D:\\openclaw-data\\workspace\\skills\\skillhub-upload-guide\\SKILL.md', 'utf8');
const body = content.replace(/^---\n[\s\S]*?---\n/, '');

imaApi('openapi/note/v1/import_doc', {
  content_format: 1,
  title: 'SkillHub Upload Guide',
  content: body
}, {
  clientId: '66f4b780fc9d552fb2d6bb1a785fda3f',
  apiKey: '[REDACTED: PLAINTEXT API KEY PRESENT IN SOURCE]'
}).then(r => { console.log(r); });

Technical Analysis

The documented workflow imports ima_api.cjs from an absolute local path outside the audited project. That module is not included in the project, so its integrity, endpoint validation, request behavior, and side effects cannot be reviewed.

Node.js executes top-level module code immediately when require() is called. Consequently, a replaced or compromised ima_api.cjs receives the full permissions of the user running the command. The example also reads local Skill content and passes it to the external module for transmission.

No evidence in the audited files establishes that the external module is malicious. The vulnerability is the unchecked trust boundary: users are instructed to execute code that is outside the reviewed package and to provide it with local content and credentials.

Attack Path

  1. An attacker or another compromised process obtains write access to the referenced ima_api.cjs path or substitutes a file at that location.
  2. The user follows the archival instructions and runs the JavaScript example.
  3. Node.js loads the substituted module and executes its top-level code with the user's operating ...[truncated 770 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not instruct users to load modules from mutable absolute paths outside the reviewed package.
  2. Include the required client implementation in the package so that it can be audited, versioned, and integrity-checked.
  3. If an external dependency is necessary, pin an approved version and verify its cryptographic integrity before execution.
  4. Disclose the exact HTTPS destination, data fields, retention behavior, and authentication mechanism before requesting consent to transmit content.
  5. Require explicit user confirmation before reading or uploading any local file.
  6. Restrict file selection to the intended project directory and use canonical-path validation to prevent unintended file access.
  7. Run archival functionality in a sandbox with minimal filesystem and network permissions.
  8. Supply credentials through environment variables or a secret manager rather than embedding them in the request example.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:152
Finding

Unpinned Global Installation of a Third-Party CLI Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 152-155; duplicated in README.md, lines 28-31
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
npm install -g @astron-team/skillhub

skillhub login --token sk_your_token_here

The README repeats the installation command:

bash
npm install -g @astron-team/skillhub
skillhub login --token sk_xxx
skillhub publish ./my-skill --namespace my-team

Technical Analysis

The installation command omits a version constraint and therefore resolves to whichever package version is current when the user runs it. The -g option installs the package globally. npm packages may execute lifecycle scripts during installation, and the installed CLI subsequently receives a publication token.

The audited project does not provide a lockfile, integrity hash, source commit, or other mechanism for ensuring that users execute the same reviewed package version. A future compromised release, account takeover, or malicious dependency update could therefore change the effective code after this skill has been reviewed.

The audit found no evidence that the named package is currently malicious. The issue is the unpinned, globally installed supply-chain dependency.

Attack Path

  1. An attacker compromises the npm publisher account, the package itself, or one of its transitive dependencies.
  2. A malicious package version becomes the version selected by the unpinned installation command.
  3. A user follows the guide and runs npm install -g.
  4. Malicious installation code or CLI code executes with the user's npm permissions.
  5. When the user runs skillhub login, the compromised CLI can capture the supplied token and access files or network resources available to the process.

Impact Assessment

Potential impact includes arbitrary code execution under the installing user's account, theft of t ...[truncated 306 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a reviewed version, for example:
    bash
    npm install --save-dev @astron-team/skillhub@REVIEWED_VERSION
  2. Prefer a project-local installation over a global installation.
  3. Commit a lockfile and use deterministic installation commands such as npm ci.
  4. Verify the package's official publisher, source repository, provenance attestations, and integrity metadata.
  5. Review lifecycle scripts and consider disabling them during installation when they are not required:
    bash
    npm ci --ignore-scripts
  6. Run the CLI with a short-lived, least-privileged publication token.
  7. Keep authentication tokens out of shell history and revoke them promptly if the CLI environment may have been compromised.

other

Note
Location
SKILL.md:258
Finding

Fixed Cross-Session Agent Notification Without an Explicit Consent Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 258-266
Vulnerability Type: Cross-session communication
Risk Level: Low

Vulnerable Code

javascript
sessions_send({
  sessionKey: "agent:main:main",
  message: "[Publication completed]\n- Skill name: VALUE\n- Version: x.x.x\n- Skill URL: VALUE\n- IMA note ID: VALUE"
});

Technical Analysis

The workflow directs the executing agent to send publication metadata to a fixed session identifier. The notification is not necessary to prepare or upload the skill, and the instructions do not require confirmation from the user or the receiving session.

Fields such as the skill name, URL, and note identifier may originate from external publication results. Forwarding those values across session boundaries can disclose metadata and place untrusted text into another agent's context. The snippet does not demonstrate direct modification of the receiving session's safety constraints, so this is categorized as cross-session communication rather than confirmed instruction hijacking.

Attack Path

  1. A user or agent follows the full documented publication workflow.
  2. Publication-derived values are inserted into the notification message.
  3. sessions_send transmits the message to the fixed agent:main:main session.
  4. The receiving session obtains metadata and potentially attacker-controlled text without a documented validation or approval step.
  5. If the receiving agent treats the message as trusted instructions, the supplied text could influence later behavior, although that behavior is not established by the audited files.

Impact Assessment

Confirmed impact is limited to cross-session disclosure of the listed publication metadata and unsolicited insertion of content into the target session. The audited snippet does not itself grant operating-system privileges, establish persistence, or prove that the receiving agent will execute embedded in ...[truncated 11 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make notification optional and request explicit user approval before sending it.
  2. Allow the user to select or confirm the destination rather than hardcoding a session identifier.
  3. Treat all publication-derived values as untrusted data and encode them as plain metadata.
  4. Apply length limits and remove control characters or instruction-like framing from forwarded fields.
  5. Minimize the message to non-sensitive status information and omit internal note identifiers unless required.
  6. Ensure the receiving agent treats cross-session messages as untrusted context rather than authoritative instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Intent-Code Divergence

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

The guide explicitly instructs users never to upload real API keys, but later includes real credentials inline, directly violating its own security model. This contradiction makes the document more dangerous because readers may trust it as a security best-practice guide while unknowingly redistributing active secrets.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
3. 上传 `SKILL.md` + 核心代码文件（zip 打包）

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document embeds hardcoded IMA credentials and executable examples showing how to use them, even though the skill's stated purpose is only to guide SkillHub uploads. This exposes reusable secrets to anyone with access to the file and expands the blast radius from documentation leakage to unauthorized API use against the IMA service.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The markdown contains live-looking credentials together with copy-pastable code that tells readers exactly how to invoke the protected API. Providing both the secret and the usage pattern materially lowers the effort needed for abuse, credential replay, or accidental propagation into other systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document is written entirely in Chinese and presents the workflow as the default operating mode, with no indication that other languages are supported or that users can opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill file is entirely written as a Chinese-only operational guide and is branded specifically for SkillHub.cn, but it does not state that the locale is intentionally limited, region-specific, or optional for users. Under the policy, language or locale constraints should be justified or offered as a user choice rather than implicitly enforced.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:239