ClawHub
Back to skill

Security audit

Curl Tool

Security checks for vulnerabilities and agentic risk

Overview

This is a small curl-like HTTP client whose network, authentication, and file-download behavior is disclosed and purpose-aligned, but users should handle credentials and output paths carefully.

Install only if you need a curl-like helper. Use it only with trusted URLs, prefer HTTPS, avoid putting passwords or tokens directly in command lines when possible, and choose output paths carefully because -o writes response content to the specified file.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/curl.py:45
Finding

Basic Authentication Credentials Can Be Exposed Through Insecure Transport and Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/curl.py:45-52 and scripts/curl.py:93
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code

python
# Basic auth
if user:
    if ':' in user:
        username, password = user.split(':', 1)
    else:
        username, password = user, ''
    credentials = base64.b64encode(f'{username}:{password}'.encode()).decode()
    req.add_header('Authorization', f'Basic {credentials}')
python
parser.add_argument('-u', '--user', help='Basic auth (user:password)')

Technical Analysis

Base64 encoding is required by the HTTP Basic authentication scheme, but it does not encrypt credentials. Anyone who obtains the Authorization header can trivially recover the username and password.

Basic authentication is part of the Skill's documented functionality, and the code sends credentials only to the caller-selected destination. Therefore, this is not evidence of a covert exfiltration channel. However, the implementation permits Basic credentials to be sent to an unencrypted http:// URL without rejection or warning. On such connections, a network observer can capture and decode the Authorization header.

The password is also accepted directly through the --user user:password command-line argument. Depending on the operating environment, command-line values can be exposed through process listings, shell history, diagnostic logs, audit records, or Agent execution transcripts.

Attack Path

  1. A user invokes the Skill with credentials, for example:
    bash
    curl-tool -u victim:secret http://example.test/private
  2. The complete credential string may be retained in shell history, process metadata, logs, or an Agent transcript.
  3. The implementation Base64-encodes victim:secret and adds it to the HTTP Authorization header.
  4. Because the destination uses unencrypted HTTP, an attacker capa ...[truncated 1261 chars]
Remediation
View remediation

Remediation Suggestions

  1. Reject Basic authentication for non-HTTPS URLs by default:
    python
    parsed = urllib.parse.urlparse(url)
if user and parsed.scheme.lower() != 'https':
    raise ValueError('Basic authentication requires HTTPS')
  2. Apply the same HTTPS requirement when callers provide an Authorization header manually.
  3. If insecure transport must be supported for exceptional development scenarios, require an explicit option such as --allow-insecure-auth and display a prominent warning.
  4. Avoid accepting passwords directly on the command line. Accept only the username and retrieve the password with getpass.getpass(), or use a protected credential source such as a restricted file descriptor or operating-system secret store.
  5. Ensure credentials are never included in normal output, exception messages, debug logs, or saved response files.
  6. Document that HTTP Basic authentication is safe only when protected by properly validated TLS and that credentials should not be reused across services.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code implements a simple network request tool consistent with API testing and file downloading, including custom methods, headers, request bodies, JSON payloads, basic auth, and output-to-file behavior. However, the declared description explicitly claims support for HTTP, HTTPS, and FTP protocols, while the implementation is clearly focused on HTTP-style requests via urllib.request.Request and presents itself as a 'Simple HTTP client'. There is no explicit FTP-specific handling or functionality in the code chunk. Thus, the description overstates protocol support and does not accurately represent the implemented behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises and demonstrates network access and file output behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and makes it easier for an agent to invoke network, shell, or file-write capabilities without clear policy boundaries or user visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill encourages arbitrary outbound requests, custom headers, authentication, and file downloads, but it provides no warnings about sending sensitive data to remote endpoints or using credentials over the network. In agent contexts, that omission can lead users to disclose tokens, internal URLs, or confidential data without understanding the security implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
description: Transfer data using HTTP, HTTPS, FTP protocols. Test APIs and download files.
---

# Curl Tool - Data Transfer

Transfer data with HTTP/HTTPS/FTP. Supports custom headers and auth.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Quick Start

bash
curl-tool https://api.example.com/data

Features

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This example combines outbound network access with writing downloaded content to a local file, which can create security issues in agent environments if destinations and output paths are not constrained. Even in documentation, showing unrestricted downloads to arbitrary files normalizes behavior that could overwrite files or import untrusted content without caution.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Examples

bash
curl-tool https://api.example.com/users
curl-tool -X POST -d '{"name":"test"}' https://api.example.com
curl-tool -o out.txt https://example.com/file