T09 · Insecure Skill Coding Practices
Error
- Location
scripts/hiboards_client.py:96- Finding
API Credentials and User Identifier Exposed in Plaintext Output
- Content
View full analysis
- Remediation
View remediation
Security audit
push-task-to-negative-screen
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent task-push purpose, but it under-discloses credential handling and can expose the user's API key and UID in output and logs.
Review carefully before installing. Do not use this skill with sensitive task content unless you accept that task data, UID, and API-key-authenticated requests go to the hardcoded Huawei endpoint. The publisher should remove plaintext credential printing, redact headers, make authentication and destination documentation consistent, and enforce the documented record-saving controls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/task_pusher.py:322- Finding
Record-Retention Security Controls Are Ignored
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (55)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Version-file modification, update-log maintenance, and command-line version operations are materially different from a narrowly scoped task push function. Such undocumented maintenance features can be abused for persistence or tampering with local state, especially when combined with shell and file-write capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Version-file modification, update-log maintenance, and command-line version operations are materially different from a narrowly scoped task push function. Such undocumented maintenance features can be abused for persistence or tampering with local state, especially when combined with shell and file-write capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Version-file modification, update-log maintenance, and command-line version operations are materially different from a narrowly scoped task push function. Such undocumented maintenance features can be abused for persistence or tampering with local state, especially when combined with shell and file-write capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Version-file modification, update-log maintenance, and command-line version operations are materially different from a narrowly scoped task push function. Such undocumented maintenance features can be abused for persistence or tampering with local state, especially when combined with shell and file-write capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Version-file modification, update-log maintenance, and command-line version operations are materially different from a narrowly scoped task push function. Such undocumented maintenance features can be abused for persistence or tampering with local state, especially when combined with shell and file-write capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Version-file modification, update-log maintenance, and command-line version operations are materially different from a narrowly scoped task push function. Such undocumented maintenance features can be abused for persistence or tampering with local state, especially when combined with shell and file-write capabilities.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code prints the PERSONAL-API-KEY and PERSONAL-UID values directly when present, exposing sensitive credentials to stdout and potentially to logs, consoles, CI systems, or telemetry collectors. Credential disclosure through logging is a high-severity secret-handling failure because anyone with log access may reuse the API key to impersonate the user or send unauthorized requests.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This skill is described as a task-result pusher, but it includes code that launches PowerShell and an external update-inspection CLI. That undocumented capability increases privileges and external interaction beyond the declared purpose, which is dangerous because users and reviewers may not expect startup-time command execution or remote metadata retrieval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
该文档从开头即以中文定义技能说明，且全文均以中文编写，没有提供可选语言、英文版本链接或说明该技能仅面向特定中文用户群。根据语言/locale 政策，若未提供用户选择或明确、合理的区域限定，这类强制单一语言的自然语言说明可构成政策违规。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The security documentation is entirely in Chinese, which can prevent non-Chinese-speaking users from understanding what data is transmitted, what files are written locally, and how configuration is accessed. In a skill that sends task content and metadata to remote endpoints, lack of accessible security documentation undermines informed consent and safe configuration, increasing the chance of privacy or data-handling mistakes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries, yet the documentation describes capabilities involving file reads/writes, shell execution, and network access. In an agent environment, missing scope declarations can allow broader-than-expected execution and reduces the user's ability to make informed trust decisions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger includes a catch-all condition covering essentially any scenario where a task is completed and results may be pushed. Overly broad activation can cause the skill to run in unrelated conversations, increasing the chance that sensitive task output is packaged and transmitted without sufficiently specific user intent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation alternates between saying cloud-side authentication is automatic and saying missing authentication configuration will break the skill. Contradictory authentication guidance can mislead users into supplying unnecessary secrets or trusting a flow they do not understand, increasing the chance of credential mishandling.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation simultaneously states that the push target is user-configurable and that the URL is hardcoded, which prevents users from understanding where their data will actually be sent. For a skill that transmits task content externally, ambiguity about the destination materially increases data-exfiltration risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file specifies a fixed provider and geographic location in China for the default endpoint, and the overall skill is documented entirely around a China-specific destination (负一屏) without offering a locale choice or stating that this is a region-restricted skill. Under the policy, locale constraints should be opt-in or clearly justified when region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions section repeats a broad ambiguous activation phrase without clear boundaries, reinforcing the risk of accidental invocation. In a skill that writes files and sends content to a remote service, accidental activation directly increases privacy and data-leak exposure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation describes an embedded update-checking subsystem that expands the skill beyond its declared purpose of pushing task results. Even though this file is only documentation, it signals planned or existing behavior that introduces extra network-capable functionality and a broader trust boundary, which can create privacy and supply-chain risk if users did not expect the skill to contact remote services.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file explicitly states that update checking requires network access and references remote version lookup via ClawHub, which is unrelated to the minimal task-result pushing function. This creates an unnecessary outbound communication path that could expose metadata, enable tracking, or later become a vector for malicious update logic if not tightly controlled.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The configuration sets the default_result to a Chinese-language string, which implies a fixed output language. There is no indication in this file that users can choose their preferred language or that the skill is intentionally limited to a Chinese-speaking context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and class/init documentation say configuration is read from the OpenClaw configuration system, and _load_from_openclaw_config further claims a hybrid model. In practice, the executed code in that method only loads a local config.json and never calls _get_from_openclaw_global, so the documentation actively misstates the source of configuration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language descriptions and user-facing output exclusively in Chinese, including module docstrings and configuration instructions. The skill does not offer any language selection or indicate that the locale restriction is intentional, which can violate language/locale policy requirements.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The property docstring says it gets the Hiboards URL and notes it is hardcoded, which implies callers receive that URL. The implementation instead returns an empty string, contradicting the documented behavior and potentially misleading integrators about how push destination configuration works.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language docstrings and CLI output exclusively in Chinese, including the usage instructions. That imposes a specific language on users without any opt-in, alternative locale, or documented region-specific justification, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file contains docstrings, printed messages, logs, and detailed remediation text exclusively in Chinese, which imposes a specific language on users. The file does not offer a locale selection mechanism or document that the skill is intentionally region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The client reads credentials from a fixed local file and automatically injects them into outbound requests, even though the stated purpose is a generic task-result pusher. This creates implicit credential access and transmission behavior that can leak personal API keys or user identifiers to a remote service without clear minimization, consent, or scope restriction.
- Content
Static analysis
No suspicious patterns detected.