ClawHub
Back to skill

Security audit

狐表(Foxtable) 移动端开发

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Foxtable documentation package, but several examples teach unsafe web, credential, and data-deletion patterns that users could copy into real systems.

Install only if you need Foxtable reference documentation and are prepared to treat code examples as legacy or unvetted. Do not copy the authentication, API credential, upload, firewall, public binding, file-deletion, or database-query examples directly into production; replace secrets with protected configuration, use HTTPS, keep development servers loopback-only unless explicitly secured, use server-side sessions, validate uploads and paths, parameterize database operations, and add authorization and CSRF protections.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
references/09_微信接口.md:295
Finding

Hard-Coded WeChat Application Secrets in Executable Examples

Content
View full analysis
3600 Then Dim hc As New HttpClient(CExp(url, AppId, AppSecret)) Dim ret As String = hc.GetData() End If ``` The same credential values are reused in OAuth and access-token examples. Another credential-shaped secret appears at line 6039: ```vb CExp(ul, "wx8acdb7df5beb68fd", "dec0df8a469518df30e9bdef0758c678", e.GetValues("code")) ``` ### Technical Analysis The documentation embeds realistic WeChat AppId and AppSecret values directly in executable examples. The AppSecret is then interpolated into a URL query parameter when requesting an access token. Hard-coded credentials can be extracted by anyone who receives the Skill package. Secrets placed in URLs may additionally be captured in application logs, HTTP client diagnostics, reverse-proxy logs, monitoring systems, browser history, or exception reports. Although TLS protects the request in transit, it does not prevent local or intermediary systems from recording the complete URL. The documentation states that users should replace the values, but that warning does not protect any displayed credential that remains active and encourages users to reproduce the insecure secret-management pattern. ### Attack Path 1. An attacker obtains the publicly distributed Skill reference file. 2. The attacker extracts the embedded AppId and AppSecret values. 3. If a displayed credential re ...[truncated 1057 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/10_更多接口.md:23
Finding

Hard-Coded Aliyun AppCode Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/04_HTML入门.md:3649
Finding

Plaintext User Passwords Stored in Client-Side Cookies

Content
View full analysis
") Return End If ``` The failed-login form also places the submitted password back into generated HTML: ```vb sb.AppendLine( "Password:

") ``` ### Technical Analysis The example treats a user's raw password as a reusable client-side authentication token. The password is stored in a browser cookie and read back on every request. The demonstrated cookie calls do not set `Secure`, `HttpOnly`, or `SameSite` protections. Client-side password storage violates the principle that passwords should be verified once and then replaced with an opaque session identifier. Any script, browser extension, malware, local user, network observer on an HTTP deployment, or logging component that obtains the cookie can recover the original reusable password. Reflecting the submitted password into the returned HTML furt ...[truncated 1275 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/05_WeUI框架.md:8024
Finding

Untrusted Request Parameters Concatenated into Database Predicates

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (137)

Ssd 3

Critical
Category
Not specified by scanner
Confidence
100% confidence
Finding

The sample implements authentication by writing the username and password into client cookies and reading the password back on later requests, effectively turning client-side state into the trust anchor. This permits credential disclosure and replay and bypasses basic secure authentication design principles.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file explicitly recommends binding the HTTP service to all interfaces (http://*/) and even public IPs, which can unintentionally expose a development server to the LAN or Internet. In the context of a documentation skill, this is dangerous because later examples include weak authentication, file serving, uploads, and data mutation endpoints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instructions tell users to create Windows firewall inbound rules to permit remote access to the hosted service, directly weakening host network protections. Combined with the document's insecure sample endpoints, this can expose unauthenticated or weakly protected functionality to other systems.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The sample echoes all submitted form values back to the browser, including sensitive fields like passwords, without output encoding or field-level filtering. This leaks secrets and also creates an injection/XSS risk if attacker-controlled input is rendered as HTML.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The upload examples accept user-supplied files and persist them to disk with attacker-controlled names, without validation, scanning, size limits, or storage isolation. This enables overwriting, malicious content storage, denial of service, and possible later execution or unsafe retrieval depending on server configuration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
100% confidence
Finding

The authentication example stores usernames and passwords directly in cookies and reuses those cookie values for authentication, which exposes credentials to theft, replay, client-side inspection, and insecure transport risks. This is a severe credential-handling flaw and especially dangerous because it is presented as an example readers may implement verbatim.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
100% confidence
Finding

The authentication sample presents password-in-cookie storage without any warning that the pattern is insecure, making it highly likely to be copied into real systems. In documentation, unsafe examples without disclaimers are especially risky because they teach bad practice as if it were acceptable.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document includes sample code that deletes server-side files based on client-submitted state (up1_deleted) and a derived filesystem path. Even though this is presented as instructional content, it normalizes a dangerous capability without robust validation, authorization, path canonicalization, or safety warnings, making accidental unsafe reuse likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section demonstrates storing usernames and passwords directly in client cookies for authentication state. That is insecure because cookies can be stolen, replayed, or exposed through client-side compromise, and storing raw credentials on the client materially increases account compromise risk.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High
Category
Output Handling
Confidence
98% confidence
Finding

This example assigns server-returned content directly to innerHTML, which creates a DOM XSS sink if the response ever includes attacker-controlled HTML or script. Documentation examples are especially risky here because developers may copy the pattern broadly for displaying AJAX responses.

Content

Scanner excerpt · references/05_WeUI框架.md (reported line 5036)May include surrounding context.

md
obj.name = "舒淇";
    obj.age=39;
    var result = sendAjaxJSON(obj,"json.htm","",false);
    document.getElementById("p1").innerHTML=result;
}

//发送JSON字符串

Unvalidated Output Injection

High
Category
Output Handling
Confidence
98% confidence
Finding

Directly writing AJAX response data into innerHTML makes the page vulnerable to DOM-based XSS when response content can be influenced by an attacker. The danger is amplified in tutorial code because it teaches an unsafe default rendering pattern.

Content

Scanner excerpt · references/05_WeUI框架.md (reported line 5043)May include surrounding context.

md
function sendJsonString(){
    var val= '{"name":"李云龙","age":"36"}'
    var result = sendAjaxJSON(val,"json.htm","",false);
    document.getElementById("p1").innerHTML=result;
}

2、HttpRequest事件代码：

Unvalidated Output Injection

High
Category
Output Handling
Confidence
83% confidence
Finding

This instance writes a constructed string into innerHTML; while the immediate example uses parsed JSON fields, those fields are still unescaped and would enable script injection if attacker-controlled. It is safer than raw server HTML insertion but still an unsafe sink for untrusted data.

Content

Scanner excerpt · references/05_WeUI框架.md (reported line 5143)May include surrounding context.

md
result="姓名:"
+ user.name + "<br/>" + "年龄:" +
user.age
    document.getElementById("p1").innerHTML=result;
}

2、HttpRequest事件代码：

Unvalidated Output Injection

High
Category
Output Handling
Confidence
99% confidence
Finding

The example inserts an entire server response page into innerHTML without validation or sanitization. If the response contains attacker-controlled markup, this becomes immediate DOM XSS and can execute arbitrary script in the user's browser.

Content

Scanner excerpt · references/05_WeUI框架.md (reported line 5331)May include surrounding context.

md
function tongji(){
    var result = submitAjaxForm('form1','',false);
    document.getElementById("p1").innerHTML=result;
}

2、HttpReqquest事件代码：

Unvalidated Output Injection

High
Category
Output Handling
Confidence
99% confidence
Finding

Placing AJAX response content directly into page2.innerHTML exposes the application to DOM XSS if any part of the returned content is attacker-controlled. The risk is substantial because this pattern effectively treats the response as trusted executable markup.

Content

Scanner excerpt · references/05_WeUI框架.md (reported line 5399)May include surrounding context.

md
function tongji2(){
    var result = submitAjaxForm('form1','',false);
    document.getElementById("page2").innerHTML=result;
    hide('page1');
    show('page2');
}

Unvalidated Output Injection

High
Category
Output Handling
Confidence
99% confidence
Finding

This callback example explicitly teaches assigning arbitrary server-returned data to innerHTML, which is a classic DOM XSS sink. In documentation, such a pattern is dangerous because it encourages insecure handling of asynchronous responses as normal practice.

Content

Scanner excerpt · references/05_WeUI框架.md (reported line 5486)May include surrounding context.

md
所有的回掉函数都必须定义一个参数，这个参数表示服务器返回的值，例如：

function afterSendJson(result){
    document.getElementById("p1").innerHTML=result;
}

唯一的参数result表示服务器返回的数据，上面代码的意思就是：将服务器返回的数据显示在id为"p1"的元素中。

Unvalidated Output Injection

High
Category
Output Handling
Confidence
99% confidence
Finding

This asynchronous callback repeats the unsafe pattern of inserting response data into innerHTML without sanitization. An attacker who can influence the response could run arbitrary JavaScript in the browser context.

Content

Scanner excerpt · references/05_WeUI框架.md (reported line 5528)May include surrounding context.

md
//显示服务器返回的数据
function afterSendJson(result){
    document.getElementById("p1").innerHTML=result;
}

2、HttpRequest事件代码：

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The backend file deletion example performs permanent deletion of server files based on client-originated data without a strong warning about trust boundaries. That is dangerous because developers may copy the pattern and allow arbitrary or unintended file deletion if filename handling, path checks, or authorization are weak.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document includes hard-coded AppId/AppSecret-style credentials and similar tokens directly in sample code, which encourages copy-paste use and accidental secret exposure. If these values are real or if users imitate the pattern, attackers can steal API credentials, mint tokens, impersonate the application, and access protected WeChat functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The central token service example returns access tokens over plain HTTP and relies on simplistic posted credentials, exposing bearer tokens to interception or replay on the network. Anyone who obtains that token can call privileged WeChat APIs as the application until the token expires, potentially leading to account takeover of API capabilities and data access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A hardcoded API credential is present in sample code, which is a direct secret exposure. Anyone with access to the documentation can reuse the credential, consume the associated paid quota, and potentially access or correlate logistics-query activity tied to the account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document includes a concrete FTP host, username, and password directly in sample code. Even if illustrative, embedded credentials normalize unsafe secret handling and may expose real infrastructure if the values are valid or reused elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The markdown demonstrates network credential handling without any warning, masking, or secure storage guidance. This can lead readers to copy insecure patterns into production and may leak sensitive access details through source control, logs, or redistributed documentation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document instructs users to run Foxtable as administrator and start an HTTP server, which meaningfully expands host attack surface from a mobile-development skill into privileged local service hosting. While this is framed as instructional content, it encourages unnecessary privilege and service exposure without proportional security guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guidance promotes exposure on all interfaces and public IPs without clearly warning that this makes the service reachable by other hosts. In a document that also demonstrates unsafe server logic, omitting that warning materially increases the chance of accidental exposure.

Content

No source excerpt is available for this finding.