ClawHub
Back to skill

Security audit

Library

Security checks for vulnerabilities and agentic risk

Overview

The skill’s library-management behavior mostly matches its purpose, but its setup asks users to paste and persist a read/write account token in unsafe ways.

Review before installing. Use this only if you are comfortable giving the skill read/write access to your SansFiction library. Do not paste the token into chat; configure it through a protected secret or environment variable if available, and prefer a scoped, revocable token. Check the reminder timezone before enabling daily check-ins.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:16
Finding

Read/Write API Token Collected Through Chat and Stored in Plaintext Configuration

Content
View full analysis
"` - (this maps to env var `SANSFICTION_TOKEN`) - Or set: - `skills.entries.sansfiction-library.env.SANSFICTION_TOKEN: ""` If you can’t edit config automatically, give the user the exact snippet to paste. ``` ### Technical Analysis The setup procedure explicitly instructs the agent to ask the user to paste a read/write bearer token into the conversation. This contradicts the skill's own rule not to write the token into chat logs. A token supplied as a chat message may be retained in conversation history, agent state, telemetry, backups, exports, or other logging systems. The skill also recommends persisting the token directly in `~/.openclaw/openclaw.json`. No requirement is provided for restrictive file permissions, encryption at rest, a dedicated secret-management facility, token scoping, or token expiration. Consequently, any process or user able to read the conversation records or configuration file may recover the credential. Because the token is transmitted as a bearer credential, possession is sufficient to authenticate to the SansFiction MCP endpoint. No additional proof of identity is described. ### Attack Path 1. The `SANSFICTION_TOKEN` environment variable is absent. 2. The skill follows its setup procedure and asks the user to paste a personal token into the chat. 3. The user's token is retained in chat history, logs, telemetry, backups, or exported conversation data. 4. Alternatively, the tok ...[truncated 1074 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill tells the user to paste a personal token directly into chat, but provides no prominent warning that chat content may be retained, surfaced in history, or exposed to logs and downstream systems. Requesting credentials through the conversational channel materially raises the risk of accidental secret disclosure and token theft.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 17)May include surrounding context.

md
## Hard rules
- **Never ask for or store passwords.** Use a SansFiction token only.
- **Never echo the token back** to the user or write it into chat logs.
- **No side effects without confirmation** when the target book is ambiguous (multiple matches).

---

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 18)May include surrounding context.

md
## Hard rules
- **Never ask for or store passwords.** Use a SansFiction token only.
- **Never echo the token back** to the user or write it into chat logs.
- **No side effects without confirmation** when the target book is ambiguous (multiple matches).

---

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to persist a personal access token into local configuration, creating long-lived credential storage beyond what is necessary to complete a single library-management request. This increases the blast radius of compromise from session exposure to durable local secret retention, especially on shared machines or in environments where config files may be backed up, logged, or read by other tools.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 51)May include surrounding context.

1) List available tools (discover exact tool names)

bash
curl -s https://sansfiction.com/api/mcp \
  -H "Authorization: Bearer $SANSFICTION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill hardcodes the reminder timezone to Europe/Warsaw without asking the user, which can cause reminders to fire at unintended times and may reveal incorrect assumptions about the user's locale. While not a direct security breach, forced locale settings can create privacy and operational issues, especially for scheduled automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.