T09 · Insecure Skill Coding Practices
Error
- Location
fetch.sh:43- Finding
Hard-Coded Administrative API Token in Executable Script
- Content
View full analysis
- Remediation
View remediation
Security audit
只需要发律动文章链接，帮你抓取并保存到 ChainThink 后台
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated import-and-save purpose, but it includes an embedded ChainThink admin token and can upload loosely validated web content without clear user control.
Review before installing. The publisher should remove and revoke the embedded JWT, require a secure user-provided token, enforce an exact BlockBeats URL allowlist, sanitize or preview imported HTML, and ask for confirmation before creating a ChainThink draft.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
fetch.sh:7- Finding
Insufficient URL Validation Enables Arbitrary Navigation and Untrusted HTML Import
- Content
View full analysis
" echo "示例: $0 https://www.theblockbeats.info/news/61465" exit 1 fi # 提取文章ID ARTICLE_ID=$(echo "$ARTICLE_URL" | grep -oE '[0-9]+$') if [[ -z "$ARTICLE_ID" ]]; then echo "错误: 无法从URL提取文章ID" exit 1 fi ``` The unvalidated URL is opened directly, and page-controlled values are extracted: ```bash # 使用浏览器提取文章内容 ARTICLE_DATA=$(openclaw browser --action=act --kind=evaluate \ --url="$ARTICLE_URL" \ --fn='() => { const data = window.__NUXT__.data[0]; return { title: data.info.title, abstract: data.info.abstract, content: data.info.content }; }' 2>/dev/null | jq -r '.result') TITLE=$(echo "$ARTICLE_DATA" | jq -r '.title') ABSTRACT=$(echo "$ARTICLE_DATA" | jq -r '.abstract') CONTENT=$(echo "$ARTICLE_DATA" | jq -r '.content') ``` The extracted HTML is placed directly into the publishing payload: ```bash # 构建 JSON payload PAYLOAD=$(jq -n \ --arg title "$TITLE" \ --arg text "$CONTENT" \ --arg abstract "$ABSTRACT" \ '{ "id": "0", "info": {}, "is_translate": true, "translation": { "zh-CN": { "title": $title, "text": $text, "abstract": $abstract } }, "type": 5, "admin_detail": {}, "strong_content_tags": {}, "chain_is_calendar": false, "chain_calendar_time": 0, "chain_calendar_tendency": 0, "is_push_bian": 2, "content_pin_top": 0, "is_public": false, "user_id": "3", "chain_fixed_publish_time": 0, "as_user_id": "3", "is_chain": true, "chain_airdrop_time": 0, "chain_airdrop_time_end": 0 }') ``` The resulting content i ...[truncated 3364 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script embeds a live-looking JWT token directly in source code while claiming it is read from TOOLS.md, which is a strong secret-handling failure. Anyone with access to the script can reuse the token to call the ChainThink API as the associated user, potentially creating, modifying, or abusing content until the token is revoked or expires.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs the agent to retrieve an authentication token from TOOLS.md, which expands the skill's access to stored secrets. While a token is needed to call the destination admin API, directing the agent to read credentials from another file creates a secret-access pattern that can be abused or reused beyond the narrow article-import task.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill tells users to store and use an API token but does not include adequate handling guidance for sensitive credentials. This increases the chance that users place long-lived admin tokens into ordinary markdown files, where they may be exposed to other tools, logs, or unintended readers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill instructs the agent to send scraped article content together with authentication headers to an external admin API, but it does not clearly warn the user that a network transmission to a third-party service will occur. Even if the operation is the intended function, the lack of explicit disclosure reduces informed consent around external data transfer and credential use.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
The skill performs an authenticated external transmission to an admin API, including article data and sensitive headers. External transmission is central to the skill's purpose, so this is not malicious on its face, but it remains security-relevant because it moves data and credentials off-tool and into a remote service with elevated publishing capabilities.
- Content
调用 API：
bash curl 'https://api-v2.chainthink.cn/ccs/v1/admin/content/publish' \ -H 'Content-Type: application/json' \ -H 'X-App-Id: 101' \ -H 'x-token: <从TOOLS.md读取>' \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically sends fetched article title, abstract, and content to a remote API without an explicit confirmation step or clear warning at the point of transmission. In an agent skill context, this increases the risk of unintended data exfiltration, especially if the fetched page contains sensitive, proprietary, or unexpectedly private content.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The curl call transmits collected article data and associated authentication headers to an external service, creating a clear outbound data path. In this skill, the danger is elevated because the transmission is coupled with a hardcoded token and automated publishing behavior, which can enable unauthorized or opaque content submission.
- Content
sh }') # 调用 ChainThink API RESPONSE=$(curl -s 'https://api-v2.chainthink.cn/ccs/v1/admin/content/publish' \ -H 'Content-Type: application/json' \ -H 'X-App-Id: 101' \ -H "x-token: $TOKEN" \
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file presents all user-facing instructions in Chinese, and the payload later hard-codes the translation locale as zh-CN. There is no indication that users may opt into another language or that the locale restriction is a documented, justified regional requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The request body stores content only under the zh-CN locale. This is a natural-language/locale constraint that may violate organizational language-choice policy when users are not given a choice and no region-specific justification is stated.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Comments and terminal output throughout the script are in Chinese, including usage and status messages, with no option for another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in or a documented regional constraint.
- Content