ClawHub
Back to skill

Security audit

高德地图地址·餐饮开关店与竞对分析

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently guides restaurant-network analysis through a documented API, with no hidden execution or persistence, but users should verify the API endpoint before sending their key.

Before using the skill, create a dedicated low-privilege API key if available and confirm DDT_OPEN_BASE is exactly the intended HTTPS service URL. Do not run the example curl commands in an environment where that variable may have been set by someone else.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:30
Finding

Bearer Token Disclosure Through Attacker-Controlled API Base URL

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–34 and 88–106
Vulnerability Type: Unvalidated endpoint configuration leading to credential disclosure
Risk Level: High

Vulnerable Code

bash
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"
test -n "$DDT_API_KEY"
text
Requests uniformly use `Authorization: Bearer $DDT_API_KEY`.
bash
curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/network/nearby" \
  --data-urlencode "q=北京航空科技大厦" \
  --data-urlencode "city=北京市" \
  --data-urlencode "radius_m=1000" \
  --data-urlencode "size=10"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/network/sales-shortlist" \
  --data-urlencode "brand=茉莉奶白" \
  --data-urlencode "city=上海市" \
  --data-urlencode "months=6" \
  --data-urlencode "size=10"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/network/stores" \
  --data-urlencode "brand=% Arabica" \
  --data-urlencode "q=浦东" \
  --data-urlencode "city=上海市" \
  --data-urlencode "size=10"

Technical Analysis

The setup preserves any preexisting value of DDT_OPEN_BASE instead of pinning or validating the documented service origin. The subsequent commands attach Authorization: Bearer $DDT_API_KEY to requests constructed from that variable.

No validation requires HTTPS or verifies that the parsed hostname is exactly gotoshop-ai.com. Therefore, an attacker who can influence the environment may redirect authenticated requests to an arbitrary endpoint. Shell quoting prevents command injection through this variable, but it does not prevent credential exfiltration at the HTTP destination.

The same requests can also disclose user-submitted addresses, landmarks, brand names, geographic filters, and business-analysis queries.

Attack Path

  1. An attacker gains the ability to define environm ...[truncated 1287 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the API origin rather than inheriting an arbitrary environment value:

    bash
    readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"

  2. If endpoint configurability is required, parse and validate it before attaching credentials. Require:

    • The https scheme.
    • An exact approved hostname.
    • An approved port.
    • An expected base path.
    • No embedded user information.
    • No ambiguous hostname suffix matching.

  3. Construct authenticated requests only after validation succeeds. Abort on every unapproved origin.

  4. Restrict redirects. Prefer --max-redirs 0; if redirects are necessary, validate every destination and never forward authorization credentials across origins.

  5. Keep the key in a minimally scoped secret store or process environment, apply least-privilege API permissions, and rotate it periodically.

  6. Document that users must clear or inspect inherited endpoint variables before making authenticated requests.

  7. Revoke and rotate any API key that may already have been used while DDT_OPEN_BASE pointed to an untrusted endpoint.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep