Skill Trend Analysis

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:00 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent read-only ClawHub skill trend analysis helper, but users should be aware it sends queries over an unencrypted HTTP API.

Install only if you are comfortable sending trend-analysis queries to skills.easytoken.cc. Avoid putting sensitive information in search terms or query parameters, and prefer HTTPS or a trusted network because the default HTTP endpoint can expose or allow tampering with API traffic.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/call_api.sh:4

Finding

Cleartext HTTP Used for API Communication

Content

View full analysis

Vulnerability Details

File Location: scripts/call_api.sh:4
Vulnerability Type: Cleartext transmission and unauthenticated API transport
Risk Level: Medium

Vulnerable Code

bash

BASE_URL="${BASE_URL:-http://skills.easytoken.cc/api}"

The same insecure endpoint is also documented and encouraged in:

• SKILL.md:22-23
• SKILL.md:37
• references/api-endpoints.md:3
• references/api-endpoints.md:36

Relevant documentation snippets include:

markdown

- Online site: `http://skills.easytoken.cc/`
- API prefix: `http://skills.easytoken.cc/api`

bash

BASE_URL="http://skills.easytoken.cc/api"

markdown

Base URL: `http://skills.easytoken.cc/api`

bash

curl -o /dev/null -s -w "%{http_code}\n" "http://skills.easytoken.cc/api/stats"

Technical Analysis

The executable script and all documented examples use unencrypted HTTP. HTTP does not provide transport confidentiality, server authentication, or response integrity. The script's curl --fail-with-body option only treats HTTP error responses as failures; it does not protect traffic against interception or modification.

A network-positioned attacker could perform a man-in-the-middle attack and modify API responses before they reach the Skill. Because the Skill is intended to interpret rankings, growth values, statistics, authors, tags, and search results, manipulated JSON could cause the Agent to produce false conclusions while appearing to rely on the legitimate service.

The endpoint and query string are also visible to passive observers. No credentials or authentication tokens are transmitted by the reviewed project, so the confirmed confidentiality exposure is limited to requested endpoints, search terms, date ranges, filters, and other query parameters.

Attack Path

1. A user or Agent invokes scripts/call_api.sh or runs one of the documented curl examples.
2. The client connects to skills.easytoken.cc through cleartext HTTP.
3. An attacker con ...[truncated 1048 chars]

Remediation

View remediation

Remediation Suggestions

1. Configure the service with a valid TLS certificate and expose the API exclusively through HTTPS.

2. Change the script default to:

   bash

   BASE_URL="${BASE_URL:-https://skills.easytoken.cc/api}"
   

3. Replace every http://skills.easytoken.cc reference in SKILL.md and references/api-endpoints.md with https://skills.easytoken.cc.

4. Redirect HTTP requests to HTTPS at the server, but do not rely on redirection as the client-side fix because the initial HTTP request remains interceptable.

5. Keep curl certificate verification enabled. Do not introduce -k or --insecure.

6. Consider validating BASE_URL and rejecting non-HTTPS values unless an explicit, documented development-only override is enabled.

7. If HTTPS cannot be provided, clearly state that responses are not authenticated or integrity-protected and must not be treated as authoritative.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs use of shell commands (curl, jq, and a local script) but does not declare any permissions or allowed-tools scope. This creates an authorization and review gap: an agent or platform may execute network-capable shell operations without explicit least-privilege boundaries, increasing the risk of unintended outbound requests, misuse of local scripts, or future prompt-injection abuse through shell access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and usage instructions are written entirely in Chinese, which implies a language-specific operating mode for the skill. There is no visible opt-in, alternative language option, or justification that this skill is intended only for a Chinese-speaking context, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document title, section headers, parameter notes, and debugging guidance are entirely in Chinese, which imposes a specific language on users. Under the policy, language/locale constraints should either be optional for the user or clearly documented as justified for a region-specific tool, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends requests to a configurable endpoint via BASE_URL and includes an arbitrary QUERY string in the outbound request, but provides no user warning or restriction on where data may be transmitted. In an agent-skill context, this can expose user-supplied search terms, filters, or other sensitive inputs to unintended third-party services if BASE_URL is overridden or the skill is repointed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.