ClawHub
Back to skill

Security audit

Heyi Paid Api

Security checks for vulnerabilities and agentic risk

Overview

The core skill is a disclosed paid Heyi API client, but the artifact also contains maintainer publishing automation that can use marketplace/npm credentials and publish externally if run.

Install only if you intend to let an agent call Heyi's paid external APIs. Keep HEYI_API_KEY in a credential store or environment variable, confirm any billable request before it runs, verify broad social-media requests are meant to use Heyi, and do not run bin/publish-all.sh unless you are the maintainer and understand the publishing credentials it can use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill describes capabilities that use environment variables, filesystem access, and shell commands, but it does not declare corresponding permissions. This creates a transparency and trust problem: an agent platform may expose these capabilities without users realizing the skill can read secrets, inspect local files, or execute commands related to installation/check workflows.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The declared purpose is a scoped API-calling skill, but the documented behavior apparently extends to local agent discovery, filesystem writes, snapshot generation, and third-party publishing workflows. That mismatch can cause users or platforms to grant trust and credentials for a narrow use case while the skill actually supports broader local and external operations, increasing risk of secret exposure or unauthorized system changes.

Description-Behavior Mismatch

Medium
Confidence
77% confidence
Finding
The skill states that API-key usage is limited to /api/external/ business APIs, but later instructs use of an API-key regeneration endpoint outside that scope. Expanding into credential-management actions increases the blast radius from 'call data APIs' to 'modify authentication material', which is a materially different and more sensitive capability.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
This file is a multi-platform publishing/deployment script, which is materially unrelated to the skill’s declared purpose of calling Heyi social-media APIs. Including release automation that can publish to external marketplaces expands the skill’s capability surface and creates an unexpected path for outbound actions, supply-chain changes, and accidental deployment if the script is invoked.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The script is designed to consume third-party credentials such as marketplace, npm, and GitHub tokens for publication workflows unrelated to end-user API calls. In a skill context, access to these credentials is dangerous because it can enable unauthorized package publication, repository linking, or external account actions if the file is run in an environment where such secrets are present.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README instructs users to run destructive deletion commands during uninstall, but it does not clearly warn about irreversible data loss or advise verifying the target paths before execution. Even though the paths are scoped to the skill directory, documentation that normalizes `rm -rf` without safety guidance can lead to accidental deletion if copied, edited incorrectly, or executed in an unexpected environment.

Vague Triggers

Medium
Confidence
72% confidence
Finding
The trigger phrases are broad enough to match generic social-media data or content-processing requests, which may invoke this paid, credentialed skill in situations where the user did not intend an external API call. In context, that is more dangerous because the skill can perform billable network requests using a bearer token and may handle sensitive user queries.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger list includes broad phrases such as '视频解析', '内容数据接口', and '社媒 API' that can match many ordinary requests beyond this paid external API skill’s narrow purpose. Over-broad activation can cause the agent to route unrelated user tasks into a skill that sends data to an external service and may incur billing or expose user content unnecessarily.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The description explicitly instructs use of a Bearer API Key and external HTTP API calls, but it does not disclose that user-supplied queries, identifiers, or bodies may be transmitted to a third-party paid service. In a skill context, this omission is security-relevant because it can lead to silent external data transfer, unexpected billing, and unsafe handling of secrets or sensitive user content.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The npm publication path performs an external write operation directly once invoked, with no interactive confirmation or secondary safeguard before publishing. In environments where an agent or operator could trigger this script unintentionally, that creates a risk of accidental release, package overwrite attempts, or unauthorized distribution using available npm credentials.

Credential Access

High
Category
Privilege Escalation
Content
#
# 凭据通过环境变量提供（避免写进文件/日志）：
#   SKILLHUB_TOKEN          — SkillHub 的 skh_xxx
#   NPM_TOKEN               — npm 的 npm_xxx（或用 ~/.npmrc）
#   GITHUB_TOKEN            — 用于 ClawHub GitHub linking / SkillsMP 自动索引
#   LOBEHUB_TOKEN           — LobeHub API（如支持）
Confidence
95% confidence
Finding
The script explicitly supports using npm credentials from NPM_TOKEN or ~/.npmrc, meaning execution in a developer or CI environment could access publishing secrets. In the context of a user-facing skill, this is especially dangerous because unrelated maintainer credentials may become reachable by bundled code, enabling supply-chain compromise through unauthorized package publication.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README.md:155