ClawHub
Back to skill

Security audit

Dao3 Statistics

Security checks for vulnerabilities and agentic risk

Overview

This DAO3 query skill is mostly transparent, but it needs review because it accepts account tokens on the command line and includes a broad raw API endpoint mode that can access more authenticated DAO3 data than the curated commands.

Review before installing if you plan to use authenticated DAO3 features. Prefer not to paste long-lived account tokens into chat or shell commands, rotate any token that may have been exposed, and avoid the raw endpoint mode unless you intentionally want unrestricted read access to DAO3 API paths under your account token.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dao3_statistics/cli.py:16
Finding

Authentication Token Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/dao3_statistics/cli.py, lines 16-18
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python
def _add_auth_args(parser: argparse.ArgumentParser) -> None:
    parser.add_argument("--token", type=str, required=True)
    parser.add_argument("--user-agent", type=str, required=True)

The documented invocation in SKILL.md, lines 238-245, also encourages passing the token directly on the command line:

bash
python3 -m dao3_statistics stats-player \
  --start-time 2025-03-29 \
  --end-time 2025-04-04 \
  --map-id 100131463 \
  --token "YOUR_TOKEN" \
  --user-agent "Mozilla/5.0 ..."

Technical Analysis

Authenticated commands accept the DAO3 token as an ordinary command-line argument. Depending on the operating system and shell configuration, command-line arguments can be:

  • Recorded in persistent shell history.
  • Exposed through process inspection interfaces while the command is running.
  • Captured by process-monitoring, diagnostic, audit, or job-management systems.
  • Retained in terminal logs or automation records.

The application does not provide a safer credential-input mechanism such as hidden interactive input, a protected credential file, or an operating-system credential store. Although environment variables can also leak in some environments, they generally avoid routine shell-history and process-command-line disclosure when used carefully.

Attack Path

  1. A victim invokes an authenticated command with --token.
  2. The token is stored in shell history or remains visible in the process argument list while the request runs.
  3. A local user, monitoring process, log collector, or other principal with access to that metadata retrieves the token.
  4. The attacker replays the token in the Authorization header when communicating with DAO3.
  5. The attacke ...[truncated 907 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer hidden interactive input using getpass.getpass() when a token is not supplied through a secure integration.
  2. Support an operating-system credential store or a protected configuration file with restrictive permissions.
  3. For non-interactive operation, support a dedicated environment variable while documenting its residual exposure risks and discouraging unsafe logging.
  4. Deprecate or disable --token by default. If compatibility requires retaining it, display an explicit warning that the value may enter shell history and process metadata.
  5. Replace the token-bearing command example in SKILL.md with a secure-input example.
  6. Ensure CI systems and automation platforms use masked secret variables and do not echo complete commands.
  7. Document token revocation and rotation procedures so exposed credentials can be invalidated promptly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Based on the provided code chunk alone, the implementation is just a minimal program entrypoint that delegates execution to .cli.main(). The declared description promises a rich set of 神岛 platform query and authenticated statistics/message retrieval capabilities, but none of those behaviors are present or evidenced in this snippet. Since the evaluation must compare the supplied code chunk to the declared purpose, this is a mismatch: the actual visible behavior is only command-line startup wiring, which materially underrepresents and does not substantiate the declared functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The raw subcommand exposes arbitrary endpoint access beyond the documented scope of this skill, which is supposed to support specific Dao3 profile, map, message, and statistics queries. In an agent setting, this can be abused to query unintended internal or undocumented API paths, including authenticated ones when token and user-agent are supplied, expanding the skill into a generic data-exfiltration interface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Allowing arbitrary endpoint retrieval is inconsistent with the skill's stated purpose and undermines least privilege. Because the skill already accepts authentication material for some commands, the raw mode could let a user or prompt route those credentials to broader account data or undocumented resources not intended by the manifest.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill explicitly requires internet access and documents many remote API calls, but the manifest does not declare any tool scope or allowed-tools restrictions. In agent environments, this weakens governance and makes it harder to constrain or audit what external access the skill may use, especially alongside the documented broad raw network capability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation rule says the skill should trigger even when the user does not explicitly mention DAO3, based on loosely similar requests. Over-broad activation can cause the agent to route unrelated user tasks into a networked skill, increasing the chance of unnecessary external queries, accidental data disclosure, or inappropriate credential solicitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to supply a DAO3 token and browser-like user-agent for authenticated endpoints without warning that these are sensitive credentials. In an agent context, this can normalize sharing secrets into tool flows, increasing risk of credential leakage, reuse, logging exposure, or unauthorized account access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The raw command turns the skill into a generic upstream API proxy, allowing access beyond the narrowly described user/map/statistics workflows. If an agent is induced to use this escape hatch with provided credentials, it could query unintended sensitive endpoints, expanding data exposure and reducing policy control.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

A broad endpoint-proxy capability is inconsistent with a specialized statistics/query skill and increases the chance of misuse, privilege creep, and access to data outside user expectations. Even if intended for debugging, it bypasses the safer abstraction of purpose-built commands and weakens least-privilege design.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code file defines reusable authentication arguments for multiple commands, requiring users to provide a token and user-agent that are then passed to client functions for remote requests. There is no confirmation prompt, help text, print/log disclosure, or inline warning explaining that sensitive credentials will be transmitted to external endpoints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The raw_get function exposes a generic authenticated fetch primitive that can call arbitrary API endpoints, which exceeds the skill’s stated purpose of providing specific Dao3 statistics/profile queries. In an agent setting, this broad capability can be abused to access undocumented or sensitive endpoints using user-supplied tokens, bypassing the safety implied by the curated wrapper functions.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/dao3_statistics/cli.py (reported line 243)May include surrounding context.

python
args = parser.parse_args(argv)
    fn = getattr(args, "_fn")
    mapping = getattr(args, "_map")
    kwargs = {k: getattr(args, v) for k, v in mapping.items()}
    _run_and_print(fn, kwargs)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code file makes multiple HTTP requests using authentication headers derived from token and user_agent, including message and statistics endpoints. Within this file there is no confirmation prompt, logging, or explanatory comment/docstring disclosing that user/account data will be sent over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The raised ValueError contains a Chinese-only message (token 和 user_agent 必须同时提供). This is a natural-language locale choice embedded in code with no indication that users can opt into that language or that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.