T09 · Insecure Skill Coding Practices
Error
- Location
debug.md:5- Finding
Verbose HTTP Diagnostics Can Disclose Authentication Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
API / Application Programming Interface
Security checks for vulnerabilities and agentic risk
Overview
This API reference skill is not malware, but it needs Review because it persists inferred API context and includes copyable examples that can expose credentials or trigger financial or public side effects if used live.
Before installing, decide whether you want this skill to read and write API preference and memory files under ~/Clawic/data/api/. Review that directory periodically and do not let it store account identifiers, credentials, confidential request data, or stale assumptions. Use sandbox or scoped temporary credentials for examples, avoid unredacted verbose logs, and require explicit confirmation before live payment, crypto, deletion, posting, or moderation actions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
other
Warning
- Location
setup.md:15- Finding
Inferred User and Account Context Is Persisted Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
apis/media.md:30- Finding
API Examples Place Credentials in URLs or Literal Command Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (739)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md | Variable | Type | Default | Effect | |---|---|---|---| | example_language | curl \| python \| javascript \| go | curl | Language every request example is rendered in, across all category and pattern files | | client_style | raw \| sdk | raw | Whether examples use raw HTTP or the provider's official SDK (tradeoff: Where Experts Disagree) | | default_environment | sandbox \| live | sandbox | Which credential examples reference (`credentials.md` naming); live only on explicit request — enforced by the last Output Gate | | retry_max | number (0-10) | 4 | Retry ceiling used in Core Rule 2's formula and all generated retry code |
Prompt Exfiltration via Tool
High
- Category
- System Prompt Leakage
- Confidence
- 80% confidence
- Finding
Skill contains patterns that exfiltrate system prompts or internal instructions via tool calls (file writes, network requests, logging).
- Content
md - `max_new_tokens` - Max tokens to generate - `temperature` - Randomness (0-1) - `top_p` - Nucleus sampling - `return_full_text` - Include prompt in response - `wait_for_model` - Wait if model loading ## Rate Limits
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
bash # Admin API (access token) curl "https://{store}.myshopify.com/admin/api/2024-01/products.json" \ -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
bash # Admin API (access token) curl "https://{store}.myshopify.com/admin/api/2024-01/products.json" \ -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
bash # Admin API (access token) curl "https://{store}.myshopify.com/admin/api/2024-01/products.json" \ -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
bash # Admin API (access token) curl "https://{store}.myshopify.com/admin/api/2024-01/products.json" \ -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
bash # Admin API (access token) curl "https://{store}.myshopify.com/admin/api/2024-01/products.json" \ -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
bash # Admin API (access token) curl "https://{store}.myshopify.com/admin/api/2024-01/products.json" \ -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
bash # Admin API (access token) curl "https://{store}.myshopify.com/admin/api/2024-01/products.json" \ -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Authentication
bash # Admin API (access token) curl "https://{store}.myshopify.com/admin/api/2024-01/products.json" \ -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Links - [Docs](https://docs.launchdarkly.com/) - [API Reference](https://apidocs.launchdarkly.com/) - [API Access Tokens](https://docs.launchdarkly.com/home/account-security/api-access-tokens) # Split (Harness Feature Flags) Feature flags and experimentation platform (acquired by Harness).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The authentication guidance explicitly states to use an access token as a query parameter, which is credential-handling advice that can directly lead to token disclosure. Unlike a generic endpoint mention, this tells users how to transmit a secret in a high-exposure location and is therefore a real security issue in documentation.
- Content
text ## Authentication Access token as query parameter. ```bash curl -X GET "https://api.mapbox.com/geocoding/v5/mapbox.places/Los%20Angeles.json?access_token=YOUR_ACCESS_TOKEN"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Gotchas - **OAuth only** — no API keys for server-to-server auth - Access tokens expire in 2 hours — use refresh tokens - `orgId` in token response identifies the customer's organization - Contact attributes are flexible key-value pairs - Conversation `status`: `open`, `closed`, `pending`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Gotchas - **OAuth only** — no API keys for server-to-server auth - Access tokens expire in 2 hours — use refresh tokens - `orgId` in token response identifies the customer's organization - Contact attributes are flexible key-value pairs - Conversation `status`: `open`, `closed`, `pending`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Gotchas - **OAuth only** — no API keys for server-to-server auth - Access tokens expire in 2 hours — use refresh tokens - `orgId` in token response identifies the customer's organization - Contact attributes are flexible key-value pairs - Conversation `status`: `open`, `closed`, `pending`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Gotchas - **OAuth only** — no API keys for server-to-server auth - Access tokens expire in 2 hours — use refresh tokens - `orgId` in token response identifies the customer's organization - Contact attributes are flexible key-value pairs - Conversation `status`: `open`, `closed`, `pending`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Gotchas - **OAuth only** — no API keys for server-to-server auth - Access tokens expire in 2 hours — use refresh tokens - `orgId` in token response identifies the customer's organization - Contact attributes are flexible key-value pairs - Conversation `status`: `open`, `closed`, `pending`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Gotchas - **OAuth only** — no API keys for server-to-server auth - Access tokens expire in 2 hours — use refresh tokens - `orgId` in token response identifies the customer's organization - Contact attributes are flexible key-value pairs - Conversation `status`: `open`, `closed`, `pending`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Gotchas - **OAuth only** — no API keys for server-to-server auth - Access tokens expire in 2 hours — use refresh tokens - `orgId` in token response identifies the customer's organization - Contact attributes are flexible key-value pairs - Conversation `status`: `open`, `closed`, `pending`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Common Traps - Access token expires in ~8 hours - Sandbox vs Production URLs are different - Orders must be APPROVED before capture - Use v2 endpoints (v1 is legacy)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Common Traps - Access token expires in ~8 hours - Sandbox vs Production URLs are different - Orders must be APPROVED before capture - Use v2 endpoints (v1 is legacy)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The Wise transfer example creates a transfer and can initiate real fund movement, yet the document does not explicitly warn that production use may move money or require additional approval controls. In a payments and transfer skill, that omission materially increases the chance of accidental live transfers.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Coinbase 'send' example describes a cryptocurrency transfer without warning that blockchain transfers are often irreversible and may send assets to an external address permanently if misused. In a crypto context, copied examples without caution can directly cause unrecoverable financial loss.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The Reddit example includes client credentials plus username and password in a token request, which can normalize dangerous credential-handling patterns. Even with placeholders, such examples can lead users to expose secrets in shell history, logs, screenshots, CI output, or shared terminals, and they encourage use of a high-risk password grant flow.
- Content
OAuth 2.0. Supports "script" (personal use), "web app", and "installed app" types.
bash # Get access token curl -X POST "https://www.reddit.com/api/v1/access_token" \ -u "CLIENT_ID:CLIENT_SECRET" \ -d "grant_type=password&username=USER&password=PASS"
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
-H "Client-Id: {CLIENT_ID}"
text ### Send Chat Message ```bash curl -X POST "https://api.twitch.tv/helix/chat/messages" \ -H "Authorization: Bearer {USER_ACCESS_TOKEN}" \
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- apis/media.md:208
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- apis/payments.md:423
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- apis/realtime.md:464