ClawHub
Back to skill

Security audit

节假日安排查询 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This holiday-query skill does what it claims, but it handles the required API key in ways that could expose it.

Install only if you are comfortable using a Juhe API key with this script. Prefer a protected environment variable, avoid command-line key passing, do not commit scripts/.env, and check whether Juhe supports an HTTPS version of the endpoint before using the included script.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The script hardcodes the API endpoint as plain HTTP and includes the API key in the query string, so the credential and request data are exposed to interception or modification by any network observer or intermediary. In the context of an agent skill, this is more dangerous because users may supply a reusable API credential and expect the integration to handle it safely, but the skill silently transmits it insecurely.

Credential Access

High
Category
Privilege Escalation
Content
# 方式一：环境变量（推荐，一次配置永久生效）
export JUHE_DATE_HOLIDAY_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_DATE_HOLIDAY_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
Confidence
86% confidence
Finding
The skill instructs users to write a live API key into `scripts/.env`, which risks accidental exposure if that file is later committed to source control, copied, or made world-readable. Although this is standard developer guidance in many projects, embedding credential storage instructions without any warning about secret handling can lead to credential leakage.

Credential Access

High
Category
Privilege Escalation
Content
export JUHE_DATE_HOLIDAY_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_DATE_HOLIDAY_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/holiday_query.py --key 你的 AppKey --date 2025-05-01
Confidence
84% confidence
Finding
The explicit command `echo "JUHE_DATE_HOLIDAY_KEY=..." > scripts/.env` operationalizes secret persistence in a repository subdirectory, increasing the chance of credential exposure through version control, backups, logs, or accidental file disclosure. In this skill's context, the key is only for a holiday API, so impact is limited compared with cloud or admin credentials, but leakage still enables unauthorized API use and quota exhaustion.

Static analysis

No suspicious patterns detected.