ClawHub
Back to skill

Security audit

薇薇发

Security checks for vulnerabilities and agentic risk

Overview

This package looks like internal LLM debugging notes, but it exposes sensitive endpoints, identifiers, and a bearer token example in a way users should review before installing.

Install only after the publisher sanitizes the package: remove and rotate the exposed token, replace internal IPs and object paths with placeholders, require HTTPS for uploads, and document exactly how uploaded files/images are authorized, retained, and deleted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
2025.11.24-2025.11.28.txt:12
Finding

Hard-Coded Bearer Token in API Example

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:232
Finding

Sensitive File Uploads Documented over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:116
Finding

Internal Infrastructure and User-Specific Identifiers Embedded in Skill Documentation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This is a concrete external transmission example to an internal service over HTTP using an embedded bearer token, and it includes potentially sensitive conversational history in the request body. The danger is not merely that a network call exists, but that the file operationalizes authenticated access and data submission in a way that could enable unauthorized use, token theft, and leakage of internal service topology.

Content

Scanner excerpt · 2025.11.24-2025.11.28.txt (reported line 12)May include surrounding context.

text
1. 生产环境智能体api调用，给history字段输入历史记录，无法承接历史内容进行对话
        curl -X POST http://10.73.171.38:30110/largemodel/api/v2/completions -H "Content-Type: application/json" -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcGlfa2V5IjoiNjhmNTkwN2QxYTk0ODM3MTM1ZmY2OTI0IiwiZXhwIjoxNzYzNjYxNDM4LCJ0aW1lc3RhbXAiOjE3NjM2MDE0Mzh9.GEFQg_eux0esIH7HHfCIfFktokE4aY6MnWfrKSRB1b4" -d '{"prompt": "北京还有什么其它景点","history":[["北京的景点","圆明园和故宫"]],"appId":"691d8e2264c4ec7578636236","stream":false }'

    2. -- 图像生成的插件，插件返回base64格式图像时，调试的时候无法渲染

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file contains a ready-to-use authenticated curl command with a live bearer token and internal endpoint details. Anyone who gains access to this text can replay the request, access the referenced service, and potentially abuse the token until it expires or is revoked; the skill context increases risk because this is framed as a production API debugging example, not a clearly sanitized sample.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The prompt explicitly instructs the system to use user-provided image or file content, but the skill definition contains no visible notice, consent flow, or handling constraints for potentially sensitive uploaded data. This increases the risk of users submitting personal, confidential, or regulated content without understanding how it will be processed, retained, or exposed through connected components.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example question "帮忙吹牛逼" is a short, generic natural-language phrase without clear scope or activation constraints. In a plain text/config-style skill definition, this can overlap with casual user speech and does not specify when the skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · 2025.12-01-2025.12.05.txt (reported line 43)May include surrounding context.

text
}
    ],
    "plugList": [],
    "mcpList": [
        "68f1ec87897276532ef56008",
        "68b6b37cff6d755e0ff31fd1"
    ],

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
}
    ],
    "plugList": [],
    "mcpList": [
        "68f1ec87897276532ef56008",
        "68b6b37cff6d755e0ff31fd1"
    ],

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md
}
    ],
    "plugList": [],
    "mcpList": [
        "68f1ec87897276532ef56008",
        "68b6b37cff6d755e0ff31fd1"
    ],

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md
}
    ],
    "plugList": [],
    "mcpList": [
        "68f1ec87897276532ef56008",
        "68b6b37cff6d755e0ff31fd1"
    ],

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation examples are open-ended natural-language requests that can trigger multiple skills without clear boundaries, constraints, or exclusions. In a chained weather-to-flight workflow, this increases the chance of over-broad activation, unintended cross-skill execution, and ambiguous handling of user intent, which can cause the wrong tool to run or more data to be processed than necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file is an extremely sparse design note with broad phrases such as 'LLM login not using Keycloak' and 'external call to mcp' but no activation boundaries, authorization model, or safety constraints. In a security-sensitive skill or agent context, this ambiguity is dangerous because implementers may default to insecure behavior, especially around authentication bypass and uncontrolled external connectivity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This plain text file lists behavior requirements and fixes, but it does not define any specific trigger phrases, activation conditions, or exclusion cases for when the skill should or should not apply. In plain text skill documentation, the absence of explicit trigger scope can lead to unintended invocation because the operational boundaries are unclear.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document contains concrete internal upload endpoints, file/image handling parameters, and examples of user content being transmitted, but does not include any warning about retention, access control, or privacy implications. Because the skill explicitly discusses uncertainty about how long files/images are stored and shows remotely accessible paths, users could be led to upload sensitive content without understanding exposure or persistence risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This .txt file is in scope for vague-trigger review, and L01 contains only a raw link with no context, purpose, or activation constraints. In a skill-related artifact, an unlabeled link can act as an overly broad invocation cue because readers cannot tell what action or context it applies to, nor what should not trigger its use.

Content

No source excerpt is available for this finding.