ClawHub
Back to skill

Security audit

ima skills

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its IMA notes and knowledge-base purpose, but it has review-worthy credential and update-handling risks.

Review before installing. Use it only if you trust the publisher and can constrain execution to the official IMA and COS domains. Avoid setting IMA_BASE_URL or passing a custom baseUrl, store API credentials in a secret manager or protected files instead of plain echo-created files, and treat any update instruction returned by the service as untrusted text requiring explicit user confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
ima_api.cjs:114
Finding

Remote Update Response Can Hijack Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: ima_api.cjs:114-134; SKILL.md:162-170
Vulnerability Type: Untrusted remote content treated as agent instructions
Risk Level: High

Vulnerable Code

js
const latestVersion = (updateResp.data && updateResp.data.latest_version) || '';
const releaseDesc = (updateResp.data && updateResp.data.release_desc) || '';
const instruction = (updateResp.data && updateResp.data.instruction) || '';
if (latestVersion && latestVersion !== skillVersion) {
  const updateContext = {
    current_version: skillVersion,
    latest_version: latestVersion,
    release_desc: releaseDesc,
    instruction,
    checked_at: new Date().toISOString(),
  };

  process.stdout.write(JSON.stringify(updateContext));

  const err = new Error('update available');
  err.code = ERR_UPDATE_AVAILABLE;
  err.msg = `发现新版本 skill：${latestVersion}（当前版本：${skillVersion}）。${instruction || '请更新。'}`;
  err.updateContext = updateContext;
  throw err;
}

The corresponding instructions in SKILL.md:162-170 identify the remote instruction field as prompt text and direct the agent to use it to guide the update process.

Technical Analysis

The automatic update check retrieves instruction from a mutable API response and places it in both standard output and the surfaced error message. The Skill instructions then tell the agent to follow that field as an update prompt.

No allowlist, command schema, content sanitization, cryptographic signature, or separation between untrusted release data and trusted agent instructions is applied. Consequently, control of the update response provides an instruction-injection channel into the current agent session.

The update check runs automatically before normal API requests, generally once per day. If the returned version differs from the local version, the original user operation is interrupted, increasing the likelihood ...[truncated 1342 chars]

Remediation
View remediation

Remediation Suggestions

  1. Never interpret server-provided instruction, release_desc, or similar fields as agent instructions.
  2. Remove the requirement in SKILL.md to follow the remote field. Present release information only as quoted, untrusted data.
  3. Implement update behavior through a fixed local workflow with a strict set of permitted actions.
  4. Require explicit user confirmation before any update, installation, file replacement, or command execution.
  5. Authenticate update metadata with a pinned public key and verify a detached signature before displaying it.
  6. Validate update responses against a strict schema, including a constrained semantic-version format and bounded inert text fields.
  7. Do not interrupt the original operation merely because free-form remote text is present. If an update is available, return a locally generated notification.
  8. Ensure no remote field can be passed to a shell, package manager, URL-fetching tool, or agent prompt.

T09 · Insecure Skill Coding Practices

Error
Location
ima_api.cjs:138
Finding

IMA API Credentials Can Be Redirected to an Arbitrary Endpoint

Content
View full analysis

Vulnerability Details

File Location: ima_api.cjs:64-79; ima_api.cjs:138-151
Vulnerability Type: Unrestricted credential-bearing API destination override
Risk Level: High

Vulnerable Code

js
async function postJson(apiPath, body, requestOptions) {
  const { clientId, apiKey, skillVersion, baseUrl } = requestOptions;

  const res = await fetch(`${baseUrl}/${apiPath}`, {
    method: 'POST',
    headers: {
      'ima-openapi-clientid': clientId,
      'ima-openapi-apikey': apiKey,
      'ima-openapi-ctx': `skill_version=${skillVersion}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(body),
  });

  return await res.text();
}
js
async function imaApi(apiPath, body, options = {}) {
  const forceCheck = options.forceCheck || options.forceUpdateCheck || process.env.IMA_FORCE_UPDATE_CHECK === '1';
  const baseUrl = options.baseUrl || process.env.IMA_BASE_URL || DEFAULT_BASE_URL;
  const lastCheckFile = options.lastCheckFile || process.env.IMA_LAST_CHECK_FILE || DEFAULT_LAST_CHECK_FILE;
  const { clientId, apiKey } = loadCredentials(options);
  const skillVersion = loadSkillVersion(options);

  const requestOptions = {
    forceCheck,
    clientId,
    apiKey,
    skillVersion,
    baseUrl,
    lastCheckFile,
  };

Technical Analysis

The Skill documentation states that user credentials are sent only to https://ima.qq.com. The implementation does not enforce that restriction. Instead, baseUrl can be supplied through the caller-controlled options object or the IMA_BASE_URL environment variable.

Credentials are loaded independently from options, environment variables, or files under ~/.config/ima. The selected Client ID and API key are then attached as HTTP headers to every request sent through the overridden baseUrl.

There is no URL parsing, HTTPS enforcement, exact-origin allowlist, hostname validation, or devel ...[truncated 1650 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the baseUrl option and IMA_BASE_URL override from production builds.
  2. Parse the destination with the standard URL class and require:
    • protocol exactly https:;
    • hostname exactly ima.qq.com;
    • the expected port or no explicit port;
    • no embedded username or password.
  3. Construct API URLs from a constant trusted origin and validate apiPath as a relative allowlisted API path.
  4. Configure redirects defensively. Reject any redirect to a different origin and never forward authentication headers across origins.
  5. If endpoint overrides are required for testing, place them behind an explicit development mode that refuses to load credentials from production environment variables or ~/.config/ima.
  6. Use separate, non-production test credentials with narrowly scoped permissions for local testing.
  7. Add automated tests proving that malicious origins, alternate ports, userinfo URLs, malformed hosts, and cross-origin redirects are rejected before credentials are loaded or transmitted.
  8. Rotate potentially exposed API keys after deploying the corrected implementation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (28)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares allowed domains in metadata, but it does not declare an explicit tool scope such as permissions or allowed-tools while requiring environment-variable access and outbound network access. In agent frameworks, missing explicit tool scoping can cause over-broad runtime capabilities or make policy enforcement ambiguous, increasing the chance that credentials or network actions are available in contexts the author did not narrowly constrain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
71% confidence
Finding

The natural-language description and invocation guidance are written entirely around Chinese trigger phrases and Chinese user interactions, with no indication that the user may choose another language. This can amount to a locale/language constraint that is not explicitly documented as optional or region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is extremely broad and matches common phrases like '帮我记一下' or generic document-storage intents, which can cause the skill to activate for many unrelated requests. Over-broad activation increases the chance of unintended access to personal notes, knowledge-base data, or credentialed API actions without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
1. **UTF-8 encoding (notes writes only):** Before calling `import_doc` or `append_doc`, ALL string fields (`content`, `title`) MUST be validated as legal UTF-8. Non-UTF-8 content causes irreversible garbled text. See [Detailed Rules](#detailed-utf-8-encoding-rules) for platform-specific methods.
2. **File upload naming:** `title` MUST equal `file_name` (with extension). Never rename, shorten, translate, or modify the original filename.
3. **Unsupported file types:** Reject immediately with a clear message. Do NOT ask user "do you still want to try?" Video files, Bilibili/YouTube URLs, and `file://` URLs are not supported — tell user to use IMA desktop client.
4. **File upload integrity:** Keep file content as-is during upload. No encoding conversion for binary files (PDF, images, Excel, etc.).
5. **PowerShell 5.1 (all modules):** If running in PowerShell, detect version before first API call. PS 5.1 silently converts request Body to GBK — must use UTF-8 byte array mode. See [Detailed Rules](#powershell-51-environment-detection).

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
## 模块决策表

| 用户意图                                                                                   | 模块           | 读取                      |
| ------------------------------------------------------------------------------------------ | -------------- | ------------------------- |
| 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容                                     | notes          | `notes/SKILL.md`          |
| 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · notes/references/api.md (reported line 66)May include surrounding context.

md
## 模块决策表

| 用户意图                                                                                   | 模块           | 读取                      |
| ------------------------------------------------------------------------------------------ | -------------- | ------------------------- |
| 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容                                     | notes          | `notes/SKILL.md`          |
| 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The skill instructs users to persist API credentials in plaintext files under ~/.config/ima, which creates a local secret-at-rest exposure risk. If the host is multi-user, backed up insecurely, synced, or later accessed by another process, the credentials can be stolen and used to access the user's IMA account and data.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

方式 A — 配置文件（推荐）：

bash
mkdir -p ~/.config/ima
echo "your_client_id" > ~/.config/ima/client_id
echo "your_api_key" > ~/.config/ima/api_key

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This function accesses API credentials from environment variables and files under ~/.config/ima, which is sensitive data handling. The file does not include a user-facing warning, confirmation, or explanatory comment describing that credential sources will be read.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The helper sends API credentials in headers and transmits the provided request body to a remote service via fetch, but there is no confirmation prompt, logging, or explanatory comment/docstring warning users that data will be sent off-host. For a generic API wrapper, this outbound transmission is safety-relevant and not disclosed within the file.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · knowledge-base/SKILL.md (reported line 7)May include surrounding context.

md
## 接口决策表

| 用户意图                                      | 调用接口                                                               | 关键参数                                                                                           |
| --------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| 上传文件到知识库                              | `check_repeated_names` → `create_media` → COS Upload → `add_knowledge` | `media_type`（按扩展名），`knowledge_base_id`，`file_name`，`file_size`                            |
| 上传文件到知识库的某个文件夹                  | 先定位文件夹 → 同上（`folder_id` 传入目标文件夹 ID）                   | 见「文件夹操作」章节                                                                               |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · knowledge-base/references/api.md (reported line 154)May include surrounding context.

md
## 接口决策表

| 用户意图                                      | 调用接口                                                               | 关键参数                                                                                           |
| --------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| 上传文件到知识库                              | `check_repeated_names` → `create_media` → COS Upload → `add_knowledge` | `media_type`（按扩展名），`knowledge_base_id`，`file_name`，`file_size`                            |
| 上传文件到知识库的某个文件夹                  | 先定位文件夹 → 同上（`folder_id` 传入目标文件夹 ID）                   | 见「文件夹操作」章节                                                                               |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation instructs users to include long-lived API keys in headers and later exposes temporary COS credentials, but it does not warn that these values are secrets that must not be logged, embedded in client-side code, or disclosed to end users. In a skill/integration context, omission of secret-handling guidance can lead implementers to leak credentials through prompts, traces, browser requests, or debugging output, enabling unauthorized API or storage access.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · knowledge-base/references/api.md (reported line 156)May include surrounding context.

md
| 值  | 名称           | content_type / 说明                                                                                           |
| --- | -------------- | ------------------------------------------------------------------------------------------------------------- |
| 1   | PDF            | `application/pdf`                                                                                             |
| 2   | 网页           | N/A（直接 AddKnowledge，`web_info.content_id=<url>`）                                                         |
| 3   | Word           | `application/msword` / `application/vnd.openxmlformats-officedocument.wordprocessingml.document`              |
| 4   | PPT            | `application/vnd.ms-powerpoint` / `application/vnd.openxmlformats-officedocument.presentationml.presentation` |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · knowledge-base/references/api.md (reported line 166)May include surrounding context.

md
| 9   | 图片           | `image/png`, `image/jpeg`, `image/webp`                                                                       |
| 11  | 笔记           | N/A（直接 AddKnowledge，`note_info.content_id=<doc_id>`）                                                     |
| 12  | AI会话         | N/A（直接 AddKnowledge，`session_info.content_id=<session_id>`）                                              |
| 13  | TXT            | `text/plain`                                                                                                  |
| 14  | Xmind          | `application/x-xmind` / `application/vnd.xmind.workbook` / `application/zip`                                  |
| 15  | 录音           | `audio/mpeg`(mp3), `audio/x-m4a`(m4a), `audio/wav`(wav), `audio/aac`(aac)                                     |
| 16  | 视频解析       | **不支持通过 skill 添加**。Bilibili/YouTube/本地HTML等仅支持在 ima 桌面端内添加进知识库                       |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · knowledge-base/references/api.md (reported line 467)May include surrounding context.

md
#### 返回字段（`data` 内）

| 字段                | 类型            | 说明                                                                                              |
| ------------------- | --------------- | ------------------------------------------------------------------------------------------------- |
| `media_type`        | int32           | 媒体类型（见 MediaType 枚举）                                                                     |
| `url_info`          | URLInfo         | 访问链接信息，非笔记类型时填写（见 [URLInfo](#urlinfo访问链接信息)）                              |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document directs the consumer to request returned URLs together with supplied headers, but does not warn that those headers may contain bearer tokens or other authorization material for protected content. In an agent skill, blindly replaying server-provided URLs and headers can cause credential forwarding to untrusted destinations, SSRF-like behavior, or unintended access to sensitive documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The authentication section instructs clients to send a client ID and API key but does not explicitly warn that these are secrets that must never be exposed in prompts, logs, examples, or user-visible output. For agent-integrated skills, missing secret-handling guidance increases the chance of credential leakage through debugging, error messages, or prompt injection side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger guidance uses broad natural-language phrases such as generic 'search/find notes' patterns, which can cause the skill to activate when the user did not intend to access private note data. In a privacy-sensitive notes context, accidental invocation can lead to unnecessary retrieval of notebooks, note metadata, or contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation describes create and append behaviors but does not clearly warn that these actions modify persistent user data. In a privacy-focused notes skill, insufficient disclosure raises the risk of users unknowingly causing durable writes, which can expose, retain, or alter sensitive information beyond the current conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The create-note trigger description includes broad phrases like saving content as a note without requiring a clear write-intent confirmation. That increases the chance of unintended persistent data creation, which is a user-data integrity and privacy issue because conversation content may be stored durably without sufficient user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Appending to an existing note is a state-changing operation, and the trigger guidance does not impose strict enough conditions before performing that write. In a note-management skill, accidental append operations can silently alter user records, corrupt note contents, or add sensitive chat material to the wrong note.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The error message text is hard-coded in Chinese, and similar Chinese-only messages appear elsewhere in the file. Because the skill does not offer language selection or justify a Chinese-only locale requirement, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes a unified IMA OpenAPI skill for note management and knowledge-base actions such as upload, search, browse, create, and edit. This code additionally performs a daily version-update check against a separate endpoint and writes update-check state to a local file, which is an operational capability not justified by the user-facing skill purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This user-visible parse error message is emitted only in Chinese, which forces a specific language for users regardless of their locale. No opt-in or documented locale restriction is present in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The options parsing error shown to users is only available in Chinese. This enforces a language choice without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
ima_api.cjs:31

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
knowledge-base/scripts/cos-upload.cjs:96