ClawHub
Back to skill

Security audit

Denario (Autonomous Research Pipeline)

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it embeds an undisclosed third-party API key and automatically installs unpinned packages into a persistent user environment.

Review this skill before installing. Do not run the citations path until the embedded Perplexity key is removed and rotated by the publisher. Expect first run to install packages into ~/.denario_skill_env, and expect research prompts, generated project content, and citation queries to be sent to external model or citation providers. Use a sandbox and only provide API keys suitable for this workflow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/test_citations.py:8
Finding

Hard-Coded Perplexity API Credential

Content
View full analysis

Vulnerability Details

File Location: scripts/test_citations.py:8-11
Vulnerability Type: Plaintext hard-coded secret
Risk Level: High

Vulnerable Code

python
# Set API credentials
if not os.environ.get("OPENAI_API_KEY"): print("Warning: OPENAI_API_KEY not set");
os.environ["OPENAI_BASE_URL"] = "https://open.bigmodel.cn/api/coding/paas/v4"
os.environ["PERPLEXITY_API_KEY"] = "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"

Technical Analysis

The citation script contains a plaintext Perplexity API credential and places it in the process environment. Anyone who can access the source package or its repository history can extract the credential without authorization.

When the script imports and invokes Denario, the dependency may use PERPLEXITY_API_KEY for citation searches. This exposes the credential to code running in the same process and makes citation requests occur under a bundled credential rather than one explicitly supplied by the operator.

Attack Path

  1. An attacker obtains a copy of the publicly or internally distributed skill package.
  2. The attacker reads scripts/test_citations.py.
  3. The attacker extracts the value assigned to PERPLEXITY_API_KEY.
  4. If the credential remains active, the attacker submits requests to the associated API outside the skill.
  5. Those requests consume the credential owner's quota and may incur charges or disrupt legitimate use.

Impact Assessment

Exploitation does not grant host operating-system privileges, but it may grant whatever API permissions and quota are associated with the exposed credential. Potential consequences include unauthorized API consumption, billing abuse, quota exhaustion, loss of attribution, and disruption of legitimate citation operations. The scope is limited by the provider-side permissions and usage limits assigned to the key.

Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed credential immediately.
  2. Remove the credential from the current source tree, package releases, commit history, build artifacts, and logs.
  3. Obtain the credential from a secret manager or environment variable instead:
    python
    perplexity_api_key = os.environ.get("PERPLEXITY_API_KEY")
if not perplexity_api_key:
    raise RuntimeError("PERPLEXITY_API_KEY is required for citation generation")
  4. Do not assign a secret literal in source code or provide a fallback credential.
  5. Add secret-scanning checks to pre-commit and CI workflows.
  6. Apply provider-side least privilege, spending limits, rate limits, expiration, and monitoring to the replacement key.
  7. Document that users must supply their own credential through an approved secret-management mechanism.

T08 · Insecure Dependencies

Warning
Location
scripts/wrapper.sh:9
Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: scripts/wrapper.sh:9-15
Vulnerability Type: Unpinned runtime dependency installation without integrity verification
Risk Level: Medium

Vulnerable Code

bash
# 1. Environment Setup
if [ ! -d "$VENV_DIR" ]; then
    echo "First run: Creating Denario environment in $VENV_DIR..."
    python3 -m venv "$VENV_DIR"
    echo "Installing dependencies (this may take a few minutes)..."
    "$VENV_DIR/bin/pip" install -q denario langchain-openai
    echo "Environment ready."
fi

The same unsafe installation pattern is also documented at SETUP.md:8-13:

bash
python3 -m venv ~/denario_env
source ~/denario_env/bin/activate
pip install denario

Technical Analysis

The wrapper automatically downloads and installs the latest versions of denario, langchain-openai, and their transitive dependencies when the persistent virtual environment does not exist. No exact versions, cryptographic hashes, lockfile, or explicit trusted-index restriction are used.

As a result, the effective executable code can change after the skill has been reviewed. A compromised upstream package, malicious newly selected transitive dependency, or unsafe future release could execute during installation or import. The installed packages subsequently run with the invoking user's permissions and inherit sensitive environment variables such as OPENAI_API_KEY.

This finding concerns insecure supply-chain controls. The audited source does not itself prove that the named packages are malicious.

Attack Path

  1. An upstream package account, release, artifact, or dependency selected by pip is compromised or replaced with malicious code.
  2. A user invokes any skill action while ~/.denario_skill_env does not exist.
  3. wrapper.sh creates the environment and installs the latest dependency versions from pip without hash verification.
  4. Malicious code executes through package ...[truncated 774 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct and transitive dependency to a reviewed version.
  2. Generate a lockfile containing cryptographic hashes and install with hash enforcement, for example:
    bash
    "$VENV_DIR/bin/pip" install \
  --require-hashes \
  --only-binary=:all: \
  -r requirements.lock
  3. Configure an explicitly trusted package index or an internally controlled artifact mirror.
  4. Review and scan dependency artifacts before publishing the skill.
  5. Move package installation to an explicit, user-approved setup phase rather than silently performing it when a research action is invoked.
  6. Record and verify dependency provenance and periodically audit transitive dependencies.
  7. Run the pipeline in a sandbox with restricted filesystem and network access, and expose only the secrets required for the selected operation.
  8. Update SETUP.md so its installation instructions use the same pinned, hash-verified dependency set.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script directly sets external service credentials in code, including a hardcoded API key, which creates an immediate secret-exposure risk if the repository, logs, or build artifacts are shared. In addition, the script configures outbound access to third-party LLM infrastructure, so anyone running it may unknowingly send project content to external services under the embedded account.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
100% confidence
Finding

A hardcoded API credential is present in the script, which means the secret is exposed to anyone with file access and can be abused for unauthorized API usage, billing fraud, or access under the owner's identity. Because it is assigned unconditionally, the key may also override safer local configuration and spread into downstream processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly states that the first run will auto-install dependencies and that it creates/manages a virtual environment, but it does not present a clear user warning about these side effects before execution. Automatic package installation and environment modification can introduce unreviewed code into the system, consume resources, and create persistence in the user's home directory, making this a real safety and security concern even if the intended functionality is legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script configures an external LLM API base URL and then invokes paper-generation functionality, making it likely that local project data, prompts, or generated content are transmitted to a third-party service without clear disclosure or consent. In a research or document-generation workflow, this can expose unpublished material, proprietary text, or sensitive metadata outside the local environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.