ClawHub
Back to skill

Security audit

iFlow Search

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it should be reviewed because it can expose the user's iFlow API key and builds authenticated requests unsafely.

Install only if you are comfortable sending search terms and fetched URLs to iFlow. Do not run the documented echo "$IFLOW_API_KEY" check, prefer protected secret storage or a temporary environment variable instead of writing the key to ~/.zshrc, and avoid passing sensitive or attacker-controlled text until the scripts use safe JSON encoding and validate result counts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:134
Finding
API Key Disclosed Through Command Output## Vulnerability Details **File Location**: `SKILL.md:134-137` **Vulnerability Type**: Secret exposure through terminal, agent, or logging output **Risk Level**: High ### Vulnerable Code ```bash echo "$IFLOW_API_KEY" ``` ### Technical Analysis The Skill instructs the agent to verify whether `IFLOW_API_KEY` is configured by printing its complete value. Agent command output may be retained in conversation transcripts, execution traces, monitoring platforms, terminal history, or diagnostic logs. Revealing the secret is unnecessary for checking whether the variable exists. The check should inspect only whether the variable is non-empty and should produce no secret-bearing output. ### Attack Path 1. A user configures a valid iFlow API key in `IFLOW_API_KEY`. 2. The agent follows the mandatory preflight instruction in `SKILL.md`. 3. The command prints the complete key to standard output. 4. The execution framework records that output in a transcript, trace, or log. 5. A party with access to the recorded output extracts the key. 6. The exposed key is reused against the iFlow API. ### Impact Assessment An attacker could exercise the permissions associated with the exposed iFlow credential, consume its API quota, issue requests attributed to the victim, and potentially access account-scoped API capabilities. This does not directly grant local host privileges, but its scope includes the remote API authority assigned to the key.
Remediation
## Remediation Suggestions Replace the value-printing check with a silent existence test: ```bash if [[ -z "${IFLOW_API_KEY:-}" ]]; then printf '%s\n' "IFLOW_API_KEY is not configured." >&2 exit 1 fi ``` Alternatively, use: ```bash printenv IFLOW_API_KEY >/dev/null ``` Never include the credential value in logs, diagnostics, error messages, or agent-visible command output. Existing keys that may have been printed should be rotated, and retained execution logs should be reviewed for exposure.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/web_search.sh:12
Finding
Unescaped Search Parameters Permit JSON Payload Manipulation## Vulnerability Details **File Location**: `scripts/web_search.sh:12-13,24-31` **Vulnerability Type**: Improper construction of JSON from untrusted input **Risk Level**: Medium ### Vulnerable Code ```bash KEYWORDS="${1:?Usage: bash web_search.sh <keywords> [num]}" NUM="${2:-15}" curl -s -X POST "${BASE_URL}/api/search/webSearch" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d "{ \"keywords\": \"${KEYWORDS}\", \"num\": ${NUM} }" ``` ### Technical Analysis `KEYWORDS` is inserted into a JSON string without JSON escaping, while `NUM` is inserted as a raw JSON token without numeric validation. Quotes, backslashes, control characters, or crafted values can terminate or modify the intended JSON structure. A malicious `NUM` value may introduce additional JSON properties or otherwise alter the request. This is request-body manipulation rather than local shell command injection: the variables are expanded inside a quoted shell argument, so shell metacharacters contained in them are not re-evaluated as commands. ### Attack Path 1. An attacker supplies crafted search keywords or a crafted result-count argument. 2. The script interpolates the value directly into the JSON text. 3. The crafted characters terminate the intended string or raw numeric value. 4. The generated request becomes malformed or contains attacker-selected JSON structure. 5. The authenticated request is sent to the iFlow web-search endpoint using the victim's API key. ### Impact Assessment Exploitation can cause malformed authenticated requests, alter API fields accepted by the remote endpoint, consume API quota, or repeatedly trigger failures. The attacker does not obtain local command execution or additional operating-system privileges through this issue.
Remediation
## Remediation Suggestions Validate the count as a bounded integer and use a JSON encoder: ```bash [[ "$NUM" =~ ^[0-9]+$ ]] || { printf '%s\n' "Result count must be an integer." >&2 exit 1 } (( NUM >= 1 && NUM <= 100 )) || { printf '%s\n' "Result count is outside the allowed range." >&2 exit 1 } payload="$(jq -n \ --arg keywords "$KEYWORDS" \ --argjson num "$NUM" \ '{keywords: $keywords, num: $num}')" ``` Pass the encoded value with `curl --data "$payload"`. Also use `--fail-with-body --show-error` so HTTP and transport errors are handled explicitly.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/image_search.sh:12
Finding
Unescaped Image Search Parameters Permit JSON Payload Manipulation## Vulnerability Details **File Location**: `scripts/image_search.sh:12-13,24-31` **Vulnerability Type**: Improper construction of JSON from untrusted input **Risk Level**: Medium ### Vulnerable Code ```bash KEYWORDS="${1:?Usage: bash image_search.sh <keywords> [num]}" NUM="${2:-15}" curl -s -X POST "${BASE_URL}/api/search/imageSearch" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d "{ \"keywords\": \"${KEYWORDS}\", \"num\": ${NUM} }" ``` ### Technical Analysis User-controlled keywords are interpolated without JSON escaping, and the result count is accepted as an arbitrary raw JSON fragment. Crafted quotes, escape sequences, control characters, or nonnumeric count values can corrupt or modify the outbound JSON body. Because the input remains within a quoted shell argument, this does not independently provide local shell command execution. The affected security boundary is the authenticated request sent to the iFlow API. ### Attack Path 1. An attacker controls the keywords or optional result-count argument. 2. The script inserts that input directly into the request body. 3. Crafted syntax modifies or invalidates the JSON structure. 4. The script submits the manipulated request with the victim's bearer credential. 5. The remote API processes or rejects the attacker-influenced request. ### Impact Assessment The issue may permit remote request-field manipulation, denial of the intended operation, and unauthorized consumption of the victim's API quota. It does not grant direct access to local files, processes, or elevated host permissions.
Remediation
## Remediation Suggestions Require `NUM` to match `^[0-9]+$`, enforce a documented minimum and maximum, and serialize the payload with a JSON-aware tool: ```bash payload="$(jq -n \ --arg keywords "$KEYWORDS" \ --argjson num "$NUM" \ '{keywords: $keywords, num: $num}')" curl --fail-with-body --silent --show-error \ -X POST "${BASE_URL}/api/search/imageSearch" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ --data "$payload" ``` If adding `jq`, declare it as a required binary. A language-native JSON serializer is also acceptable.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/web_fetch.sh:11
Finding
Unescaped URL Permits Web-Fetch JSON Payload Manipulation## Vulnerability Details **File Location**: `scripts/web_fetch.sh:11,22-28` **Vulnerability Type**: Improper construction of JSON from untrusted input **Risk Level**: Medium ### Vulnerable Code ```bash URL="${1:?Usage: bash web_fetch.sh <url>}" curl -s -X POST "${BASE_URL}/api/search/webFetch" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d "{ \"url\": \"${URL}\" }" ``` ### Technical Analysis The caller-provided URL is embedded directly inside a JSON string without escaping. A URL argument containing a quote, backslash, newline, or crafted JSON syntax can terminate the intended value and change the serialized request body. The network transmission itself is consistent with the declared web-fetch capability: the URL and API credential must be sent to the documented iFlow endpoint. The vulnerability is the unsafe serialization of the URL, not the expected HTTPS request. The quoted shell context also prevents this defect from directly becoming shell command injection. ### Attack Path 1. An attacker provides a crafted URL to the Skill. 2. `web_fetch.sh` interpolates the URL verbatim into JSON. 3. Embedded JSON syntax terminates or changes the intended `url` field. 4. The script sends the altered body to the iFlow API with the configured bearer credential. 5. The request may invoke unintended API behavior, fail, or consume authenticated quota. ### Impact Assessment The exploitable scope is the authenticated iFlow web-fetch request. Potential effects include request-field manipulation, failed fetches, unexpected remote processing, and quota consumption. No evidence indicates that this script transmits unrelated environment variables or local files, and this issue does not directly grant local system privileges.
Remediation
## Remediation Suggestions Serialize the URL with a JSON-aware encoder: ```bash payload="$(jq -n --arg url "$URL" '{url: $url}')" curl --fail-with-body --silent --show-error \ -X POST "${BASE_URL}/api/search/webFetch" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ --data "$payload" ``` Additionally, parse and validate the URL before submission. Restrict accepted schemes to those supported by the service, normally `http` and `https`, and reject control characters and malformed URLs.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:42
Finding
Documentation Encourages Persistent Plaintext API Key Storage## Vulnerability Details **File Location**: `SKILL.md:42` and `SKILL.md:142-144` **Vulnerability Type**: Persistent plaintext credential storage **Risk Level**: Medium ### Vulnerable Code ```bash echo 'export IFLOW_API_KEY="YOUR_IFLOW_API_KEY"' >> ~/.zshrc ``` The setup instructions repeat the same persistence approach using an unquoted placeholder: ```bash echo 'export IFLOW_API_KEY=your_api_key' >> ~/.zshrc ``` ### Technical Analysis The recommended setup writes a long-lived API credential into a general-purpose shell startup file. Such files may be included in workstation backups, diagnostic archives, dotfile repositories, or accidental file sharing. Their permissions may also be broader than those appropriate for dedicated secret storage. Persisting the key is not required for individual API requests and exceeds the minimum secret-retention period needed for a session. This is not system persistence in the backdoor sense represented by T06; it is insecure credential handling covered by T09. ### Attack Path 1. A user follows the documented setup command. 2. The API key is stored indefinitely in `~/.zshrc`. 3. The file is read by another local principal or copied into a backup, support archive, or dotfile repository. 4. An unauthorized party retrieves the plaintext key. 5. The party reuses the key against the iFlow API. ### Impact Assessment Exposure grants the attacker the remote API privileges and quota associated with the key. The issue extends the period during which the credential can be stolen but does not itself grant elevated local operating-system privileges.
Remediation
## Remediation Suggestions Prefer one of the following approaches: 1. Load the key from an operating-system or platform secret manager. 2. Export it only for the current shell session. 3. Inject it through the agent runtime's protected secret configuration. 4. If file-based storage is unavoidable, use a dedicated secrets file restricted to mode `0600`, exclude it from backups and version control, and source it only when required. Remove instructions that append secrets to general shell initialization files. Document key rotation procedures and advise users to rotate any credential committed to a repository or included in shared logs or archives.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The code chunk is narrowly focused on webpage content fetch through the iFlow API's /api/search/webFetch endpoint. It does not implement web search or image search behavior, nor any trigger logic. Because the declared description presents a broader set of capabilities than the supplied code actually provides, the description does not accurately represent this code chunk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The description claims three capabilities: web search, image search, and webpage content fetch. The actual code shown only performs web search by POSTing to /api/search/webSearch. There is no implementation for image search or webpage content retrieval in this chunk. The resource access and API usage are otherwise consistent with the declared iFlow Search API purpose, and use of an environment variable for the API key is a supporting detail rather than a mismatch. The mismatch is that the supplied code chunk represents only a subset of the declared functionality.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill explicitly requires and documents shell execution via bash and curl, but it does not declare any tool scope such as permissions or allowed-tools. In an agent environment, undeclared shell capability weakens policy enforcement and can let a seemingly simple search skill execute broader command functionality than reviewers or orchestrators expect.

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

1. Create an API key at https://platform.iflow.cn/profile?tab=apiKey
2. Export it in your shell **before** starting the agent:

```bash
Confidence
92% confidence
Finding
The setup instructions tell users to persist the API key in ~/.zshrc, which increases the lifetime and exposure of a secret beyond the immediate session. Persistent shell startup files are commonly readable by local tools, inherited by future sessions, and more likely to be leaked through backups, dotfile sync, or accidental sharing, making credential compromise more likely in an agent-enabled environment.

External Transmission

Medium
Category
Data Exfiltration
Content
BASE_URL="https://platform.iflow.cn"

curl -s -X POST "${BASE_URL}/api/search/imageSearch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
Confidence
70% confidence
Finding
The script sends user-supplied content and a bearer token to a remote third-party endpoint, which creates real confidentiality and trust-boundary risk if operators do not realize queries may contain sensitive data. In addition, the JSON body is assembled by direct shell interpolation of KEYWORDS and NUM, so malformed input can break the request structure and may result in unintended data transmission or request manipulation.

External Transmission

Medium
Category
Data Exfiltration
Content
BASE_URL="https://platform.iflow.cn"

curl -s -X POST "${BASE_URL}/api/search/webFetch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This shell script performs an HTTP POST to an external service, sending the user-provided URL and using a bearer token from an environment variable. While the script has usage comments and an error for missing credentials, it does not include any confirmation, user-facing notice, or explicit warning that data is being transmitted to a third-party endpoint.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
The script's human-facing instructions, labels, and error messages are entirely in Chinese, which imposes a specific language on users without opt-in. Under the stated policy, locale or language restrictions should either offer a choice or be clearly documented as intentionally region-specific.

External Transmission

Medium
Category
Data Exfiltration
Content
BASE_URL="https://platform.iflow.cn"

curl -s -X POST "${BASE_URL}/api/search/webSearch" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
Confidence
85% confidence
Finding
The script sends user-provided search terms and an API bearer token to an external third-party service, which creates a real data exposure boundary. In this skill context that behavior is expected, but it still carries privacy and supply-chain risk if sensitive queries are passed or if users are unaware that content leaves the local environment.

Natural-Language Policy Violations

Low
Confidence
85% confidence
Finding
The file tells users to consult the Chinese section for full parameter documentation, examples, and error codes, which can impose a language requirement on users who do not read Chinese. This is a natural-language locale policy concern because the skill does not explicitly offer equivalent full documentation in the user's preferred language.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
Comments and runtime messages are presented only in Chinese, which imposes a specific language on users without offering an alternative. Under the policy, forcing a language or locale without user opt-in is a natural-language policy concern.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This code performs an HTTP POST to an external API, transmitting the user's search terms and using a bearer token from an environment variable. While network access is central to the script's purpose, the file does not clearly disclose that the provided keywords are sent to a third-party service, which is relevant to user privacy expectations.

Natural-Language Policy Violations

Low
Confidence
85% confidence
Finding
Comments, usage text, and error messages are presented only in Chinese, which imposes a specific language on users without any opt-in or stated regional limitation. This can violate language/locale policy when a skill is expected to be generally usable unless it explicitly documents the locale restriction.

Missing User Warnings

Low
Confidence
76% confidence
Finding
This shell script sends the provided keywords to a remote API endpoint, which can expose user-entered data externally. While the script has basic usage comments and an API-key error message, it does not explicitly warn the user that their search terms will be transmitted to a third-party service.

Static analysis

No suspicious patterns detected.