ClawHub
Back to skill

Security audit

digikala

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Digikala seller API helper that can change a live seller account, but its behavior is scoped, documented, and user-directed.

Install only if you intend to let an agent operate your Digikala seller account. Use the narrowest token scopes available, do not use real tokens with custom hosts or sandbox settings, review every product/title/image change before running it, and revoke the token if it is pasted into chat, logs, or a repository.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/endpoints.md (reported line 9)May include surrounding context.

md
background; the scripts in `scripts/` are the actual supported surface.

> **Credential note:** the endpoints under "Authentication" mint and revoke the
> seller access token. They are listed here for orientation only. Never call them
> from an agent session, and never use this skill to obtain a token.

## Authentication (5) — not called by this skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/endpoints.md (reported line 16)May include surrounding context.

md
background; the scripts in `scripts/` are the actual supported surface.

> **Credential note:** the endpoints under "Authentication" mint and revoke the
> seller access token. They are listed here for orientation only. Never call them
> from an agent session, and never use this skill to obtain a token.

## Authentication (5) — not called by this skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/endpoints.md (reported line 17)May include surrounding context.

md
background; the scripts in `scripts/` are the actual supported surface.

> **Credential note:** the endpoints under "Authentication" mint and revoke the
> seller access token. They are listed here for orientation only. Never call them
> from an agent session, and never use this skill to obtain a token.

## Authentication (5) — not called by this skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md
#
# CREDENTIAL CONTRACT
# -------------------
# The access token is a live seller credential. These scripts only ever *send* it
# to the Digikala API. They never print it, never write it to stdout, never place
# it in argv, and never read it from an undeclared location.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
#
# CREDENTIAL CONTRACT
# -------------------
# The access token is a live seller credential. These scripts only ever *send* it
# to the Digikala API. They never print it, never write it to stdout, never place
# it in argv, and never read it from an undeclared location.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
#
# CREDENTIAL CONTRACT
# -------------------
# The access token is a live seller credential. These scripts only ever *send* it
# to the Digikala API. They never print it, never write it to stdout, never place
# it in argv, and never read it from an undeclared location.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_common.sh (reported line 13)May include surrounding context.

sh
#
# CREDENTIAL CONTRACT
# -------------------
# The access token is a live seller credential. These scripts only ever *send* it
# to the Digikala API. They never print it, never write it to stdout, never place
# it in argv, and never read it from an undeclared location.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_common.sh (reported line 130)May include surrounding context.

sh
#
# CREDENTIAL CONTRACT
# -------------------
# The access token is a live seller credential. These scripts only ever *send* it
# to the Digikala API. They never print it, never write it to stdout, never place
# it in argv, and never read it from an undeclared location.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_common.sh (reported line 155)May include surrounding context.

sh
#
# CREDENTIAL CONTRACT
# -------------------
# The access token is a live seller credential. These scripts only ever *send* it
# to the Digikala API. They never print it, never write it to stdout, never place
# it in argv, and never read it from an undeclared location.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/_common.sh (reported line 167)May include surrounding context.

sh
# Holds the Authorization header for curl. Two properties matter here:
#
#   1. The token is never an argv element. A `-H "Authorization: ..."` flag is
#      readable by any local process via ps//proc/<pid>/cmdline. curl -K reads
#      the header from a file instead, so it never enters the process table.
#   2. The file lives in a private directory. mktemp -d creates it 0700 by
#      construction, so no follow-up chmod is needed and no other user can

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The script materializes the live bearer token into a temporary auth.conf file on disk. Although it uses mktemp -d and a private directory, writing secrets to disk increases exposure to local compromise, crash leftovers, backups, forensic recovery, or misconfigured temp locations; the risk is limited but real because this is a seller credential.

Content

Scanner excerpt · scripts/_common.sh (reported line 195)May include surrounding context.

sh
local token
    token="$(get_access_token)" || exit 1
    [[ -n "$token" ]] || die "Access token resolved to an empty value."

    _auth_dir="$(mktemp -d "${TMPDIR:-/tmp}/digikala-curl.XXXXXX")" || exit 1
    printf 'header = "Authorization: Bearer %s"\n' "$token" >"$_auth_dir/auth.conf"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/_common.sh (reported line 223)May include surrounding context.

sh
# api_request METHOD PATH [JSON_BODY] [CONTENT_TYPE] [QUERY_ARG...]
# QUERY_ARGs are raw "key=value" pairs passed to --data-urlencode, so values
# may contain spaces, Persian text, and characters like [ and ] that curl
# would otherwise read as URL globs.
#
# Validation lives here rather than in each caller so that no code path can

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/_common.sh (reported line 280)May include surrounding context.

sh
prepare_auth

    curl -sS -g -X POST -K "$_auth_dir/auth.conf" -F "${field_name}=@${file_path}" \
        "$BASE_URL$endpoint"
}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill advertises shell and network-driven behavior but does not declare enforceable tool scope in metadata. That mismatch weakens policy enforcement and increases the chance an agent can invoke broader capabilities than reviewers or runtime expect, especially given the skill handles live seller credentials and production API mutations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md
- **Scopes Required**: Each endpoint needs specific scope — check `/auth/scopes/{client_code}` for your app's permissions
- **Image URLs**: Temp images expire; use `use_temp_images: true` in product save to reference them
- **Commission Rates**: Vary by category; check `/product-creation/be-seller/{id}` before listing
- **Token Management**: Tokens are NOT stored by scripts, and no default token location is read. Provide via `DIGIKALA_ACCESS_TOKEN` or `DIGIKALA_TOKEN_FILE` (a path you choose; keep it `chmod 600` if you create one)
- **Non-Interactive Use**: Dangerous operations (`save-product`, `assign`, `brand-request`) prompt on a terminal but refuse when stdin is not interactive; set `DIGIKALA_CONFIRM=1` to confirm from scripts or agents. Only set that flag after reviewing the exact change with the user.
- **Full API Surface**: See `references/endpoints.md` for all 274 operations.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The header comment states these scripts 'never print' the live seller token and 'never write it to stdout'. However, get_access_token is explicitly documented and implemented to print the token on stdout for immediate use by the caller at L130-L141 and L150. This is an active contradiction in the file's own documentation about how credentials are handled.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 167)May include surrounding context.

sh
# Holds the Authorization header for curl. Two properties matter here:
#
#   1. The token is never an argv element. A `-H "Authorization: ..."` flag is
#      readable by any local process via ps//proc/<pid>/cmdline. curl -K reads
#      the header from a file instead, so it never enters the process table.
#   2. The file lives in a private directory. mktemp -d creates it 0700 by
#      construction, so no follow-up chmod is needed and no other user can