ClawHub
Back to skill

Security audit

Publish site on Qutke

Security checks for vulnerabilities and agentic risk

Overview

This publishing skill is legitimate in purpose, but it can publicly upload broad local directories and handles account credentials in ways users should review before installing.

Install only if you are comfortable with an agent uploading selected files to a public hosting service and managing on.qutke.cn account credentials. Before use, publish only a clean export directory, not a whole repository; check for secrets and hidden files; avoid the agent-mediated email-code login if possible; store or revoke API keys yourself; and require explicit confirmation before deleting sites, domains, handles, or links.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/publish.sh:50
Finding

Unpinned Remote Script Execution Recommended Through curl-to-shell Pipeline

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish.sh:150
Finding

Recursive Publication Includes Hidden and Credential-Bearing Files by Default

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/publish.sh:298
Finding

Claim Tokens Are Stored Without Explicitly Restrictive File Permissions

Content
View full analysis
"$STATE_FILE" ``` ### Technical Analysis The state file may contain `claimToken` and `claimUrl`, both of which function as sensitive authorization material for anonymous publications. The directory is created with the process's default permissions, and the file is written using ordinary redirection. No explicit mode such as `0700` for the directory or `0600` for the file is enforced. Security consequently depends on the user's current `umask`. The non-atomic overwrite also leaves the operation vulnerable to accidental corruption and makes safe handling of pre-existing symbolic links more difficult. ### Attack Path 1. A user performs an anonymous publication. 2. The service returns a claim token and claim URL. 3. The script writes those values to `.onqutke/state.json`. 4. A permissive `umask`, shared workspace, or unsafe pre-existing path makes the file readable by anot ...[truncated 472 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish.sh:231
Finding

Bearer API Key Is Forwarded to an Unvalidated Finalization URL

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (32)

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill tells the agent to ask for a one-time login code, exchange it for an API key, and store that key locally on the user's behalf. Collecting authentication codes through the agent and converting them into persistent credentials creates a strong credential-theft and account-takeover risk if the skill, environment, or logs are compromised.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/REFERENCE.md (reported line 386)May include surrounding context.

md
### 删除站点

`DELETE /api/v1/publish/:slug`（别名：`DELETE /api/v1/artifact/:slug`）

硬删除站点、所有版本和 slug 索引记录。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/REFERENCE.md (reported line 386)May include surrounding context.

md
### 删除站点

`DELETE /api/v1/publish/:slug`(别名:`DELETE /api/v1/artifact/:slug`)

硬删除站点、所有版本和 slug 索引记录。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/REFERENCE.md (reported line 537)May include surrounding context.

md
### 删除 Handle

`DELETE /api/v1/handle`

删除您的 Handle 及其下的所有链接。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/REFERENCE.md (reported line 635)May include surrounding context.

md
### 删除自定义域名

`DELETE /api/v1/domains/:domain`

删除自定义域名及其下的所有链接。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/REFERENCE.md (reported line 720)May include surrounding context.

md
### 删除单个链接

`DELETE /api/v1/links/:location`

按位置删除链接。根位置使用 `__root__`。

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The script includes a recommendation to install a dependency using 'curl ... | bash', which is an unsafe pattern that executes remote code without verification. Even though it appears only in an error message, users may copy and run it verbatim, making this a real supply-chain risk if the remote host is compromised, intercepted, or serves unexpected content.

Content

Scanner excerpt · scripts/publish.sh (reported line 50)May include surrounding context.

sh
elif command -v jq >/dev/null 2>&1; then
  JQ_BIN="$(command -v jq)"
else
  die "requires jq (run: curl -fsSL https://on.qutke.cn/install.sh | bash)"
fi

for cmd in curl file; do

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes shell commands and performs network operations but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance of overbroad execution in host environments, especially because the skill can upload local content and handle credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description emphasizes ease of publishing but does not prominently warn that files are uploaded to a public URL and may expose sensitive data. Because the primary action is external publication, omission of this warning materially raises the risk of inadvertent data disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad and overlap with common user requests like 'share this', 'put this online', or 'make a website'. In context, accidental invocation is dangerous because the skill's main action is public internet publication of local files.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

保存 Key，将其写入凭据文件：

bash
mkdir -p ~/.onqutke && echo "{API_KEY}" > ~/.onqutke/credentials && chmod 600 ~/.onqutke/credentials

重要：收到 API Key 后请立即保存——自行执行上述命令。不要让用户手动运行。避免在交互会话中通过 CLI 参数（如 --api-key）传递 Key；凭据文件是推荐的存储方式。

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

保存 Key，将其写入凭据文件：

bash
mkdir -p ~/.onqutke && echo "{API_KEY}" > ~/.onqutke/credentials && chmod 600 ~/.onqutke/credentials

重要：收到 API Key 后请立即保存——自行执行上述命令。不要让用户手动运行。避免在交互会话中通过 CLI 参数（如 --api-key）传递 Key；凭据文件是推荐的存储方式。

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/REFERENCE.md (reported line 79)May include surrounding context.

保存 Key，将其写入凭据文件：

bash
mkdir -p ~/.onqutke && echo "{API_KEY}" > ~/.onqutke/credentials && chmod 600 ~/.onqutke/credentials

重要：收到 API Key 后请立即保存——自行执行上述命令。不要让用户手动运行。避免在交互会话中通过 CLI 参数（如 --api-key）传递 Key；凭据文件是推荐的存储方式。

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The duplicated finding still reflects a real issue: the skill directs the agent to save a persistent credential in the user's home directory. Given the skill's public-upload behavior and expanded account-management scope, storing reusable secrets locally makes misuse and unintended future actions more likely.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

保存 Key，将其写入凭据文件：

bash
mkdir -p ~/.onqutke && echo "{API_KEY}" > ~/.onqutke/credentials && chmod 600 ~/.onqutke/credentials

重要：收到 API Key 后请立即保存——自行执行上述命令。不要让用户手动运行。避免在交互会话中通过 CLI 参数（如 --api-key）传递 Key；凭据文件是推荐的存储方式。

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The duplicated finding still reflects a real issue: the skill directs the agent to save a persistent credential in the user's home directory. Given the skill's public-upload behavior and expanded account-management scope, storing reusable secrets locally makes misuse and unintended future actions more likely.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

保存 Key,将其写入凭据文件:

bash
mkdir -p ~/.onqutke && echo "{API_KEY}" > ~/.onqutke/credentials && chmod 600 ~/.onqutke/credentials

重要:收到 API Key 后请立即保存——自行执行上述命令。不要让用户手动运行。避免在交互会话中通过 CLI 参数(如 --api-key)传递 Key;凭据文件是推荐的存储方式。

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to immediately save any received API key without user intervention normalizes autonomous credential handling by the agent. This is dangerous because it bypasses informed consent and can leave long-lived secrets on disk where other processes, logs, or future runs may access them.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The advertised purpose is simple file publishing, but the skill additionally instructs the agent to request a user's email, collect a one-time login code, exchange it for an API key, and persist that credential locally. This materially expands the trust boundary from content publishing to account access and credential management, which is far more sensitive.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This command transmits the user's email address to an external service to initiate authentication. While expected for the feature, it is still an external data transfer and becomes risky because the skill does not pair it with strong consent language or isolation from the broader credential collection flow.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

  1. 请求一次性登录验证码：
bash
curl -sS https://on.qutke.cn/api/auth/agent/request-code \
  -H "content-type: application/json" \
  -d '{"email": "user@example.com"}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

This repeats the same pattern of locally persisting the returned apiKey after agent-mediated authentication. In context, the skill is turning a transient verification step into durable account access retained on the machine.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

  1. 自行保存返回的 apiKey（不要让用户操作）：
bash
mkdir -p ~/.onqutke && echo "{API_KEY}" > ~/.onqutke/credentials && chmod 600 ~/.onqutke/credentials

脚本参数

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

复制站点

bash
curl -sS -X POST https://on.qutke.cn/api/v1/publish/{slug}/duplicate \
  -H "Authorization: Bearer {API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{}'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill includes domain management, handle management, link routing, deletion, and duplication capabilities that go well beyond generating a {slug}.on.qutke.cn publishing URL. These extra powers can alter a user's web presence or destroy mappings if invoked without narrowly scoped authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation describes deletion of custom domains and associated links without an explicit destructive-action warning or confirmation requirement. In context, these operations can break live sites and remove user configurations beyond the core publishing task.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/REFERENCE.md (reported line 38)May include surrounding context.

1. 通过邮箱请求一次性验证码：

bash
curl -sS https://on.qutke.cn/api/auth/agent/request-code \
  -H "content-type: application/json" \
  -d '{"email": "user@example.com"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

这是一个 markdown 文件，因此应检查是否缺少会影响用户数据、隐私或系统完整性的警示。L076-L080 提供了将 <API_KEY> 写入 ~/.onqutke/credentials 的具体命令，但除了权限设置外，没有明确提醒该操作会在本机持久保存敏感凭据、应避免在共享环境执行或注意 shell 历史/替换风险。

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

This duplicate finding refers to the same plaintext credential persistence behavior. In the context of a publishing skill with account-level APIs, a stolen API key could allow unauthorized site changes, deletion, metadata changes, and domain/link operations.

Content

Scanner excerpt · references/REFERENCE.md (reported line 79)May include surrounding context.

4. 将 API Key 保存到凭据文件：

bash
mkdir -p ~/.onqutke && echo "<API_KEY>" > ~/.onqutke/credentials && chmod 600 ~/.onqutke/credentials

方式 B：控制台注册

Static analysis

No suspicious patterns detected.