ClawHub
Back to skill

Security audit

Creator SKILL

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate influencer-search connector, but it deserves review because setup uses bearer tokens in command-line configuration and searches can spend team credits.

Review before installing. Use the shortest practical MCP token expiry, avoid exposing the token in shell history or screenshots, rotate it if it may have been exposed, and monitor team credit usage. Agents should confirm broad or large searches before running searchInfluencers.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/install.md:44
Finding

Bearer Token Exposure Through Command-Line Configuration

Content
View full analysis

Vulnerability Details

File Location: references/install.md, lines 44–55
Vulnerability Type: Bearer token disclosure through command arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
# Replace <MCP_JWT_TOKEN> with the token created in the previous section:
openclaw mcp set creator-skill '{
  "url": "https://deinai.ai/mcp",
  "transport": "streamable-http",
  "headers": {
    "Authorization": "Bearer <MCP_JWT_TOKEN>"
  },
  "connectionTimeoutMs": 180000,
  "timeoutMs": 180000
}'

Technical Analysis

The installation instructions direct users to substitute a real MCP bearer token directly into a shell command. The token therefore becomes part of the command-line argument passed to openclaw.

Depending on the operating system and shell configuration, the complete command may be retained in shell history and may be visible temporarily through process inspection. Shell quoting protects token characters from expansion but does not prevent the argument from being recorded or inspected.

The documented token lifetimes include 1year and forever at references/install.md:31–37, which can significantly extend the useful lifetime of a disclosed credential.

Attack Path

  1. A user creates an MCP token and replaces the placeholder with the real token.
  2. The user executes the documented openclaw mcp set command.
  3. The command, including the bearer token, is retained in shell history or observed through process metadata while it executes.
  4. A local attacker, another user with sufficient process-inspection access, or a diagnostic collection process obtains the command text.
  5. The attacker extracts the token and submits authenticated requests to https://deinai.ai/mcp.
  6. The attacker invokes available MCP operations, including paid influencer searches, until the token is disabled, expires, or available credits are exhausted.

Impact Assessm

...[truncated 557 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not require users to place bearer tokens directly in command-line arguments.
  • Add support for reading the token from protected standard input or an interactive secret prompt that disables terminal echo.
  • Prefer integration with an operating-system credential manager or OpenClaw-supported secret store.
  • If environment-variable configuration is unavoidable, document its residual exposure risks and ensure the token is not persisted in shell startup files or logs.
  • Recommend short-lived MCP tokens by default rather than one-year or non-expiring tokens.
  • Ensure stored configuration files have owner-only permissions and that logs redact Authorization headers.
  • Document a rotation procedure: disable the exposed token through the Deinai token-management endpoint, create a replacement, and securely update the OpenClaw configuration.
  • Advise users to remove any previously entered token-bearing commands from shell history and relevant diagnostic artifacts.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/install.md (reported line 22)May include surrounding context.

MCP Token 与普通登录 JWT 不同（payload 含 type: "mcp"）。

  1. 用户登录 https://deinai.ai，取得 用户 access token（常规 API 鉴权）。
  2. 创建 MCP Token：
http

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file presents all operational guidance in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific. That can violate language/locale policy by forcing a specific language on users without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation describes a billable search operation and notes that charges are based on the number of returned influencers, but it does not clearly warn the user or agent at invocation time that executing the tool will spend credits. In an agent setting, this can lead to unintended paid actions, especially if the agent automatically performs searches from natural-language requests without explicit user confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing instructions only in Chinese, and it does not provide an opt-in language choice or explain that the skill is intended solely for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
62% confidence
Finding

The natural-language documentation exposes a language filter using ISO language codes, but does not indicate that language selection should be based on user preference or explicit request. This can create a policy concern if agents apply language constraints by default rather than with user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.