ClawHub
Back to skill

Security audit

AI KEY·找对标

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for creator benchmarking, but it asks users to create broad API credentials and store/read them from a shared local plaintext file.

Install only if you are comfortable using TikHub and possibly paying per request. Prefer a limited-scope or temporary API key if available, avoid storing it in ~/.env, and do not let the agent display or browse unrelated local secrets. Confirm the target account and estimated cost before any scrape, and avoid any path that requires logging into personal social or WeChat accounts unless you accept the account-risk warning.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Credential Access

High
Category
Privilege Escalation
Content
**第 5 步**　把 key 存起来。在电脑上打开「终端」，粘这一行（把 `你的key` 换掉）后回车：

```bash
echo 'TIKHUB_API_KEY=你的key' >> ~/.env
```

脚本会自己去 `~/.env` 读，之后不用再管。
Confidence
96% confidence
Finding
The document instructs storing an API key in ~/.env and states the script will read it automatically. Persisting secrets in a broadly reused plaintext file increases the chance of accidental disclosure to other tools, prompts, logs, backups, or future agent runs, especially because the same guide also encourages inspecting that file.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The Chinese trigger phrases include very common conversational requests such as “我该学谁”, “帮我找个对标”, and “这个号值不值得学”, which can plausibly appear in normal chat without user intent to invoke this specific skill. That creates a trigger-injection/scope-confusion risk where the skill may activate unintentionally and begin a workflow involving external lookup, data collection, and cost-bearing steps.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The English examples like “find me a benchmark account” and “is this creator worth learning from” are ordinary request phrasings rather than unambiguous invocation tokens. In this skill, unintended activation is more concerning because the workflow explicitly proceeds into account identification, scraping guidance, and paid-request estimation, so accidental triggering can cause privacy, cost, or unwanted external-action risk.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The manual tells the operator to execute shell commands and install/use external tooling, expanding the skill from analysis into system interaction. In an agent context, this increases the attack surface because a content-analysis skill should not need command execution to fulfill its core purpose, and such instructions can lead to unsafe host-side actions.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The guide explicitly instructs checking environment variables and reading ~/.env to discover credentials. For a content-benchmarking skill, directing access to local secret storage exceeds the minimum required scope and normalizes secret inspection, which can expose unrelated credentials if followed broadly or automated by an agent.

Session Persistence

Medium
Category
Rogue Agent
Content
**第 2 步**　登录后进 https://user.tikhub.io ，左边找到「**API Keys**」。

**第 3 步**　点「Create API Key」，名字随便起（比如 `aikey`），**权限全选**（要用到抖音、小红书、视频号三块）。

**第 4 步**　生成后**立刻复制那串 key**——它只完整显示一次，关掉页面就看不全了。
Confidence
95% confidence
Finding
This duplicate finding points to the same behavior: generating a full-permission API key and persisting it for repeated use. In the context of an agent skill, persistent broad-scope credentials materially increase blast radius if exposed through logs, prompts, local files, or third-party tooling.

Session Persistence

Medium
Category
Rogue Agent
Content
**第 2 步** 登录后进 https://user.tikhub.io ,左边找到「**API Keys**」。

**第 3 步** 点「Create API Key」,名字随便起(比如 `aikey`),**权限全选**(要用到抖音、小红书、视频号三块)。

**第 4 步** 生成后**立刻复制那串 key**——它只完整显示一次,关掉页面就看不全了。
Confidence
95% confidence
Finding
This duplicate finding points to the same behavior: generating a full-permission API key and persisting it for repeated use. In the context of an agent skill, persistent broad-scope credentials materially increase blast radius if exposed through logs, prompts, local files, or third-party tooling.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
Line L183 states '必须原话说给用户', and the entire required warning text is fixed in Chinese. This imposes a specific language on user-facing output without opt-in or an explicit region-specific justification, which conflicts with the language/locale policy criteria.

Static analysis

No suspicious patterns detected.