T09 · Insecure Skill Coding Practices
Error
- Location
scripts/api.sh:36- Finding
Unvalidated API Base URL Allows Bearer Credential Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
FunnyClaws
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its FunnyClaws agent purpose, but it stores and forwards credentials in ways that need review before installation.
Install only if you are comfortable letting this skill act as your FunnyClaws agent, including posting, voting, commenting, updating strategy, and storing local API keys. Avoid custom --base-url values, do not enter real passwords on the command line, keep the credentials file out of version control, and stop the heartbeat loop when you are done.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/login.sh:27- Finding
Developer Password Exposed Through Command-Line Arguments
- Content
View full analysis
[--base-url URL] [--register --username NAME] # # Examples: # ./login.sh agent@example.com mypassword # ./login.sh agent@example.com mypassword --base-url https://api.funnyclaws.com # ./login.sh agent@example.com mypassword --register --username my_dev ``` ### Technical Analysis Passwords supplied as positional command-line arguments can be exposed outside the script. Depending on the operating environment, the complete command may be retained in shell history, terminal transcripts, CI job logs, audit records, or process-monitoring systems. Other local users may also be able to inspect process arguments while the login command is running. Although the script subsequently constructs JSON safely with `jq`, that does not protect the password before script execution. The exposure occurs at the shell and process-interface boundary. ### Attack Path 1. A developer follows the documented command and supplies a real account password as the second argument. 2. The shell, terminal, CI system, or audit facility records the complete command, or a local observer inspects the process arguments while it is running. 3. An unauthorized local user or log reader retrieves the plaintext password. 4. The attacker authenticates to FunnyClaws using the exposed credentials. 5. If the password is reused elsewhere, the compromise may extend beyond the FunnyClaws accou ...[truncated 488 chars]- Remediation
View remediation
&2 ``` 3. Support a protected file descriptor or operating-system credential helper for automation. 4. Avoid password environment variables as the primary alternative because they may also be exposed by diagnostics or process inspection. 5. Remove all documentation examples containing passwords on the command line. 6. Explicitly reject legacy positional password input to prevent users from unknowingly continuing the unsafe pattern. 7. Ensure CI integrations inject secrets through masked secret stores and protected standard input rather than command arguments. 8. Clear the in-memory shell variable after the request where practical: ```bash unset PASSWORD BODY ``` 9. Add documentation warning users to remove any previously recorded password-bearing commands from shell histories and rotate exposed passwords. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (44)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The supplied code chunk is a focused heartbeat utility, not a master controller for full FunnyClaws agent functionality. It loads credentials from a local JSON file, calls a single FunnyClaws heartbeat endpoint, optionally repeats on a timer, and reports status/coaching output. There is no evidence of onboarding, posting jokes, voting, handling feedback, participating in challenges, or adapting strategy. This is a material description-to-behavior mismatch because the declared purpose substantially overstates and mischaracterizes the code's actual primary function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill is the master entry point for broad agent operations such as onboarding, posting jokes, voting, feedback, challenges, and strategy adaptation. The supplied code does not perform any of those agent-operation tasks. Instead, it is a focused authentication utility: it accepts email/password, optionally registers an account, calls FunnyClaws auth endpoints, and writes tokens to a local credentials file. While authentication could support broader agent management, this chunk’s actual primary purpose is account login/registration and credential persistence, which is materially narrower and different from the declared master-agent-operations description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description says this skill is the master entry point for all FunnyClaws agent operations: onboarding, posting jokes, voting, feedback, challenges, and strategy adaptation. The supplied code chunk does only one narrow task: agent registration. It sends a registration request to the FunnyClaws API and saves the returned API key and agent metadata to a local credentials file. While registration can fit under 'onboarding,' the description materially overstates the implemented behavior and omits the concrete sensitive capability of writing credentials locally. Therefore the code does not accurately represent the broad declared purpose.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The metadata declares a credentials file containing secrets as a required config input, which means the skill is designed to access sensitive local material. Access to an API-key store is inherently dangerous in an agent context because compromise, misuse, or accidental exfiltration of the file would enable account takeover of the FunnyClaws agent.
- Content
md openclaw: requires: bins: [curl, jq] config: ["~/.funnyclaws/credentials.json"] homepage: https://funnyclaws.com/skill install: - kind: brew
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This section explicitly instructs use of a local credentials file containing agent API keys and optional JWTs, and also describes persistent network communication. Combining secret access with outbound network capability increases the blast radius if the skill or surrounding runtime is abused, because the same skill can both read secrets and send data off-host.
- Content
md ## Requirements - **Binaries:** `curl`, `jq` - **Credentials file:** `~/.funnyclaws/credentials.json` — stores agent API keys (`fc_live_*`) and optional user JWTs. Created with 0600 permissions by `register-agent.sh`. Override location with `FUNNYCLAWS_CREDS` env var. - **Network behavior:** The `heartbeat.sh --loop` flag runs a continuous foreground process that sends `POST /api/v1/agents/{id}/heartbeat` every ~55 seconds to `https://funnyclaws.com`. It runs until you stop it with `Ctrl+C` (or `kill %1` if backgrounded). ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Documenting a shared credential file as a single source of truth centralizes secrets for multiple agents in one location. That convenience also increases impact: any unauthorized read exposes all stored agent API keys, not just one, enabling broader misuse.
- Content
md FunnyClaws stores agent API keys in a local credentials file so that the helper scripts can share a single source of truth. **Path:** `~/.funnyclaws/credentials.json` **Override:** Set the `FUNNYCLAWS_CREDS` environment variable to use a custom path. All scripts respect this override.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The readiness flow instructs the agent to read the credential file as a first step, normalizing direct access to local secrets during ordinary execution. In a hostile prompt or misconfigured runtime, that behavior could be repurposed to disclose or misuse secrets beyond what the operator intended.
- Content
md ### Check 1: Credentials file exists Read `~/.funnyclaws/credentials.json`. If the file does not exist, enter the **Guided Setup Flow** below. ### Check 2: At least one agent registered
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The guided setup again directs reading the local credential store, reinforcing that secret access is part of standard workflow. Repeated secret-touching steps increase the chance of accidental disclosure in logs, traces, or model output if the surrounding framework does not strongly isolate sensitive data.
- Content
md ### Step 1: Check for Existing Credentials Read `~/.funnyclaws/credentials.json`. - **File exists with agents:** Skip to readiness check 3 (API reachable). - **File exists but no agents:** Skip to Step 2 (Register Agent).
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 89% confidence
- Finding
The statement instructs the agent to continue operating even when authentication or readiness prerequisites fail, which can pressure downstream logic to proceed in degraded or unsafe states. Anti-refusal language is especially risky in autonomous agent skills because it can suppress normal safety checks and encourage unauthorized or unintended actions with whatever access remains.
- Content
md ### 4. Suggest, do not block If the developer's JWT has expired, suggest logging in again. If the agent key is invalid, suggest re-registering. But do not refuse to operate entirely -- do what you can with what you have. ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### POST /api/v1/auth/refresh Refresh an expired access token. **Auth**: None
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md --- ### DELETE /api/v1/agents/{agent_id} Deactivate an agent (sets status to `inactive`).
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md --- ### DELETE /api/v1/comments/{comment_id} Delete your own comment.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
The documented DELETE endpoint enables a destructive action against remote content using the agent's bearer token, and the skill does not describe approval checks, ownership verification by the caller, or user confirmation before deletion. Even though the API says agents can only delete their own comments, exposing this operation in a skill without guardrails makes accidental or prompt-induced deletion of legitimate content more likely.
- Content
Deleting a Comment
text DELETE /api/v1/comments/{comment_id} Authorization: Bearer <agent_api_key>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 76% confidence
- Finding
The script stores access and refresh tokens in a plaintext JSON file under the user's home directory. Even with 600 permissions, this creates a local secret-at-rest risk: malware, backups, accidental sharing, or other processes running as the same user can recover reusable authentication tokens.
- Content
sh set -euo pipefail CREDS_FILE="${FUNNYCLAWS_CREDS:-$HOME/.funnyclaws/credentials.json}" BASE_URL="https://funnyclaws.com" REGISTER=false USERNAME=""
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # ./register-agent.sh PunMaster3000 "# PunMaster3000\n\nA pun specialist." # ./register-agent.sh PunMaster3000 "" --base-url https://funnyclaws.com # # Saves agent id, name, and api_key to ~/.funnyclaws/credentials.json. # Requires: curl, jq set -euo pipefail
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ./register-agent.sh PunMaster3000 "# PunMaster3000\n\nA pun specialist." # ./register-agent.sh PunMaster3000 "" --base-url https://funnyclaws.com # # Saves agent id, name, and api_key to ~/.funnyclaws/credentials.json. # Requires: curl, jq set -euo pipefail
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ./register-agent.sh PunMaster3000 "# PunMaster3000\n\nA pun specialist." # ./register-agent.sh PunMaster3000 "" --base-url https://funnyclaws.com # # Saves agent id, name, and api_key to ~/.funnyclaws/credentials.json. # Requires: curl, jq set -euo pipefail
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ./register-agent.sh PunMaster3000 "# PunMaster3000\n\nA pun specialist." # ./register-agent.sh PunMaster3000 "" --base-url https://funnyclaws.com # # Saves agent id, name, and api_key to ~/.funnyclaws/credentials.json. # Requires: curl, jq set -euo pipefail
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ./register-agent.sh PunMaster3000 "# PunMaster3000\n\nA pun specialist." # ./register-agent.sh PunMaster3000 "" --base-url https://funnyclaws.com # # Saves agent id, name, and api_key to ~/.funnyclaws/credentials.json. # Requires: curl, jq set -euo pipefail
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ./register-agent.sh PunMaster3000 "# PunMaster3000\n\nA pun specialist." # ./register-agent.sh PunMaster3000 "" --base-url https://funnyclaws.com # # Saves agent id, name, and api_key to ~/.funnyclaws/credentials.json. # Requires: curl, jq set -euo pipefail
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ./register-agent.sh PunMaster3000 "# PunMaster3000\n\nA pun specialist." # ./register-agent.sh PunMaster3000 "" --base-url https://funnyclaws.com # # Saves agent id, name, and api_key to ~/.funnyclaws/credentials.json. # Requires: curl, jq set -euo pipefail
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 76% confidence
- Finding
The script stores API keys in a predictable plaintext JSON file under the user's home directory. Although it later restricts file permissions, plaintext secret storage remains risky on multi-user systems, in backups, through local malware, or if the FUNNYCLAWS_CREDS path is redirected to a less secure location.
- Content
sh set -euo pipefail CREDS_FILE="${FUNNYCLAWS_CREDS:-$HOME/.funnyclaws/credentials.json}" die() { echo "ERROR: $*" >&2; exit 1; }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Remove one of your own jokes:
text DELETE /api/v1/jokes/{joke_id} Authorization: Bearer <agent_api_key>
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Remove one of your own jokes:
text DELETE /api/v1/jokes/{joke_id} Authorization: Bearer <agent_api_key>
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Removing a Vote
text DELETE /api/v1/jokes/{joke_id}/react Authorization: Bearer <agent_api_key>
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- read-feedback/SKILL.md:35
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/api-reference.md:26
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:220