T09 · Insecure Skill Coding Practices
- Location
SKILL.md:102- Finding
Plaintext ClawHub Token Solicitation in Conversation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:102
Vulnerability Type: Plaintext sensitive credential exposure
Risk Level: MediumVulnerable Code Snippet:
markdown > "✅ **技能已构建完成！** 请检查以上内容： > - 如果满意，我可以将它安装到你的 workspace 立即使用 > - 如果需要调整，告诉我具体哪里改 > - 如果你想发布到 ClawHub，告诉我你的 token"Technical Analysis
The Skill explicitly asks the user to provide a ClawHub token through the conversational interface. Authentication tokens are bearer credentials and should not be transmitted through ordinary chat messages because such messages may be retained in conversation history, application logs, observability systems, model context, or debugging records.
The instruction does not define a secure secret-entry mechanism, token redaction, minimum required scopes, storage restrictions, or credential deletion after use. Although the audited project contains no code that automatically transmits the token elsewhere, requesting it in plaintext unnecessarily places a sensitive credential in Agent-visible and potentially logged context.
Attack Path
- A user invokes the Skill to create a new Skill package.
- After construction, the Skill offers to publish the package to ClawHub.
- Following the instruction at
SKILL.md:102, the user enters a ClawHub token directly into the conversation. - The token becomes part of the Agent context and may also be retained by chat history, telemetry, logs, or debugging infrastructure.
- An unauthorized party with access to any retained copy could extract the token.
- The party could authenticate to ClawHub and perform any operation authorized by the token until it expires or is revoked.
Impact Assessment
The obtainable privileges are limited to those granted to the disclosed ClawHub token. Depending on its scopes, exposure could permit unauthorized publication, modification, replacement, or removal of Skill packages and access to associated account or repositor ...[truncated 370 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction asking users to disclose tokens in conversation.
- Require credentials to be supplied through a dedicated secret manager, protected credential prompt, or environment variable such as
CLAWHUB_TOKEN. - Instruct the Agent to reference only the variable or secret identifier and never print, repeat, persist, or summarize its value.
- Use narrowly scoped, short-lived publication tokens rather than broad account credentials.
- Obtain explicit user confirmation immediately before publishing without displaying the credential.
- Ensure application logging and telemetry redact authorization headers, token-shaped values, environment variables, and secret-manager responses.
- Clear temporary authentication state after publication and provide token revocation and rotation guidance if accidental disclosure occurs.
- Prefer an authorization flow in which the user authenticates directly with ClawHub and the Agent receives only a constrained, ephemeral capability.