ClawHub
Back to skill

Security audit

Knowledge Chat

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate knowledge-base chat connector, but it needs review because it can send prompts, files, images, and API keys to external or configurable endpoints with limited safeguards.

Install only if you trust the configured knowledge-base and AI endpoints. Do not send confidential documents, screenshots, chat history, or API keys unless your organization approves that data transfer. Prefer HTTPS-only endpoints, scoped credentials from a secret manager or environment variable, pinned dependencies, and a reviewed deployment that actually implements the advertised upload, login, and data-handling controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/kb_connector.py:18
Finding

Bearer credentials can be transmitted to arbitrary or plaintext endpoints

Content
View full analysis

Vulnerability Details

File Location: scripts/kb_connector.py:18-33, scripts/kb_connector.py:55-59, and scripts/kb_connector.py:87-91
Vulnerability Type: Unrestricted credential transmission
Risk Level: Medium

Vulnerable Code

python
def __init__(self, base_url: str, api_key: Optional[str] = None):
    """
    Initialize the knowledge base connector
    
    Args:
        base_url: The base URL of the knowledge base API
        api_key: Optional API key for authentication
    """
    self.base_url = base_url.rstrip('/')
    self.headers = {
        'Content-Type': 'application/json'
    }
    if api_key:
        self.headers['Authorization'] = f'Bearer {api_key}'

def health_check(self) -> bool:
    """Check if the knowledge base API is accessible"""
    try:
        response = requests.get(f"{self.base_url}/health", headers=self.headers)
        return response.status_code == 200
    except Exception:
        return False

The same authorization headers are used for search and chat requests:

python
response = requests.post(
    f"{self.base_url}/api/search", 
    headers=self.headers, 
    json=search_payload
)
python
response = requests.post(
    f"{self.base_url}/api/chat", 
    headers=self.headers, 
    json=chat_payload
)

Technical Analysis

The caller controls base_url, and the script does not validate its scheme, hostname, port, or resolved network destination. When an API key is provided, the script places it in a reusable Authorization header and sends that header to every endpoint, including the health-check endpoint.

Consequently, the connector permits bearer credentials to be transmitted over plaintext HTTP or to an attacker-controlled host. The health check also sends authentication material even though many health endpoints do not require authentication. No request timeout or explicit redirect policy i ...[truncated 1414 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require https:// for all authenticated endpoints and reject plaintext HTTP when an API key is configured.
  2. Parse URLs with urllib.parse and reject user-info, unsupported schemes, unexpected ports, fragments, and malformed hostnames.
  3. Support an explicit hostname allowlist for deployments that use known knowledge-base services.
  4. Do not send authorization headers to health endpoints unless authentication is explicitly required.
  5. Disable automatic redirects or validate every redirect destination before forwarding credentials.
  6. Add finite connection and response timeouts, for example:
    python
    requests.post(url, headers=headers, json=payload, timeout=(5, 30), allow_redirects=False)
  7. Document that API credentials must only be used with trusted endpoints.
  8. Where practical, use separate, narrowly scoped credentials for search and chat operations.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/kb_connector.py:102
Finding

API keys are accepted through command-line arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/kb_connector.py:102-107 and scripts/kb_connector.py:111
Vulnerability Type: Local credential exposure
Risk Level: Medium

Vulnerable Code

python
parser = argparse.ArgumentParser(description="Knowledge Base Connector")
parser.add_argument("--url", required=True, help="Knowledge base API URL")
parser.add_argument("--api-key", help="API key for authentication")
parser.add_argument("--action", choices=["health", "search", "chat"], required=True, 
                   help="Action to perform")
parser.add_argument("--query", help="Search query")
parser.add_argument("--message", help="Chat message")
parser.add_argument("--top-k", type=int, default=5, help="Number of search results")

The supplied value is subsequently passed into the connector:

python
kb = KnowledgeBaseConnector(args.url, args.api_key)

Technical Analysis

Secrets passed as command-line arguments can be retained in shell history and may be visible in process listings, process-monitoring utilities, audit logs, job definitions, terminal recordings, or diagnostic reports. The script explicitly encourages this handling pattern by exposing --api-key as the authentication interface.

This is avoidable because the credential can be read from a protected environment variable, secret file, operating-system credential store, or interactive prompt without appearing in the command line.

Attack Path

  1. A victim invokes the connector with --api-key VALID_SECRET.
  2. The complete command is stored in shell history or remains visible in the process argument list while the script is running.
  3. Another local user, monitoring process, CI log collector, or support bundle obtains the argument.
  4. The observer extracts the API key.
  5. The observer authenticates to the corresponding remote API with the victim's token.

Exploitation requires access to command history, process ...[truncated 481 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove or deprecate the --api-key command-line option.
  2. Read the key from a protected environment variable such as KNOWLEDGE_BASE_API_KEY.
  3. Prefer an operating-system secret store or deployment-platform secret manager for production use.
  4. If interactive use is required, obtain the secret with getpass.getpass() so it is not echoed or stored in shell history.
  5. If file-based secrets are supported, require restrictive permissions and reject files accessible to other users.
  6. Ensure logs and exception messages never include authorization headers or secret values.
  7. Rotate credentials that have previously been supplied on command lines or captured in CI logs.

T08 · Insecure Dependencies

Warning
Location
scripts/setup.sh:15
Finding

Setup script installs unpinned npm dependencies

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh:15-17
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
# 安装依赖
echo "📦 安装依赖..."
npm install react-markdown remark-gfm --save

Technical Analysis

The setup script installs packages without fixed versions and without using a committed lockfile through npm ci. The effective dependency graph can therefore change between installations without any modification to the audited Skill.

npm installation can also execute lifecycle scripts from resolved packages and transitive dependencies. Although no evidence shows that the named packages are malicious, resolving mutable package versions at setup time creates an avoidable supply-chain risk and prevents reproducible review of the code that will be installed.

The command also modifies the current project's dependency manifest, meaning its effect depends on the directory from which the setup script is executed.

Attack Path

  1. A user or automation process runs scripts/setup.sh.
  2. npm resolves the current releases and transitive dependencies from the configured registry.
  3. A compromised package release, registry response, maintainer account, or transitive dependency is selected.
  4. npm downloads the altered package and may execute its installation lifecycle scripts.
  5. Malicious code runs with the permissions of the user executing the setup script or is incorporated into the deployed application.

This attack path depends on compromise or malicious modification of the external dependency supply chain; the audited repository does not itself contain evidence that either named package is currently malicious.

Impact Assessment

A malicious dependency or lifecycle script could access files, environment variables, API credentials, source code, and network resources available to the installing user. It could also modify the host p ...[truncated 146 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin reviewed package versions explicitly.
  2. Generate and commit a lockfile after reviewing the complete resolved dependency graph.
  3. Use npm ci during automated installation to enforce the lockfile rather than resolving new versions.
  4. Run npm audit and an appropriate software-composition analysis tool against the locked graph.
  5. Review package provenance, maintainers, release history, and transitive dependencies before upgrades.
  6. Consider npm ci --ignore-scripts where package lifecycle scripts are not required.
  7. Run dependency installation as an unprivileged user in an isolated build environment with minimal secret access.
  8. Verify that the setup script runs only from the intended project directory.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description significantly overstates the implemented functionality. The code does provide text chat via an external LLM API, multimodal image input, and a very basic local knowledge search. However, core advertised capabilities such as semantic search, vector index building, contextual multi-turn dialogue handling, document/attachment parsing, progress indication, Markdown rendering, and follow-up recommendation are absent. This is a material description-to-behavior mismatch rather than a minor implementation omission.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The code does partially align with the declared purpose in that it connects to an external knowledge base, supports search, and supports chat with optional conversation history. However, the description claims several substantial capabilities that are not implemented in this code chunk: image/attachment understanding, progress/thinking indicators, Markdown rendering, follow-up suggestions, and vector index building. The actual code is narrowly a command-line HTTP client for health, search, and chat endpoints. This is a material description-behavior mismatch because the declared functionality is significantly broader than what the code actually provides.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation criteria are broad enough to match many ordinary user requests related to chat, search, or information retrieval, which can cause the skill to trigger outside its intended scope. In a skill that connects to external knowledge bases and supports contextual conversations, overbroad activation increases the chance of unintended data access, unnecessary external calls, or unsafe delegation to the skill when a more constrained path should be used.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises capabilities that imply network access and file reading, but it does not declare any explicit tool scope or permissions boundary. This creates a least-privilege and transparency problem: reviewers and users cannot easily determine what external access the skill requires, increasing the chance of overbroad execution or unsafe deployment defaults.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill supports file uploads, chat interactions, and external AI/knowledge API integration, yet the documentation does not warn users that uploaded content and prompts may be transmitted to third-party services. This is a real privacy and data-governance risk because users may submit sensitive documents or internal knowledge without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language UI text specifies the assistant prompt as "小新正在思考中...", and the document consistently presents the skill as a Chinese-language assistant without indicating that users can choose another language. Under the locale policy, forcing a specific language without opt-in is a policy concern unless the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This request transmits user-supplied query data and embedded knowledge context to an external network endpoint. External transmission is expected for an API connector, but in this skill context it is still security-relevant because the data may include sensitive internal knowledge and there are no guardrails such as consent, minimization, endpoint allowlisting, or error handling around unexpected destinations.

Content

Scanner excerpt · references/kb_connector.py (reported line 30)May include surrounding context.

python
{"role": "user", "content": query}
        ]
        
        response = requests.post(
            f"{self.endpoint}/services/aigc/text-generation/generation",
            headers={
                "Content-Type": "application/json",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The chat method sends both the user query and optional knowledge_context to an external model API, but the code provides no user-facing notice, consent mechanism, or safeguards around what may be included in knowledge_context. In a knowledge-base assistant, that context may contain proprietary documents, internal notes, or regulated data, making silent exfiltration to a remote provider a meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This outbound request sends full image-derived content to a remote multimodal API. In the context of a knowledge assistant that encourages image and attachment understanding, this increases the risk of transmitting sensitive screenshots, IDs, diagrams, or embedded secrets to a third party without sufficient transparency or control.

Content

Scanner excerpt · references/kb_connector.py (reported line 72)May include surrounding context.

python
]}
        ]
        
        response = requests.post(
            f"{self.endpoint}/services/aigc/multimodal-generation/generation",
            headers={
                "Content-Type": "application/json",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function reads a local image file, base64-encodes it, and sends the full image content to a third-party API without any built-in consent flow, warning, or data classification checks. This can expose sensitive screenshots, documents, or personal data embedded in images, especially because the skill is explicitly designed for multimodal understanding and may be used on private business content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kb_connector.py (reported line 55)May include surrounding context.

python
}
        
        try:
            response = requests.post(
                f"{self.base_url}/api/search", 
                headers=self.headers, 
                json=search_payload

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kb_connector.py (reported line 87)May include surrounding context.

python
}
        
        try:
            response = requests.post(
                f"{self.base_url}/api/chat", 
                headers=self.headers, 
                json=chat_payload

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script’s comments and all user-facing output strings are in Chinese, which imposes a specific language on users without opt-in. This matches the policy category for language or locale violations because no alternative language option or justification for a Chinese-only audience is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file documents chat/conversation endpoints that transmit user messages and history, and also shows authentication headers containing API keys or credentials. Under the markdown-specific warning rule, the description should disclose privacy and credential-sensitivity implications, but the document only presents the patterns and examples without any user-facing warning about sending conversation data or protecting secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The system prompt explicitly instructs the assistant in Chinese and fixes the assistant persona as Chinese-language '小新'. This imposes a specific language/locale behavior without any visible opt-in or user choice, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.