ClawHub
Back to skill

Security audit

店店通·汽车后市场门店网络分析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent API integration for automotive service-store network analysis, with one credential-handling caveat users should configure carefully.

Before installing, use the official HTTPS API base unless you intentionally trust another endpoint, keep DDT_API_KEY out of chats/logs/repos, and rotate the key if it may have been used with an untrusted DDT_OPEN_BASE value.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:24
Finding

Unvalidated API Base URL Can Expose the Bearer Credential

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–82
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

The Skill permits the API base URL to be supplied through the existing DDT_OPEN_BASE environment variable. The documented requests then send the DDT_API_KEY bearer credential to that URL without validating its scheme or hostname.

bash
export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"
bash
curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/regions" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/nearby" \
  --data-urlencode "lng=120.6" \
  --data-urlencode "lat=31.3" \
  --data-urlencode "radius=3000"

Technical Analysis

The shell expansion preserves any preexisting value of DDT_OPEN_BASE; the official endpoint is used only when the variable is unset or empty. No origin allowlist, HTTPS requirement, hostname check, or redirect policy is specified before the Authorization header is attached.

Consequently, an attacker who can influence the execution environment could set DDT_OPEN_BASE to an attacker-controlled server. Running any documented request would then transmit the bearer credential to that server. An HTTP endpoint could additionally expose the credential to network interception.

This issue does not independently grant environment modification privileges. Exploitation requires prior influence over the environment or configuration used to launch the Skill.

Attack Path

  1. An attacker, compromised launcher, or unsafe env ...[truncated 924 chars]
Remediation
View remediation

Remediation Suggestions

  • Hard-code the production API origin when attaching production credentials, preferably https://gotoshop-ai.com/ddtclaw.
  • If endpoint overrides are necessary, parse and validate the URL before making a request. Require HTTPS, an exact approved hostname, and an approved port and path prefix.
  • Reject URLs containing user information, unexpected ports, or unapproved hosts.
  • Prevent authenticated requests from following redirects to a different origin. Configure curl not to follow redirects, or explicitly validate every redirect destination before forwarding the Authorization header.
  • Use separate, minimally privileged test credentials for development endpoints rather than allowing production credentials to be sent to arbitrary override URLs.
  • Sanitize inherited environment variables in launch scripts or controlled runtimes.
  • Rotate the API key immediately if it may have been used while DDT_OPEN_BASE pointed to an untrusted destination.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep