ClawHub
Back to skill

Security audit

东方财富妙想资讯搜索

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward financial-news search integration that sends the user's query to a documented remote API using a user-provided API key, with no hidden persistence or unrelated access.

Install only if you are comfortable sending financial search queries to the documented remote service and providing an MX_APIKEY for that service. Prefer using a limited, revocable API key, and be aware that the current script could expose that key to local process observers during execution and may mishandle queries containing quotes or control characters.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search_news.sh:16
Finding

API Key Exposed Through Process Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/search_news.sh, lines 16–20
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code:

bash
curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search' \
--header 'Content-Type: application/json' \
--header "apikey:$APIKEY" \
--data "{\"query\":\"$QUERY\"}"

Technical Analysis

The script expands MX_APIKEY directly into a curl command-line argument. While the request is running, the resulting header argument may be exposed through local process-inspection interfaces such as ps or /proc/<pid>/cmdline, depending on the operating system and its process visibility configuration.

Although the key is transmitted to the declared HTTPS service and is not hardcoded in the repository, placing it in the process argument vector unnecessarily broadens its exposure. Exploitation requires the attacker to have local process-observation capabilities while the script is executing.

Attack Path

  1. A user exports a valid credential as MX_APIKEY.
  2. The user invokes scripts/search_news.sh with a query.
  3. The shell expands $APIKEY into the curl argument vector.
  4. A local attacker or monitoring process observes the active command through process-inspection facilities.
  5. The attacker extracts the value from the apikey header argument.
  6. The attacker reuses the credential to submit requests to the financial-news API until the key is revoked, expires, or is otherwise restricted.

Impact Assessment

Successful exploitation can disclose the configured API key. The attacker may obtain the same API-level authorization granted to that key, potentially consuming its quota, issuing unauthorized searches, causing service charges, or triggering rate limits.

This issue does not by itself provide operating-system privilege escalation, arbitrary command execution ...[truncated 268 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not place secrets directly in command-line arguments.
  • Supply the sensitive header through a permission-restricted temporary curl configuration file or another mechanism that does not expose the secret in the process argument vector.
  • Create temporary files with restrictive permissions, such as mode 0600, and install an EXIT trap to remove them reliably.
  • Ensure debug tracing is disabled around credential handling; shell tracing with set -x would expose the key in logs.
  • Apply server-side least privilege, rate limits, short credential lifetimes, rotation, and revocation controls.
  • Rotate the key if there is reason to believe it has already been exposed.

One possible hardening pattern is:

bash
config_file=$(mktemp)
chmod 600 "$config_file"
trap 'rm -f "$config_file"' EXIT

{
  printf 'header = "Content-Type: application/json"\n'
  printf 'header = "apikey: %s"\n' "$APIKEY"
} > "$config_file"

payload=$(jq -n --arg query "$QUERY" '{query: $query}')

curl --location \
  --config "$config_file" \
  --request POST \
  --data "$payload" \
  'https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search'

Using jq also ensures that quotes, backslashes, and control characters in the query are encoded as valid JSON.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search_news.sh (reported line 10)May include surrounding context.

sh
fi

QUERY="$1"
APIKEY="$MX_APIKEY" # Assumes MX_APIKEY is set in environment or .env

if [ -z "$APIKEY" ]; then
  echo "Error: MX_APIKEY environment variable is not set."

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs users to run a local shell script (scripts/search_news.sh <查询内容>) and rely on an environment variable API key, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, undeclared shell capability increases the risk of unreviewed command execution, argument injection through query content, and broader-than-expected filesystem or network access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_news.sh (reported line 17)May include surrounding context.

sh
exit 1
fi

curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search' \
--header 'Content-Type: application/json' \
--header "apikey:$APIKEY" \
--data "{\"query\":\"$QUERY\"}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This shell script performs an HTTP POST to an external endpoint and includes the user's query in the transmitted JSON payload. While the code is straightforward, there is no runtime notice or confirmation informing the user that their query will be sent to a remote service, which meets the missing-warning criteria for code files.

Content

No source excerpt is available for this finding.