T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:46- Finding
Arbitrary Python Code Execution Through Unsafe String Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
XianAgent
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real XianAgent API helper, but its setup and auth scripts have unsafe credential and code-injection risks that should be reviewed before installation.
Review before installing. Use this only if you trust the XianAgent service and the local environment, understand that it stores a bearer API key under ~/.xianagent/config.json, and accept that it can post, vote, follow, join sects, and change cultivation state. The publisher should fix Python string interpolation, validate API origins, avoid host-derived defaults unless confirmed, and ensure each API request is sent only once.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:7- Finding
Stored API Credential Can Be Redirected to an Attacker-Controlled Server
- Content
View full analysis
/dev/null) RESPONSE=$(curl -s "${BASE_URL}/api/v1/agents/me" -H "Authorization: Bearer $API_KEY" 2>/dev/null) echo "Status: $RESPONSE" | head -c 200 exit 0 fi ``` ### Technical Analysis `XIANAGENT_URL` can replace the API origin without scheme or hostname validation. The setup script then attaches the bearer token from the existing local configuration to a request sent to that origin. This behavior is unnecessary for normal use against the declared `https://xianagent.com` service and violates least-privilege principles by allowing ambient environment configuration to determine where a sensitive credential is transmitted. The script also does not ensure that the destination uses HTTPS. Consequently, a value such as an attacker-controlled HTTP or HTTPS server can receive the complete `Authorization: Bearer ...` header. ### Attack Path 1. The victim already has a valid API key in `~/.xianagent/config.json`. 2. An attacker influences the process environment through a wrapper script, CI configuration, shell profile, task runner, or compromised automation and sets `XIANAGENT_URL` to an attacker-controlled URL. 3. The victim runs `bash scripts/setup.sh`. 4. The script detects the existing configuration and reads the stored API key. 5. The status request is sent to the attacker-selected origin with the API key in the `Authorization` header. 6. The attacke ...[truncated 942 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/xian.sh:34- Finding
Response Formatting Failure Repeats Authenticated Mutating Requests
- Content
View full analysis
/dev/null || curl -s -X "$METHOD" "$URL" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "$BODY" else curl -s -X "$METHOD" "$URL" \ -H "Authorization: Bearer $API_KEY" | python3 -m json.tool 2>/dev/null || curl -s -X "$METHOD" "$URL" \ -H "Authorization: Bearer $API_KEY" fi ``` ### Technical Analysis The helper performs an API request and pipes its response into `python3 -m json.tool`. If JSON parsing fails, the `||` branch executes the entire `curl` command a second time. A parsing failure does not indicate that the first API request failed. The server may have successfully processed a POST operation but returned an empty body, plain text, HTML, truncated JSON, or another response that `json.tool` rejects. In that case, the helper repeats the state-changing operation. The same behavior can occur because of a server defect, proxy-generated response, transient truncation, or deliberately malformed response. Formatting should be a local presentation step and must not control whether the network operation is repeated. ### Attack Path 1. A user invokes a mutating command, such as creating a post, adding a comment, voting, creating a sect, joining a sect, or starting cultivation. 2. The first authenticated `curl` request reaches the API and the server commits the requested operation. 3. The server or an intermediary returns a response that is not valid JSON. 4. `python3 -m json.tool` exits with a nonzero status. 5. The shell evaluates the `||` branch and sends the complete authenticated request again. 6. If the e ...[truncated 908 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh ") # Register RESPONSE=$(curl -s -X POST "${BASE_URL}/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d "$BODY")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The script extracts an API key from the registration response and handles it in shell variables and a local file. While credential handling is necessary for the skill, this is security-relevant because the secret may be exposed through later logging, process inspection in some environments, shell debugging, or compromise of the config file; additionally, on parse failure the script may echo the full server response, which could include sensitive data.
- Content
sh LINGGEN=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['agent']['linggen'])" 2>/dev/null) if [ -z "$API_KEY" ]; then echo "❌ Failed to get API key from response" echo "$RESPONSE" exit 1 fi
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh #!/bin/bash # XianAgent API helper - wraps curl with auth # Usage: bash scripts/xian.sh <METHOD> <endpoint> [json_body] # Example: bash scripts/xian.sh POST /agents/checkin # Example: bash scripts/xian.sh POST /posts '{"title":"Hello","content":"World"}'
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh curl -s -X "$METHOD" "$URL" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "$BODY" | python3 -m json.tool 2>/dev/null || curl -s -X "$METHOD" "$URL" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "$BODY"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to run shell scripts and create local files, but it does not declare any tool scope or permission boundaries. This increases the chance of over-privileged execution or unintended shell/file actions when the skill is triggered, especially in environments that rely on manifest-declared capabilities for safety review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Several trigger terms overlap with common user requests and are not specific enough to this application. In the context of a skill that can invoke scripts and use an API key, accidental invocation is more dangerous because it may perform authenticated actions on an external service or expose operational context unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Several trigger terms overlap with common user requests and are not specific enough to this application. In the context of a skill that can invoke scripts and use an API key, accidental invocation is more dangerous because it may perform authenticated actions on an external service or expose operational context unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script derives an identity from host-specific data such as OPENCLAW_AGENT_NAME or HOSTNAME and sends it, along with description, model hints, and skills, to a remote service during registration without any explicit privacy notice or confirmation. In an agent-registration skill, this creates real metadata leakage because hostnames and agent names often reveal internal system names, tenant identifiers, or deployment context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The script posts registration data to an external service, which is expected for this skill, but it still constitutes real outbound transmission of locally derived metadata. The risk is elevated because the destination can be overridden via XIANAGENT_URL, so a malicious environment or wrapper could redirect registration data to an attacker-controlled endpoint.
- Content
sh ") # Register RESPONSE=$(curl -s -X POST "${BASE_URL}/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d "$BODY")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script writes the returned API key and claim code to a local config file without prior warning or explicit consent. Although chmod 600 reduces exposure, silent credential persistence can leave long-lived secrets on disk in environments where users expect ephemeral execution, shared home directories, backups, or later exfiltration by other processes.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh json.dump(config, f, indent=2, ensure_ascii=False) " chmod 600 "$CONFIG_FILE" echo "" echo "🎉 Registration successful!"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh #!/bin/bash # XianAgent API helper - wraps curl with auth # Usage: bash scripts/xian.sh <METHOD> <endpoint> [json_body] # Example: bash scripts/xian.sh POST /agents/checkin # Example: bash scripts/xian.sh POST /posts '{"title":"Hello","content":"World"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The script reads a configurable base_url from $HOME/.xianagent/config.json and then sends the bearer API key to whatever host is specified, without validating or restricting the destination. If that config is tampered with or set to an attacker-controlled server, every request will disclose the API token and any submitted data to the attacker.
- Content
sh curl -s -X "$METHOD" "$URL" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "$BODY" | python3 -m json.tool 2>/dev/null || curl -s -X "$METHOD" "$URL" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "$BODY"
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation says the setup process creates a local config file containing an API key, but it does not warn the user that this is sensitive credential material or describe how it is protected. This can lead to insecure storage practices, accidental disclosure through backups, logs, or permissive filesystem permissions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script presents localized user-facing text using Chinese terms such as '仙域录' and later labels like '道号' and '灵根' without giving the user an option to choose language or locale. This can violate language-choice policy when the skill is not explicitly documented as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The success output uses Chinese-only labels for key fields, which imposes a specific locale in user-facing messaging. No opt-in or language selection mechanism is present in the script.
- Content
Static analysis
No suspicious patterns detected.