ClawHub
Back to skill

Security audit

维表智联系统生成

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for building Dimens business systems, but it needs review because it can use credentials to change business data, permissions, and public views.

Install only if you intend to let an agent operate Dimens business projects through the CLI. Use least-privilege API keys, avoid pasting real secrets into chat or command history, review every create/update/delete/permission action before execution, and change public views to private or role-restricted unless you explicitly want broader access.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
references/auth-prerequisite.md:10
Finding

API Secret Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location:

  • references/auth-prerequisite.md:10-13
  • references/auth-prerequisite.md:52-55
  • references/auth-prerequisite.md:61-63
  • references/auth-prerequisite.md:131-134
  • references/auth-prerequisite.md:167-170
  • references/command-mapping.md:16-19

Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
dimens-cli auth api-key-login \
  --base-url https://dimens.bintelai.com/api \
  --api-key ak_xxx \
  --api-secret sk_xxx

This command pattern is repeatedly prescribed as the standard authentication method.

Technical Analysis

The documentation directs users and AI agents to supply an API key and API secret as command-line arguments. Secrets passed this way can be exposed through:

  • Shell history files.
  • Process-listing utilities while the command is running.
  • Terminal session recording.
  • CI/CD logs and command tracing.
  • Agent transcripts or diagnostic logs.
  • Parent-process telemetry and endpoint-monitoring products.

Although the examples use placeholders, users are expected to replace them with real credentials. The repeated recommendation makes accidental disclosure likely during normal use.

Attack Path

  1. A user or agent replaces ak_xxx and sk_xxx with valid credentials.
  2. The authentication command is executed in an interactive shell, automated job, or agent-controlled terminal.
  3. The command and its arguments are retained in shell history, logs, telemetry, or process metadata.
  4. A local user, compromised monitoring process, log reader, or CI operator retrieves the exposed secret.
  5. The attacker submits the recovered credentials to the documented authentication endpoint.
  6. The service returns a token associated with the account bound to the API credentials.
  7. The attacker accesses resources permitted to tha ...[truncated 745 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a secure interactive authentication mode that reads the API secret from a no-echo prompt.
  2. Support reading the secret from protected standard input, for example through a --api-secret-stdin option.
  3. Integrate with an operating-system credential store or secrets manager and reference credentials by identifier.
  4. Remove direct --api-secret VALUE examples from documentation.
  5. If environment-variable input is supported, document that environment variables may still be visible to privileged local processes and must not be printed or logged.
  6. Ensure the CLI redacts API keys, API secrets, tokens, and refresh tokens from errors, debug logs, telemetry, and agent output.
  7. Disable command echoing around authentication steps in automation.
  8. Recommend short-lived credentials, least-privilege service identities, rotation, revocation, and audit monitoring.
  9. Add automated tests verifying that secrets never appear in process output or logs.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/command-mapping.md:221
Finding

Public Table Views Are Created by Default Without an Access Review

Content
View full analysis

Vulnerability Details

File Location:

  • references/command-mapping.md:70-71
  • references/command-mapping.md:221-238
  • references/scenario-taxonomy.md:256-263

Vulnerability Type: Insecure default access-control configuration
Risk Level: Medium

Vulnerable Code

bash
dimens-cli view create \
  --team-id TEAM_ID \
  --project-id PROJECT_ID \
  --sheet-id SHEET_ID \
  --name 默认视图 \
  --type grid \
  --is-public true \
  --config '{"filters":[],"filterMatchType":"and","sortRule":null,"groupBy":[],"hiddenColumnIds":[],"rowHeight":"medium"}'

The surrounding instructions require a public default view when one does not already exist, without first requiring a data-classification or effective-permission review.

Technical Analysis

The use of --is-public true explicitly broadens the view's audience. Making this the default conflicts with least-privilege principles, particularly because the Skill is intended to create systems containing customer records, contracts, workflow information, financial values, personnel assignments, and other potentially sensitive business data.

The project does not define the precise platform-wide meaning of “public.” Therefore, this finding does not assume unauthenticated Internet exposure. However, regardless of whether “public” means project-wide, team-wide, link-accessible, or globally accessible, it represents broader visibility than a private or role-restricted default.

The configuration also contains no filters or hidden columns. Consequently, any access granted through the public view may expose every row and column available to that view unless another authorization layer independently restricts it.

Attack Path

  1. An agent creates a table for customer, contract, approval, personnel, or financial data.
  2. The agent follows the documented mandatory setup sequence.
  3. The agent creates a grid view with --is-public true ...[truncated 975 chars]
Remediation
View remediation

Remediation Suggestions

  1. Change the default to a private or role-restricted view.
  2. Require explicit user approval before setting --is-public true.
  3. Add a mandatory data-classification step covering personal, customer, financial, contractual, and workflow data.
  4. Verify project admission, table permissions, column restrictions, row policies, and resource permissions before publication.
  5. If broader access is necessary, expose only required columns and apply restrictive row filters.
  6. Create a separate sanitized public view rather than publishing the operational default view.
  7. Perform an effective-access test using representative low-privilege and external identities.
  8. Record who approved publication, its intended audience, and an expiration or review date.
  9. Re-run access checks after schema changes because newly added fields may otherwise become visible through an existing public view.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Line L025 requires generating Chinese plans, Markdown, JSON, and document files on Windows, which imposes a language constraint in the skill instructions. The file does not indicate that the user may choose another language or opt into Chinese, so this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document instructs users to authenticate with an API key and secret and shows the command format, but it does not explicitly warn users not to paste real credentials into chat, shared terminals, logs, screenshots, or documentation. In an agent-assisted workflow, that omission increases the chance of credential disclosure, especially because users may copy the example verbatim with live secrets into observable contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file title and the full operational guidance are written in Chinese, and the document does not state that language selection is optional or user-driven. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document shows API key and secret login examples without warning that these credentials are highly sensitive and should not be exposed in prompts, logs, screenshots, shell history, or generated artifacts. In an AI-assisted workflow, such examples can normalize plaintext credential handling and increase the risk of secret leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation includes destructive and access-changing operations such as document deletion, version restore, permission changes, and public view creation without requiring explicit confirmation or warning about their consequences. This increases the chance that an agent or operator will perform irreversible or visibility-expanding actions without adequate user awareness.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document instructs agents to create a public default view (--is-public true) as a normal part of system setup. In a system-building/orchestration skill, making data views public by default can unintentionally broaden access to business data and violates least-privilege unless the user explicitly requested public sharing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This section routes the skill into creating roles, assigning users, setting resource permissions, and defining row-level access policies. While permissions may be relevant in some builds, these are security-administration capabilities that go beyond a generic 'system-level solution decomposition and execution orchestration' description unless the manifest explicitly includes access-control administration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

SQP-3 applies to all file types and covers language/locale policy violations. This markdown file presents all instructions, examples, and templates only in Chinese, with no opt-in, alternative language guidance, or explanation that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill document is written in Chinese and provides no indication that language choice is optional or that the locale constraint is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrases for the project-audit scenario are very broad and map common requests like '看看当前项目里有什么' or '帮我梳理这个项目' directly into a path that reads real project resources after authentication. In an agent setting, this can cause over-broad invocation and unintended access to sensitive project structure, data, documents, or permissions when the user's intent was informal or underspecified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The new-project triggers are broad enough to match casual requests such as '帮我生成一个客户管理系统', yet this scenario leads to extensive authenticated actions including project creation, table setup, sample data insertion, permissions, reports, and workflows. If invoked too easily, the agent may perform large-scale side effects from a loosely phrased request, creating or modifying organizational assets without sufficiently narrow authorization or scope confirmation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The modification scenario includes ambiguous examples like '帮我修改这个表的数据' and '调整菜单目录', which can be interpreted from casual language and route the agent into real update operations. Because this skill explicitly supports authenticated writes to rows, fields, documents, reports, canvases, and permissions, over-broad matching creates a meaningful risk of unintended destructive or unauthorized changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The classification-routing examples are especially generic, such as '帮我处理一下这个项目' or '这个系统有点乱', and are designed to be the top-level entrypoint for subsequent execution. In context, that makes them risky because ambiguous everyday language can escalate into authenticated read or write workflows after routing, even when user intent and scope are not yet well defined.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The title and all routing instructions are written exclusively in Chinese, indicating a language-specific routing policy. There is no visible opt-in, fallback, or statement that other user languages are supported, which can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file presents the skill guidance entirely as a Chinese-language system decomposition guide, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains user-facing natural language entirely in Chinese, but it does not indicate that the skill is region-specific or provide any user opt-in for language/locale. Under the policy rule, forcing a specific language without choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

A file-scoped natural-language instruction set that implicitly fixes one language can violate language/locale policy when no opt-in or justification is provided. Here, all operational guidance and user reply templates are Chinese-only, with no indication that users may choose another language or that the scope is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

SQP-3 适用于所有文件。该文档从标题、说明到命令示例中的命名约定均固定为中文，没有提供用户可选语言或说明该技能仅面向中文使用场景，可能构成语言/locale 选择上的自然语言策略问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Phrases like “看看客户表里有哪些数据” and “列出所有角色权限” are common-language requests that could appear in many tools or discussions. The section does not include negative examples or constraints clarifying that these triggers are limited to querying actual dimens project resources.

Content

No source excerpt is available for this finding.