Security audit

assethub-claw

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate AssetHub purpose, but it needs Review because its helper handles credentials unsafely and exposes broad high-impact admin API actions.

Install only after reviewing the helper script and using a dedicated low-privilege AssetHub account. Prefer HTTPS endpoints, avoid prompt-supplied passwords being written to /tmp, do not run high-risk confirmation unless you have verified the exact endpoint and payload, and treat admin, backup, restore, user, role, service-token, and system-config operations as sensitive.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/assethub_api.sh:155
Finding: Bearer Tokens Can Be Disclosed to Arbitrary Network Destinations
Content: View full analysis
``` to the attacker-controlled server. 5. The attacker reuses the token against AssetHub until it expires or is revoked. ### Impact Assessment An attacker can obtain the current ...[truncated 448 chars]
Remediation: View remediation
&2 exit 1 fi ``` 2. Accept only relative API paths beginning with `/`. 3. Canonicalize the resulting URL and enforce an exact scheme, hostname, and port match with a trusted `ASSETHUB_API_URL`. 4. Maintain a strict endpoint allowlist where practical. 5. Never attach authorization headers across redirects. Add `--max-redirs 0`, or validate every redirect destination before following it. 6. Apply the same destination validation to both user JWTs and IoT tokens. 7. Add regression tests proving that absolute URLs, protocol-relative URLs, malformed URLs, and cross-origin redirects cannot receive credentials. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/assethub_api.sh:19
Finding: Plaintext Credentials and Tokens Are Stored in Predictable Shared Temporary Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/assethub_api.sh:538
Finding: Logout Does Not Delete the Plaintext Temporary Credential File
Content: View full analysis
{ try { fs.unlinkSync(p); } catch(e) {} }); " 2>/dev/null || true echo "✅ 已注销，所有登录信息已清除" ;; ``` The temporary credential file used elsewhere is: ```bash TEMP_SESSION_FILE="/tmp/assethub-claw-temp-session.json" ``` It is not included in the logout cleanup list. ### Technical Analysis The Skill documentation states that logout immediately deletes the session cache and all associated credentials. The implementation removes the configured session file and several hardcoded cache paths, but it does not remove `/tmp/assethub-claw-temp-session.json`. That omitted file is specifically intended to contain the user's plaintext username and password. It is also automatically consumed by later helper invocations. Logout can therefore report that all login data was removed while reusable credentials remain on disk. ### Attack Path 1. The Agent writes a username and password to: ```text /tmp/assethub-claw-temp-session.json ``` 2. The user invokes `logout`. 3. The helper deletes the JWT session file but leaves the temporary credential file intact. 4. A later helper invocation detects the remaining file and can automatically authenticate again. 5. A local attacker or subsequent process that can read the file obtains the plaintext credentials or causes unintended reauthentication. ### Impact Assessment The user's reusable AssetHub password remains available after logout. This defeats the expected security boundary of logout and may allow ind ...[truncated 266 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/assethub_api.sh:19
Finding: Credentials and Bearer Tokens May Be Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation
&2 exit 1 ;; esac ``` 8. Consider certificate pinning for high-assurance deployments. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/assethub_api.sh:599
Finding: Tenant Selection Argument Allows JavaScript Code Injection
Content: View full analysis
ents.length) { console.error('序号无效: ${idx}'); process.exit(1); } const selected = ents[n - 1]; s.tenant_id = selected.id; fs.writeFileSync(sessionFile, JSON.stringify(s, null, 2), 'utf8'); console.log('✅ 已切换到租户:', selected.tenant_name, '(ID:', selected.id + ')'); NODE ``` ### Technical Analysis The command-line value `idx` is interpolated directly into JavaScript source in two places. The heredoc delimiter is unquoted, so shell parameter expansion occurs before Node.js receives the program. No numeric validation is performed before interpolation. A value containing a single quote and JavaScript syntax can terminate the intended string literal and inject additional statements. Node.js executes the resulting source with the same operating-system privileges as the Skill process. This is a code-injection vulnerability rather than only malformed input because the attacker controls executable JavaScript source. ### Attack Path 1. A valid session file exists so that the `set-tenant` branch reaches the Node.js heredoc. 2. An attacker controls or influences the second command-line argument to `set-tenant`. 3. The attacker supplies a quote-breaking payload that closes the string passed to `parseInt`, inserts JavaScript, and comments out the remaining source as necessary. 4. Shell expansion embeds the payload into the heredoc. 5. Node.js executes the injected JavaScript. 6. The payload can invoke Node APIs such as `fs`, `child_process`, or networ ...[truncated 721 chars]
Remediation: View remediation
&2 exit 1 fi ``` 2. Never interpolate untrusted values into source code. 3. Pass the value through an environment variable: ```bash SESSION_FILE="$SESSION_FILE" TENANT_INDEX="$idx" node <<'NODE' const n = Number.parseInt(process.env.TENANT_INDEX, 10); NODE ``` 4. Quote the heredoc delimiter as `<<'NODE'` to disable shell expansion inside the JavaScript program. 5. Alternatively, pass the value as a positional Node argument and read it through `process.argv`. 6. Require strict integer conversion and reject trailing characters rather than relying only on `parseInt`. 7. Apply the same no-interpolation rule to every shell-to-JavaScript boundary in the helper. 8. Add security tests using quotes, newlines, template literals, command substitutions, and JavaScript statement separators. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (438)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Database backup, restore, and schema-altering operations are highly privileged and unrelated to normal asset management workflows. If exposed through an agent skill, they enable catastrophic integrity and availability impacts, including data destruction, rollback to stale states, or invasive schema changes across tenants.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose presents an end-user asset management skill, but the content also describes API catalog harvesting, snapshot generation, and developer-refresh behavior. This mismatch is dangerous because reviewers and users may grant trust or permissions appropriate for routine business actions while the skill also performs broader documentation and filesystem activities.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 388)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 389)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 393)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 396)May include surrounding context.
md
> - helper 脚本 `scripts/assethub_api.sh` 增量升级：

Static analysis

No suspicious patterns detected.