ClawHub
Back to skill

Security audit

agentcloud

Security checks for vulnerabilities and agentic risk

Overview

This cloud-storage skill is mostly coherent, but its helper script has unsafe download and credential-handling behavior that users should review before installing.

Install only if you are comfortable sending selected files to the AgentCloud service. Avoid uploading sensitive files, treat share links as public bearer links until they expire, store the API key in a protected secret store or locked-down config file, and avoid using --key on the command line. Be especially cautious with the download command because a malicious or compromised service response could overwrite local files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/agentcloud.py:248
Finding

Server-Controlled Download Filename Allows Arbitrary File Overwrite

Content
View full analysis

Vulnerability Details

File Location: scripts/agentcloud.py, lines 248-252
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: High

python
content_disp = r.headers.get("Content-Disposition", "")
if "filename=" in content_disp:
    output = content_disp.split("filename=")[-1].strip('"').strip("'")

with open(output, "wb") as f:

Technical Analysis

The download implementation trusts the filename supplied by the remote server in the Content-Disposition header. This value replaces the local output path without validation, even when the user explicitly provided an output path.

A filename containing an absolute path or directory traversal sequence, such as ../../.bashrc, can escape the intended download directory. The subsequent open(output, "wb") call creates or truncates the selected file.

Exploitation requires control of the API response, such as through compromise of the AgentCloud service, its infrastructure, or another mechanism capable of supplying a malicious authenticated HTTPS response.

Attack Path

  1. An attacker gains control over the download response returned by the AgentCloud API.
  2. The response includes a header such as Content-Disposition: attachment; filename="../../.bashrc".
  3. The user invokes the CLI download command.
  4. The CLI replaces the intended output path with the server-provided filename.
  5. The downloaded response body is written to the traversed path, truncating an existing file if present.
  6. If the overwritten file is security-sensitive or later executed, additional code execution or configuration compromise may result.

Impact Assessment

The attacker can create or overwrite files accessible to the operating-system user running the CLI. The vulnerability does not directly provide elevated system privileges, but it can modify user-owned shell configuration, application configuration, source files, credentials, or agent ...[truncated 135 chars]

Remediation
View remediation

Remediation Suggestions

  • Never allow a remote filename to override an explicitly supplied --output path.
  • Extract only the basename using Path(remote_name).name.
  • Reject absolute paths, .. components, path separators, null bytes, and platform-specific drive prefixes.
  • Resolve the destination against a designated download directory and verify that the resolved path remains inside that directory.
  • Require confirmation before overwriting an existing file, or use exclusive creation mode.
  • Parse Content-Disposition with a standards-compliant parser rather than splitting the raw header.
  • Add tests covering absolute paths, traversal paths, encoded separators, Windows paths, malformed headers, and explicit output-path preservation.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/agentcloud.py:57
Finding

API Credential Stored Without Enforced Owner-Only Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/agentcloud.py, lines 57-67
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

python
def _save_config(data):
    """保存注册信息到配置文件"""
    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    if CONFIG_FILE.exists():
        config = json.loads(CONFIG_FILE.read_text())
        config.update(data)
    else:
        config = data
    CONFIG_FILE.write_text(json.dumps(config, indent=2, ensure_ascii=False))
    print(f"📁 配置已保存: {CONFIG_FILE}")

Technical Analysis

Registration information, including the API key, is stored in ~/.agentcloud/config.json as plaintext. The code does not explicitly set owner-only permissions on either the configuration directory or the file. Newly created permissions therefore depend on the process umask, while an existing file may retain previously insecure permissions.

Because the API key is the account's bearer credential, any process or local user able to read the file can authenticate as the affected AgentCloud agent.

Attack Path

  1. A user runs the registration command.
  2. _save_config writes the returned API key to ~/.agentcloud/config.json.
  3. The file is created or retained with permissions that allow another local account or process to read it.
  4. A local attacker retrieves the plaintext API key.
  5. The attacker sends requests with the stolen X-Agent-Key credential.
  6. The attacker accesses or manipulates the victim's AgentCloud resources within the permissions granted to that key.

Impact Assessment

A stolen key may permit unauthorized file listing, downloads, uploads, deletions, sharing-link creation, account-information access, or other API operations supported by the credential. The compromise is limited to the AgentCloud account and resources authorized by the key; this issue does not itself grant operating-system privilege escalation.

Remediation
View remediation

Remediation Suggestions

  • Create ~/.agentcloud with mode 0700.
  • Create the configuration file atomically with mode 0600.
  • Check and correct permissions on pre-existing directories and files before reading or updating them.
  • Avoid following symbolic links when creating or replacing the credential file.
  • Prefer an operating-system credential manager or keyring over a plaintext JSON file.
  • Document where credentials are stored and provide a command to revoke or rotate a potentially exposed key.
  • Avoid printing the complete API key after registration unless explicitly requested by the user.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/agentcloud.py:484
Finding

Command-Line API Key Option Exposes Credentials to Local Observation

Content
View full analysis

Vulnerability Details

File Location: scripts/agentcloud.py, lines 484-512
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

python
p_upload.add_argument("--key", default=None, help="API Key")

p_download.add_argument("--key", default=None, help="API Key")

p_list.add_argument("--key", default=None, help="API Key")

p_share.add_argument("--key", default=None, help="API Key")

p_me.add_argument("--key", default=None, help="API Key")

p_upgrade.add_argument("--key", default=None, help="API Key")

p_plans.add_argument("--key", default=None, help="API Key")

Technical Analysis

The CLI permits a bearer credential to be supplied through the --key command-line argument. Command-line arguments can be exposed through process listings, shell history, audit records, terminal logs, crash reports, CI output, and orchestration telemetry.

The implementation already supports an environment variable and a configuration file, so exposing the key through a command-line option is not necessary for the declared functionality.

Attack Path

  1. A user invokes a command such as agentcloud.py list --key avk_secret.
  2. The complete command is recorded in shell history or exposed through process-inspection facilities.
  3. A local user, monitoring service, log collector, or compromised process retrieves the argument.
  4. The observer reuses the captured bearer credential against the AgentCloud API.
  5. The observer performs operations authorized for the victim's agent account.

Impact Assessment

Exposure of the key can compromise all AgentCloud data and operations authorized by that credential. The issue does not directly confer operating-system privileges, but it can allow unauthorized remote access to stored files and sharing functions.

Remediation
View remediation

Remediation Suggestions

  • Remove or deprecate the --key option.
  • Read credentials from an owner-protected configuration file or an operating-system keyring.
  • If interactive entry is required, use a hidden prompt through getpass.
  • For automation, accept credentials through a protected file descriptor or secret-management integration.
  • Warn users not to place credentials in command lines, scripts, shell history, or CI logs.
  • Redact credentials from exceptions, diagnostics, and telemetry.
  • Provide key rotation instructions for users who previously supplied credentials on the command line.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:72
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 72; repeated at line 227
Vulnerability Type: Unverified and non-reproducible dependency installation
Risk Level: Medium

bash
pip install requests

Technical Analysis

The installation instructions retrieve the current version of requests and its transitive dependencies without a reviewed version constraint, lock file, or cryptographic hash verification. Installation behavior can consequently change after the Skill has been audited.

The package name is not an evident typosquat, and no malicious package was identified during this static audit. The risk arises from mutable package-index state, compromised releases, compromised mirrors, unsafe index configuration, or malicious transitive dependencies.

Attack Path

  1. A package release, transitive dependency, configured package index, or mirror is compromised.
  2. A user follows the documented pip install requests instruction.
  3. pip retrieves the currently selected package artifacts without checking project-supplied hashes.
  4. The unreviewed dependency code is installed into the user's Python environment.
  5. Malicious code may execute during installation or when the CLI imports and uses the dependency.

Impact Assessment

Malicious dependency code would run with the privileges of the user performing installation or invoking the CLI. It could access files, environment variables, AgentCloud credentials, network resources, and any other resources available to that user. The project does not instruct users to install with administrative privileges, so system-wide privilege is not inherently obtained.

Remediation
View remediation

Remediation Suggestions

  • Pin reviewed direct and transitive dependency versions in a lock file.
  • Record cryptographic hashes and install with pip --require-hashes.
  • Document the expected trusted package index and prevent unintended fallback to untrusted indexes.
  • Use an isolated virtual environment rather than modifying a shared Python environment.
  • Add automated dependency vulnerability and integrity scanning.
  • Regularly review and deliberately update pinned versions.
  • Apply the same corrected installation guidance to both occurrences in SKILL.md.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (37)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

注册你的 Agent

bash
export AGENTCLOUD_KEY=$(curl -s -X POST https://api.traceclaw.cn/api/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['api_key'])")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README promotes uploading, downloading, and cross-agent sharing of files but provides no warning about privacy, data classification, or the risks of sharing sensitive data via public or weakly controlled links. In a storage-and-sharing skill, omission of such guidance can lead users or autonomous agents to transmit confidential files to an external service without understanding exposure risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

注册你的 Agent

bash
export AGENTCLOUD_KEY=$(curl -s -X POST https://api.traceclaw.cn/api/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['api_key'])")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README demonstrates extracting an API key into an environment variable and then explicitly printing it to the terminal without any warning that the credential is sensitive. This increases the chance of accidental disclosure through shell history, terminal logging, screen sharing, or copied command transcripts, especially in agent or CI environments where stdout may be persisted.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents and encourages capabilities that access environment variables, read/write local files, and make external network requests, but it does not declare any tool scope or permissions metadata. In systems that rely on declared scopes for user awareness or enforcement, this mismatch can cause users or orchestrators to invoke a skill with broader real-world effects than expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

只需一个命令，Agent 就能获得专属存储空间：

bash
curl -X POST https://api.traceclaw.cn/api/v1/agents/register/open \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
BASE = "https://api.traceclaw.cn/api/v1"

# 注册（无需任何认证）
r = requests.post(f"{BASE}/agents/register/open", json={"name": "my-agent"})
data = r.json()

api_key = data["api_key"]  # 保存好！

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The sharing-link examples emphasize convenience but do not clearly warn that the generated URL enables unauthenticated file download by anyone possessing the token. Because the skill is for cross-agent file transfer, users may paste or log these URLs in places with weaker access controls, unintentionally exposing sensitive files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

python
# 生成 1 小时有效分享链接
r = requests.post(
    f"{BASE}/files/{file_id}/share",
    json={"expires_in": 3600},
    headers={"X-Agent-Key": API_KEY}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

}

text

## curl 一行命令版

```bash
# 注册

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

This duplicate persistence finding refers to the same auto-load installation instructions. Making the skill resident in standard discovery paths can expand exposure if users do not realize it will be available to future sessions and contexts automatically.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
# 全局安装（所有项目生效）
mkdir -p ~/.config/opencode/skills/agentcloud
cp ~/agentcloud-skill/SKILL.md ~/.config/opencode/skills/agentcloud/

# 或项目级安装（仅当前项目生效）

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

This duplicate persistence finding refers to the same auto-load installation instructions. Making the skill resident in standard discovery paths can expand exposure if users do not realize it will be available to future sessions and contexts automatically.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
# 全局安装(所有项目生效)
mkdir -p ~/.config/opencode/skills/agentcloud
cp ~/agentcloud-skill/SKILL.md ~/.config/opencode/skills/agentcloud/

# 或项目级安装(仅当前项目生效)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The OpenClaw/OpenCode example contradicts the earlier documented registration endpoint and auth model by using a different path and storing the returned API key in agent memory. Inconsistent security guidance increases the chance of unsafe integrations, accidental credential mishandling, or developers bypassing expected controls while trying to make the example work.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
import requests

# 注册（开放注册，无需任何前置条件）
r = requests.post("https://api.traceclaw.cn/api/v1/agents", json={
    "name": context.agent.name  # 使用 Agent 自身名称
})
config = r.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
import requests

# 注册（开放注册，无需任何前置条件）
r = requests.post("https://api.traceclaw.cn/api/v1/agents", json={
    "name": context.agent.name  # 使用 Agent 自身名称
})
config = r.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md
context.memory.set("agentcloud_key", config["api_key"])

# 上传文件
r = requests.post(
    "https://api.traceclaw.cn/api/v1/files/upload",
    files={"file": open("/tmp/result.txt", "rb")},
    headers={"X-Agent-Key": config["api_key"]}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and all user-facing CLI text are written in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. This is a natural-language policy concern because the skill does not document that it is region- or language-specific, nor does it offer a language choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

md
print("❌ 请先安装 requests: pip install requests")
    sys.exit(1)

BASE_URL = "https://api.traceclaw.cn/api/v1"
SITE_URL = "https://agentcloud.traceclaw.cn"
CONFIG_DIR = Path.home() / ".agentcloud"
CONFIG_FILE = CONFIG_DIR / "config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md
print("❌ 请先安装 requests: pip install requests")
    sys.exit(1)

BASE_URL = "https://api.traceclaw.cn/api/v1"
SITE_URL = "https://agentcloud.traceclaw.cn"
CONFIG_DIR = Path.home() / ".agentcloud"
CONFIG_FILE = CONFIG_DIR / "config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
print("❌ 请先安装 requests: pip install requests")
    sys.exit(1)

BASE_URL = "https://api.traceclaw.cn/api/v1"
SITE_URL = "https://agentcloud.traceclaw.cn"
CONFIG_DIR = Path.home() / ".agentcloud"
CONFIG_FILE = CONFIG_DIR / "config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
print("❌ 请先安装 requests: pip install requests")
    sys.exit(1)

BASE_URL = "https://api.traceclaw.cn/api/v1"
SITE_URL = "https://agentcloud.traceclaw.cn"
CONFIG_DIR = Path.home() / ".agentcloud"
CONFIG_FILE = CONFIG_DIR / "config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
print("❌ 请先安装 requests: pip install requests")
    sys.exit(1)

BASE_URL = "https://api.traceclaw.cn/api/v1"
SITE_URL = "https://agentcloud.traceclaw.cn"
CONFIG_DIR = Path.home() / ".agentcloud"
CONFIG_FILE = CONFIG_DIR / "config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
print("❌ 请先安装 requests: pip install requests")
    sys.exit(1)

BASE_URL = "https://api.traceclaw.cn/api/v1"
SITE_URL = "https://agentcloud.traceclaw.cn"
CONFIG_DIR = Path.home() / ".agentcloud"
CONFIG_FILE = CONFIG_DIR / "config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
print("❌ 请先安装 requests: pip install requests")
    sys.exit(1)

BASE_URL = "https://api.traceclaw.cn/api/v1"
SITE_URL = "https://agentcloud.traceclaw.cn"
CONFIG_DIR = Path.home() / ".agentcloud"
CONFIG_FILE = CONFIG_DIR / "config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
print("❌ 请先安装 requests: pip install requests")
    sys.exit(1)

BASE_URL = "https://api.traceclaw.cn/api/v1"
SITE_URL = "https://agentcloud.traceclaw.cn"
CONFIG_DIR = Path.home() / ".agentcloud"
CONFIG_FILE = CONFIG_DIR / "config.json"

Static analysis

No suspicious patterns detected.