ClawHub
Back to skill

Security audit

iFlow Search

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it should be reviewed because it can expose the user's iFlow API key and builds authenticated requests unsafely.

Install only if you are comfortable sending search terms and fetched URLs to iFlow. Do not run the documented echo "$IFLOW_API_KEY" check, prefer protected secret storage or a temporary environment variable instead of writing the key to ~/.zshrc, and avoid passing sensitive or attacker-controlled text until the scripts use safe JSON encoding and validate result counts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:134
Finding

API Key Disclosed Through Command Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:134-137
Vulnerability Type: Secret exposure through terminal, agent, or logging output
Risk Level: High

Vulnerable Code

bash
echo "$IFLOW_API_KEY"

Technical Analysis

The Skill instructs the agent to verify whether IFLOW_API_KEY is configured by printing its complete value. Agent command output may be retained in conversation transcripts, execution traces, monitoring platforms, terminal history, or diagnostic logs.

Revealing the secret is unnecessary for checking whether the variable exists. The check should inspect only whether the variable is non-empty and should produce no secret-bearing output.

Attack Path

  1. A user configures a valid iFlow API key in IFLOW_API_KEY.
  2. The agent follows the mandatory preflight instruction in SKILL.md.
  3. The command prints the complete key to standard output.
  4. The execution framework records that output in a transcript, trace, or log.
  5. A party with access to the recorded output extracts the key.
  6. The exposed key is reused against the iFlow API.

Impact Assessment

An attacker could exercise the permissions associated with the exposed iFlow credential, consume its API quota, issue requests attributed to the victim, and potentially access account-scoped API capabilities. This does not directly grant local host privileges, but its scope includes the remote API authority assigned to the key.

Remediation
View remediation

Remediation Suggestions

Replace the value-printing check with a silent existence test:

bash
if [[ -z "${IFLOW_API_KEY:-}" ]]; then
  printf '%s\n' "IFLOW_API_KEY is not configured." >&2
  exit 1
fi

Alternatively, use:

bash
printenv IFLOW_API_KEY >/dev/null

Never include the credential value in logs, diagnostics, error messages, or agent-visible command output. Existing keys that may have been printed should be rotated, and retained execution logs should be reviewed for exposure.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/web_search.sh:12
Finding

Unescaped Search Parameters Permit JSON Payload Manipulation

Content
View full analysis

Vulnerability Details

File Location: scripts/web_search.sh:12-13,24-31
Vulnerability Type: Improper construction of JSON from untrusted input
Risk Level: Medium

Vulnerable Code

bash
KEYWORDS="${1:?Usage: bash web_search.sh <keywords> [num]}"
NUM="${2:-15}"

curl -s -X POST "${BASE_URL}/api/search/webSearch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d "{
    \"keywords\": \"${KEYWORDS}\",
    \"num\": ${NUM}
  }"

Technical Analysis

KEYWORDS is inserted into a JSON string without JSON escaping, while NUM is inserted as a raw JSON token without numeric validation. Quotes, backslashes, control characters, or crafted values can terminate or modify the intended JSON structure. A malicious NUM value may introduce additional JSON properties or otherwise alter the request.

This is request-body manipulation rather than local shell command injection: the variables are expanded inside a quoted shell argument, so shell metacharacters contained in them are not re-evaluated as commands.

Attack Path

  1. An attacker supplies crafted search keywords or a crafted result-count argument.
  2. The script interpolates the value directly into the JSON text.
  3. The crafted characters terminate the intended string or raw numeric value.
  4. The generated request becomes malformed or contains attacker-selected JSON structure.
  5. The authenticated request is sent to the iFlow web-search endpoint using the victim's API key.

Impact Assessment

Exploitation can cause malformed authenticated requests, alter API fields accepted by the remote endpoint, consume API quota, or repeatedly trigger failures. The attacker does not obtain local command execution or additional operating-system privileges through this issue.

Remediation
View remediation

Remediation Suggestions

Validate the count as a bounded integer and use a JSON encoder:

bash
[[ "$NUM" =~ ^[0-9]+$ ]] || {
  printf '%s\n' "Result count must be an integer." >&2
  exit 1
}

(( NUM >= 1 && NUM <= 100 )) || {
  printf '%s\n' "Result count is outside the allowed range." >&2
  exit 1
}

payload="$(jq -n \
  --arg keywords "$KEYWORDS" \
  --argjson num "$NUM" \
  '{keywords: $keywords, num: $num}')"

Pass the encoded value with curl --data "$payload". Also use --fail-with-body --show-error so HTTP and transport errors are handled explicitly.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/image_search.sh:12
Finding

Unescaped Image Search Parameters Permit JSON Payload Manipulation

Content
View full analysis

Vulnerability Details

File Location: scripts/image_search.sh:12-13,24-31
Vulnerability Type: Improper construction of JSON from untrusted input
Risk Level: Medium

Vulnerable Code

bash
KEYWORDS="${1:?Usage: bash image_search.sh <keywords> [num]}"
NUM="${2:-15}"

curl -s -X POST "${BASE_URL}/api/search/imageSearch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d "{
    \"keywords\": \"${KEYWORDS}\",
    \"num\": ${NUM}
  }"

Technical Analysis

User-controlled keywords are interpolated without JSON escaping, and the result count is accepted as an arbitrary raw JSON fragment. Crafted quotes, escape sequences, control characters, or nonnumeric count values can corrupt or modify the outbound JSON body.

Because the input remains within a quoted shell argument, this does not independently provide local shell command execution. The affected security boundary is the authenticated request sent to the iFlow API.

Attack Path

  1. An attacker controls the keywords or optional result-count argument.
  2. The script inserts that input directly into the request body.
  3. Crafted syntax modifies or invalidates the JSON structure.
  4. The script submits the manipulated request with the victim's bearer credential.
  5. The remote API processes or rejects the attacker-influenced request.

Impact Assessment

The issue may permit remote request-field manipulation, denial of the intended operation, and unauthorized consumption of the victim's API quota. It does not grant direct access to local files, processes, or elevated host permissions.

Remediation
View remediation

Remediation Suggestions

Require NUM to match ^[0-9]+$, enforce a documented minimum and maximum, and serialize the payload with a JSON-aware tool:

bash
payload="$(jq -n \
  --arg keywords "$KEYWORDS" \
  --argjson num "$NUM" \
  '{keywords: $keywords, num: $num}')"

curl --fail-with-body --silent --show-error \
  -X POST "${BASE_URL}/api/search/imageSearch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data "$payload"

If adding jq, declare it as a required binary. A language-native JSON serializer is also acceptable.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/web_fetch.sh:11
Finding

Unescaped URL Permits Web-Fetch JSON Payload Manipulation

Content
View full analysis

Vulnerability Details

File Location: scripts/web_fetch.sh:11,22-28
Vulnerability Type: Improper construction of JSON from untrusted input
Risk Level: Medium

Vulnerable Code

bash
URL="${1:?Usage: bash web_fetch.sh <url>}"

curl -s -X POST "${BASE_URL}/api/search/webFetch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d "{
    \"url\": \"${URL}\"
  }"

Technical Analysis

The caller-provided URL is embedded directly inside a JSON string without escaping. A URL argument containing a quote, backslash, newline, or crafted JSON syntax can terminate the intended value and change the serialized request body.

The network transmission itself is consistent with the declared web-fetch capability: the URL and API credential must be sent to the documented iFlow endpoint. The vulnerability is the unsafe serialization of the URL, not the expected HTTPS request. The quoted shell context also prevents this defect from directly becoming shell command injection.

Attack Path

  1. An attacker provides a crafted URL to the Skill.
  2. web_fetch.sh interpolates the URL verbatim into JSON.
  3. Embedded JSON syntax terminates or changes the intended url field.
  4. The script sends the altered body to the iFlow API with the configured bearer credential.
  5. The request may invoke unintended API behavior, fail, or consume authenticated quota.

Impact Assessment

The exploitable scope is the authenticated iFlow web-fetch request. Potential effects include request-field manipulation, failed fetches, unexpected remote processing, and quota consumption. No evidence indicates that this script transmits unrelated environment variables or local files, and this issue does not directly grant local system privileges.

Remediation
View remediation

Remediation Suggestions

Serialize the URL with a JSON-aware encoder:

bash
payload="$(jq -n --arg url "$URL" '{url: $url}')"

curl --fail-with-body --silent --show-error \
  -X POST "${BASE_URL}/api/search/webFetch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data "$payload"

Additionally, parse and validate the URL before submission. Restrict accepted schemes to those supported by the service, normally http and https, and reject control characters and malformed URLs.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:42
Finding

Documentation Encourages Persistent Plaintext API Key Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:42 and SKILL.md:142-144
Vulnerability Type: Persistent plaintext credential storage
Risk Level: Medium

Vulnerable Code

bash
echo 'export IFLOW_API_KEY="YOUR_IFLOW_API_KEY"' >> ~/.zshrc

The setup instructions repeat the same persistence approach using an unquoted placeholder:

bash
echo 'export IFLOW_API_KEY=your_api_key' >> ~/.zshrc

Technical Analysis

The recommended setup writes a long-lived API credential into a general-purpose shell startup file. Such files may be included in workstation backups, diagnostic archives, dotfile repositories, or accidental file sharing. Their permissions may also be broader than those appropriate for dedicated secret storage.

Persisting the key is not required for individual API requests and exceeds the minimum secret-retention period needed for a session. This is not system persistence in the backdoor sense represented by T06; it is insecure credential handling covered by T09.

Attack Path

  1. A user follows the documented setup command.
  2. The API key is stored indefinitely in ~/.zshrc.
  3. The file is read by another local principal or copied into a backup, support archive, or dotfile repository.
  4. An unauthorized party retrieves the plaintext key.
  5. The party reuses the key against the iFlow API.

Impact Assessment

Exposure grants the attacker the remote API privileges and quota associated with the key. The issue extends the period during which the credential can be stolen but does not itself grant elevated local operating-system privileges.

Remediation
View remediation

Remediation Suggestions

Prefer one of the following approaches:

  1. Load the key from an operating-system or platform secret manager.
  2. Export it only for the current shell session.
  3. Inject it through the agent runtime's protected secret configuration.
  4. If file-based storage is unavoidable, use a dedicated secrets file restricted to mode 0600, exclude it from backups and version control, and source it only when required.

Remove instructions that append secrets to general shell initialization files. Document key rotation procedures and advise users to rotate any credential committed to a repository or included in shared logs or archives.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code chunk is narrowly focused on webpage content fetch through the iFlow API's /api/search/webFetch endpoint. It does not implement web search or image search behavior, nor any trigger logic. Because the declared description presents a broader set of capabilities than the supplied code actually provides, the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description claims three capabilities: web search, image search, and webpage content fetch. The actual code shown only performs web search by POSTing to /api/search/webSearch. There is no implementation for image search or webpage content retrieval in this chunk. The resource access and API usage are otherwise consistent with the declared iFlow Search API purpose, and use of an environment variable for the API key is a supporting detail rather than a mismatch. The mismatch is that the supplied code chunk represents only a subset of the declared functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly requires and documents shell execution via bash and curl, but it does not declare any tool scope such as permissions or allowed-tools. In an agent environment, undeclared shell capability weakens policy enforcement and can let a seemingly simple search skill execute broader command functionality than reviewers or orchestrators expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

The setup instructions tell users to persist the API key in ~/.zshrc, which increases the lifetime and exposure of a secret beyond the immediate session. Persistent shell startup files are commonly readable by local tools, inherited by future sessions, and more likely to be leaked through backups, dotfile sync, or accidental sharing, making credential compromise more likely in an agent-enabled environment.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

Setup

  1. Create an API key at https://platform.iflow.cn/profile?tab=apiKey
  2. Export it in your shell before starting the agent:
bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

The script sends user-supplied content and a bearer token to a remote third-party endpoint, which creates real confidentiality and trust-boundary risk if operators do not realize queries may contain sensitive data. In addition, the JSON body is assembled by direct shell interpolation of KEYWORDS and NUM, so malformed input can break the request structure and may result in unintended data transmission or request manipulation.

Content

Scanner excerpt · scripts/image_search.sh (reported line 24)May include surrounding context.

sh
BASE_URL="https://platform.iflow.cn"

curl -s -X POST "${BASE_URL}/api/search/imageSearch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/web_fetch.sh (reported line 22)May include surrounding context.

sh
BASE_URL="https://platform.iflow.cn"

curl -s -X POST "${BASE_URL}/api/search/webFetch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This shell script performs an HTTP POST to an external service, sending the user-provided URL and using a bearer token from an environment variable. While the script has usage comments and an error for missing credentials, it does not include any confirmation, user-facing notice, or explicit warning that data is being transmitted to a third-party endpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script's human-facing instructions, labels, and error messages are entirely in Chinese, which imposes a specific language on users without opt-in. Under the stated policy, locale or language restrictions should either offer a choice or be clearly documented as intentionally region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The script sends user-provided search terms and an API bearer token to an external third-party service, which creates a real data exposure boundary. In this skill context that behavior is expected, but it still carries privacy and supply-chain risk if sensitive queries are passed or if users are unaware that content leaves the local environment.

Content

Scanner excerpt · scripts/web_search.sh (reported line 24)May include surrounding context.

sh
BASE_URL="https://platform.iflow.cn"

curl -s -X POST "${BASE_URL}/api/search/webSearch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The file tells users to consult the Chinese section for full parameter documentation, examples, and error codes, which can impose a language requirement on users who do not read Chinese. This is a natural-language locale policy concern because the skill does not explicitly offer equivalent full documentation in the user's preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Comments and runtime messages are presented only in Chinese, which imposes a specific language on users without offering an alternative. Under the policy, forcing a language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code performs an HTTP POST to an external API, transmitting the user's search terms and using a bearer token from an environment variable. While network access is central to the script's purpose, the file does not clearly disclose that the provided keywords are sent to a third-party service, which is relevant to user privacy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

Comments, usage text, and error messages are presented only in Chinese, which imposes a specific language on users without any opt-in or stated regional limitation. This can violate language/locale policy when a skill is expected to be generally usable unless it explicitly documents the locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

This shell script sends the provided keywords to a remote API endpoint, which can expose user-entered data externally. While the script has basic usage comments and an API-key error message, it does not explicitly warn the user that their search terms will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.