ClawHub
Back to skill

Security audit

ssy-batchjob-async-job

Security checks for vulnerabilities and agentic risk

Overview

This skill does the BatchJob work it advertises, but it can automatically upload local files or URL-fetched content to a configured external service with too little user confirmation or destination validation.

Install only if you trust the BatchJob endpoint and token configuration and are comfortable with the agent automatically uploading selected or context-resolved files. Prefer using explicit file_id values or clearly chosen workspace files, avoid sensitive local paths, and require operator review before using this skill with private datasets, internal URLs, or broadly privileged agent runtimes.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:148
Finding

Unrestricted URL Retrieval Enables SSRF and Data Exfiltration

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:185
Finding

Automatic Upload of Arbitrary Readable Local Files Violates Least Privilege

Content
View full analysis
`, `/tmp/openclaw-media/...`. - if readable, upload. ``` ```bash FILE_PATH="/path/to/input.jsonl" FILE_NAME="$(basename "${FILE_PATH}")" test -f "${FILE_PATH}" || { echo "文件 ${FILE_PATH} 不存在"; exit 1; } FILE_CONTENT_B64="$(base64 < "${FILE_PATH}" | tr -d '\n')" curl -sS "${BATCHJOB_BASE_URL}/v1/batch/files:upload" \ -H "Authorization: Bearer ${BATCHJOB_BEARER_TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"filename\":\"${FILE_NAME}\",\"mode\":\"fast\",\"content\":\"${FILE_CONTENT_B64}\"}" ``` ### Technical Analysis The resolver accepts an explicit local path whenever it is readable and then automatically uploads its contents. No restriction confines access to a dedicated upload directory, the current workspace, or verified channel attachments. The only illustrated validation is `test -f`, which establishes that the target is a regular file but does not establish that: - The user is authorized to disclose it - The path belongs to the current task - The file is inside an approved directory - The path did not escape through a symbolic link - The file avoids known credential or configuration locations - Its size and actual format are appropriate for BatchJob - A path appearing in message context constitutes explicit upload consent The full-auto policy worsens the exposure by discouraging confirmation whene ...[truncated 1497 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:190
Finding

Unvalidated BatchJob Base URL Can Expose Bearer Tokens and Uploaded Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
- OpenAI Batch style lines containing `method` + `url` + `body` (for example `/v1/chat/completions` payload).
  - This schema will fail with Vertex error: `at least one contents field is required`.

## Dataset Output Rule (Important)

When user asks you to generate a template/demo file for BatchJob image tasks:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly directs the agent to resolve files from message/context, download them if needed, upload their contents, and proceed to precheck/submit in full-auto mode without requiring an explicit user confirmation at the point of data transmission. This creates a real risk of unintentionally sending sensitive local files, attachments, or URL-fetched content to an external BatchJob service without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The instruction to always run in full-auto mode and avoid asking the user first is a genuine unsafe-autonomy issue in a skill that can fetch files, upload them externally, and submit jobs. By reducing user checkpoints, it increases the chance of unintended external actions, privacy violations, and misuse of attached or local files.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
## Automation Policy (Default)

- Always run in full-auto mode.
- Do not ask user for `file_id` first.
- Resolve file source from current message/context, then upload automatically when needed.
- Ask follow-up questions only when no readable file source can be obtained.
- Accepted input file formats for upload: `jsonl`, `csv`, `xlsx`, `xls` (BatchJob normalizes to internal JSONL).

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill includes a fixed Chinese fallback prompt for user interaction, which imposes a specific language on users. There is no indication that the skill is region-specific or that the user can opt into Chinese versus another language.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code base64-encodes a local file and sends its full contents to an external endpoint using a bearer token. In the broader skill context, this transmission is dangerous because the skill is designed to automatically resolve local paths, attachments, and public URLs, so sensitive data could be exfiltrated to a third-party service with minimal user interaction.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md
test -f "${FILE_PATH}" || { echo "文件 ${FILE_PATH} 不存在"; exit 1; }
FILE_CONTENT_B64="$(base64 < "${FILE_PATH}" | tr -d '\n')"

curl -sS "${BATCHJOB_BASE_URL}/v1/batch/files:upload" \
  -H "Authorization: Bearer ${BATCHJOB_BEARER_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{\"filename\":\"${FILE_NAME}\",\"mode\":\"fast\",\"content\":\"${FILE_CONTENT_B64}\"}"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The short description is written only in Chinese, which indicates a language-specific presentation without any visible opt-in, alternative locale, or justification in this file. The policy requires flagging language or locale constraints when the skill appears to force a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:186