ClawHub
Back to skill

Security audit

节假日安排查询 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it puts the Juhe API key at risk through insecure transport and credential-handling options.

Review before installing. Use only if you are comfortable sending queried dates to Juhe, and do not use a real API key with this version unless the endpoint is changed to HTTPS. Prefer an environment variable over --key or scripts/.env; if a .env file is used, keep it out of version control and restrict file permissions. Rotate any Juhe key previously used through the documented HTTP endpoint.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/holiday_query.py:27
Finding

API Credential Transmitted Over Unencrypted HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/holiday_query.py, lines 27 and 70-78
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: High

Vulnerable Code

python
API_URL = "http://apis.juhe.cn/fapig/calendar/day"
python
params = {
    "key": api_key,
    "date": date,
    "detail": 1,
}
url = f"{API_URL}?{urllib.parse.urlencode(params)}"

try:
    with urllib.request.urlopen(url, timeout=10) as resp:
        result = json.loads(resp.read().decode("utf-8"))

Technical Analysis

The script places the Juhe API key in a URL query parameter and transmits the request using plaintext HTTP. HTTP provides neither transport confidentiality nor server authentication. Any party with network-path visibility—including a local network attacker, compromised router, transparent proxy, or Internet service provider—can inspect the URL and recover the API key.

An active man-in-the-middle can additionally alter the request or response. Because the response is not cryptographically authenticated, the script may display attacker-controlled holiday, calendar, or almanac information as though it came from the legitimate provider.

Sending the requested date to the API is necessary for the declared functionality. Sending the API credential without encrypted transport exceeds the minimum exposure necessary and is not required for the Skill to operate.

Attack Path

  1. A user configures a valid JUHE_DATE_HOLIDAY_KEY and runs a normal holiday query.
  2. The script constructs a URL containing key=<API_KEY>.
  3. The script sends that URL to apis.juhe.cn over unencrypted HTTP.
  4. An attacker with network-path visibility captures the HTTP request and extracts the key from its query string.
  5. The attacker reuses the credential against the provider's API, consuming its quota or accessing any API capabilities associated with that key.
  6. If actively interc ...[truncated 715 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the endpoint with the provider's HTTPS endpoint:

    python
    API_URL = "https://apis.juhe.cn/fapig/calendar/day"

  2. Update the direct API example in SKILL.md to use HTTPS.

  3. Do not implement a fallback to plaintext HTTP if HTTPS fails.

  4. If the provider supports it, transmit the credential in an authorization header instead of the URL. Query strings may be retained in browser, proxy, application-server, and monitoring logs even when HTTPS protects them in transit.

  5. Handle HTTP and TLS errors without including the full request URL or credential in output or logs.

  6. Rotate any API key that has already been used by this implementation because it may have been exposed on prior network paths.

  7. Test that redirects cannot downgrade HTTPS requests to HTTP and that certificate validation remains enabled.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/holiday_query.py:179
Finding

Command-Line API Key Exposure Through Process Listings and Shell History

Content
View full analysis

Vulnerability Details

File Location: scripts/holiday_query.py, lines 179-181
Vulnerability Type: Sensitive credential accepted as a command-line argument
Risk Level: Medium

Vulnerable Code

python
if args[i] == "--key" and i + 1 < len(args):
    cli_key = args[i + 1]
    i += 2

Technical Analysis

The script permits users to supply the API credential using --key. Command-line arguments are commonly recorded in shell history and may be visible in process inspection interfaces while the program is running. They may also be captured by terminal logging, job schedulers, monitoring agents, support bundles, or command auditing systems.

This mechanism unnecessarily broadens credential exposure because the Skill already supports an environment variable and a local .env file. The risk is increased by SKILL.md explicitly documenting the command-line method as a supported configuration option.

Attack Path

  1. A user follows the documented example and runs the script with --key followed by a valid API key.
  2. The shell records the complete command in its history, or the operating system exposes the argument vector while the process is running.
  3. Another local user, administrator, monitoring process, backup process, or later shell-history reader obtains the command.
  4. The observer extracts the API key and reuses it against the Juhe API.
  5. The attacker consumes the account's quota or exercises any provider-side permissions assigned to the key.

Impact Assessment

Exploitation exposes the external Juhe API credential to parties able to read process arguments, shell history, command audit records, or related logs. The resulting privilege is limited to the capabilities assigned to the stolen key, including quota consumption and possible billing impact.

This issue does not itself provide elevated local system privileges. The exact local visibility of process arguments depends on t ...[truncated 91 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --key option and its examples from both the script and SKILL.md.
  2. Prefer a dedicated environment variable or a secret-management facility supplied by the runtime.
  3. If file-based configuration is retained, require restrictive owner-only permissions and clearly instruct users not to commit scripts/.env to version control.
  4. Add .env and equivalent secret files to the project's ignore rules.
  5. If interactive credential entry is necessary, use a non-echoing prompt such as Python's getpass rather than an ordinary command-line argument.
  6. Advise users who previously supplied keys on the command line to remove affected shell-history entries and rotate the exposed credentials.
  7. Ensure errors, diagnostics, and debug output never print the key or the complete authenticated request URL.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The instructions explicitly create a plaintext scripts/.env file containing the API key. If that file is readable by other users, accidentally committed, bundled, or exposed in logs/backups, the credential can be stolen and abused against the third-party account.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export JUHE_DATE_HOLIDAY_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_DATE_HOLIDAY_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/holiday_query.py --key 你的 AppKey --date 2025-05-01

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python holiday_query.py --key your_api_key --date 2025-05-01
    2. 环境变量：export JUHE_DATE_HOLIDAY_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_DATE_HOLIDAY_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/606
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/holiday_query.py (reported line 13)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python holiday_query.py --key your_api_key --date 2025-05-01
    2. 环境变量：export JUHE_DATE_HOLIDAY_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_DATE_HOLIDAY_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/606
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/holiday_query.py (reported line 224)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python holiday_query.py --key your_api_key --date 2025-05-01
    2. 环境变量：export JUHE_DATE_HOLIDAY_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_DATE_HOLIDAY_KEY=your_api_key

免费申请 API Key: https://www.juhe.cn/docs/api/id/606
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/holiday_query.py (reported line 39)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill requires environment access, file reads, and outbound network use, but it does not declare an explicit tool/permission scope for those capabilities. This weakens least-privilege controls and can cause the agent to access secrets or make external requests without clear operator visibility or policy enforcement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file consistently instructs usage and output in Chinese, including fixed Chinese weekday and status labels, but does not state that the skill is China/Chinese-only or offer user opt-in for language/locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script sends the API key as a URL query parameter to an HTTP endpoint, so the credential is transmitted in cleartext and can be intercepted or modified by a network attacker. Query-string secrets are also more likely to be exposed in logs, proxies, browser/history tooling, or upstream monitoring systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill directs users to send date queries to a third-party API but does not disclose that user-supplied query data will be transmitted to juhe.cn. Even if the payload is usually low sensitivity, lack of transparency creates a privacy and consent issue, especially if users include personal dates or context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The setup instructions tell users to store an API key in an environment variable or .env file, but they do not include guidance on secure handling. This can lead to accidental exposure through shell history, committed .env files, or unsafe filesystem permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

All natural-language instructions, help text, and user-facing output are presented only in Chinese, with no option to select another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented regional limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.