ClawHub
Back to skill

Security audit

Octen Search

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Octen web-search skill, but it needs review because its API key can be carried by automatic redirects even though the documentation says it only goes to Octen.

Review before installing. Use this skill only if you trust Octen with your search queries and are comfortable providing an OCTEN_API_KEY. Prefer a limited, revocable key, monitor usage, and consider asking the publisher to block redirects or strip credentials on redirects before relying on the claim that the key only reaches one endpoint.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search.py:63
Finding

API Key Disclosure Through Automatically Followed Cross-Origin Redirects

Content
View full analysis

Vulnerability Details

File Location: scripts/search.py, lines 63–72
Vulnerability Type: Credential disclosure through unsafe HTTP redirect handling
Risk Level: Medium

python
req = request.Request(
    url,
    data=json.dumps(body).encode('utf-8'),
    headers={
        'Content-Type': 'application/json',
        'X-Api-Key': api_key
    },
    method='POST'
)

try:
    with request.urlopen(req) as response:

Technical Analysis

The script attaches the OCTEN_API_KEY credential to a custom X-Api-Key request header and submits the request using urllib.request.urlopen(). Although the initial URL is validated against the hardcoded https://api.octen.ai/search endpoint, urlopen() uses redirect handling by default.

Python's standard redirect handling can construct a redirected request using headers from the original request. Consequently, an HTTP redirect—particularly a 301, 302, or 303 response—may cause the custom authentication header to be forwarded to a different origin. The initial endpoint validation is not repeated for the redirect destination.

Sending the API key to the official service is necessary for the declared authenticated search functionality. The vulnerability is therefore not the intended transmission itself, but the failure to constrain subsequent redirect destinations and credential forwarding. This also makes the documentation claim that the key is only sent to the hardcoded endpoint stronger than the code actually guarantees.

Attack Path

  1. A user or agent invokes the Skill with a search query.
  2. The script reads OCTEN_API_KEY from the environment.
  3. It sends a request containing the key in the X-Api-Key header to the allowlisted Octen endpoint.
  4. If that endpoint, its infrastructure, or an upstream component is compromised or misconfigured, it returns a redirect to an attacker-controlled HTTPS URL.
  5. The standard URL opener follows th ...[truncated 933 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable automatic redirects for requests carrying authentication credentials. Use a custom urllib.request.HTTPRedirectHandler that rejects all redirects and treats any 3xx response as an error.
  2. If redirects are operationally required, validate every redirect destination before following it. Require the exact HTTPS scheme, hostname, port, and approved path rather than relying on suffix or substring matching.
  3. Never forward X-Api-Key across origins. Strip the authentication header before constructing any redirected request, including redirects that change scheme, hostname, or port.
  4. Prefer rejecting redirects entirely for this fixed API endpoint because the Skill documentation states that the endpoint is immutable and allowlisted.
  5. Add automated tests using a local redirecting server to verify that cross-origin and same-origin redirects cannot receive the API key.
  6. Keep TLS certificate verification enabled and avoid adding permissive SSL contexts or hostname-verification bypasses.
  7. Update the security documentation only after redirect behavior is technically enforced, ensuring its guarantees accurately match runtime behavior.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'req' from os.environ.get (line 65, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/search.py (reported line 76)May include surrounding context.

python
)

    try:
        with request.urlopen(req) as response:
            return json.loads(response.read().decode('utf-8'))
    except error.HTTPError as e:
        error_text = e.read().decode('utf-8') if e.fp else ''

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requires environment access for OCTEN_API_KEY and performs network operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an avoidable trust gap: users and hosting platforms cannot enforce or review the minimum privileges from the manifest alone, increasing the risk of unintended secret access or outbound communication.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
# Security: Hardcoded API endpoint whitelist
ALLOWED_API_ENDPOINT = "https://api.octen.ai/search"


def validate_api_endpoint(url):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 11)May include surrounding context.

python
# Security: Hardcoded API endpoint whitelist
ALLOWED_API_ENDPOINT = "https://api.octen.ai/search"


def validate_api_endpoint(url):

Static analysis

No suspicious patterns detected.