ClawHub
Back to skill

Security audit

Moark Text Moderations

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent text-moderation skill that sends user-provided text to Gitee AI, with manageable privacy and credential-handling cautions.

Install only if you are comfortable sending the text you moderate to Gitee AI. Prefer setting GITEEAI_API_KEY through a protected environment or secret manager instead of passing it with --api-key, avoid submitting secrets or sensitive personal data unless authorized, and pin the openai dependency in controlled environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/perform_text_moderation.py:4
Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: scripts/perform_text_moderation.py:4-6 and SKILL.md:18
Vulnerability Type: Unconstrained third-party dependency
Risk Level: Medium

Vulnerable code:

scripts/perform_text_moderation.py:4-6

python
# dependencies = [
#     "openai"
# ]

Related installation instruction in SKILL.md:18:

text
Ensure you have installed the required dependencies (`pip install openai`). Use the bundled script to perform text moderation.

Technical Analysis

The project declares and documents installation of the openai package without an exact version constraint or integrity hash. Consequently, the package version installed at a future point can differ from the version reviewed during this audit.

Package installation and import both place trust in externally distributed code. If a future package release or its distribution channel is compromised, the installer could retrieve attacker-controlled code. Ordinary upstream compatibility changes could also introduce unexpected behavior or break the moderation workflow.

This is a supply-chain weakness rather than evidence that the current openai package is malicious. Exploitation depends on compromise of the package, package repository, dependency resolution path, or an unsafe package source.

Attack Path

  1. An attacker compromises a future release, distribution account, package index, mirror, or dependency-resolution path associated with the unconstrained dependency.
  2. A user follows the documented pip install openai command or runs the script through a dependency-aware launcher.
  3. The package manager resolves and downloads the attacker-controlled version because no reviewed version or hash is enforced.
  4. Malicious installation or import-time code executes with the privileges of the user running the installation or script.
  5. The malicious dependency could access files, environment variables, API ...[truncated 479 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin openai to an exact, reviewed version in both the inline dependency metadata and installation documentation.
  2. Generate and commit a lockfile that records all transitive dependency versions.
  3. Enforce package integrity hashes, such as through pip install --require-hashes.
  4. Install packages only from an explicitly configured and trusted package index.
  5. Use automated dependency scanning and controlled upgrade reviews before changing pinned versions.
  6. Run installation and execution under a dedicated, least-privileged account without access to unrelated secrets or files.
  7. Keep the declaration and documentation synchronized so users do not bypass the locked installation process.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/perform_text_moderation.py:35
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/perform_text_moderation.py:35-37 and SKILL.md:21
Vulnerability Type: Sensitive credential accepted through process arguments
Risk Level: Medium

Vulnerable code:

scripts/perform_text_moderation.py:35-37

python
parser.add_argument(
    "--api-key", "-k",
    help="Gitee AI API key (overrides GITEEAI_API_KEY env var)"
)

Related usage instruction in SKILL.md:21:

bash
python {baseDir}/scripts/perform_text_moderation.py --text "User-specified input text" --api-key YOUR_API_KEY

Technical Analysis

The script accepts a Gitee AI API key as a command-line argument, and the documentation presents that mechanism as the primary usage example. Command-line arguments are not a suitable secret-transport mechanism because they may be recorded in shell history, process telemetry, job logs, terminal transcripts, crash reports, or automation metadata. Depending on operating-system policy, process arguments may also be visible to other local users while the process is running.

The script does not print the API key itself, and no hardcoded key was found. The exposure arises from how the credential is supplied to the process.

Attack Path

  1. A user follows the documented command and substitutes a real credential for YOUR_API_KEY.
  2. The shell records the command in history, or a monitoring system, process inspector, CI log, or terminal recorder captures the process arguments.
  3. A local user or another party with access to those records retrieves the exposed API key.
  4. The attacker submits requests to the Gitee AI service using the stolen credential.
  5. The credential remains usable until it expires or is revoked.

Impact Assessment

An attacker who obtains the key could exercise the API permissions and quota assigned to that credential. Potential consequences include unauthorized API consumption, financial or quota exhaustio ...[truncated 330 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key and -k command-line options.
  2. Use GITEEAI_API_KEY or a protected secret-management service as the supported noninteractive credential source.
  3. If interactive entry is required, use a non-echoing prompt such as Python's getpass.getpass.
  4. Update SKILL.md so examples never place real credentials in command-line arguments.
  5. Ensure CI/CD systems inject the credential through their protected secret facilities and redact it from logs.
  6. Apply least privilege, expiration, usage limits, and regular rotation to API keys.
  7. Revoke and replace any credential previously supplied through shell commands if command histories or logs may have retained it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/perform_text_moderation.py (reported line 23)May include surrounding context.

python
def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument, config, or environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GITEEAI_API_KEY")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill requires access to an environment variable containing an API key, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the skill's runtime capabilities less transparent to reviewers and users, increasing the risk of unintended secret access or execution behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow instructs the agent to send user-specified text to an external GITEE AI API, but the skill description does not clearly warn users that their input leaves the local environment. This creates a privacy and data-handling risk because users may provide sensitive, personal, or regulated content without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends user-supplied text to a third-party remote moderation API, but it does not provide an explicit privacy warning, consent check, or data-handling notice before transmission. This is risky because users may provide sensitive, personal, or regulated content assuming local processing, leading to unintended disclosure to the external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.