ClawHub
Back to skill

Security audit

TokenFlow 词元流

Security checks for vulnerabilities and agentic risk

Overview

TokenFlow does what it claims, but it can automatically send user files and URLs to an external API with broad triggers and limited privacy/consent guidance.

Install only if you are comfortable sending selected files, pasted URLs, and possibly authentication data to TokenFlow's external service. Avoid using it for confidential documents, regulated data, internal-only URLs, or secrets unless you have reviewed TokenFlow's data handling and configured ask-before-convert behavior for sensitive file types.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The signup/signin flows transmit credentials to a remote service and then persist the returned API key via saveConfig() without showing any user-consent, storage-safety, or secret-handling controls in this file. In a skill context, this is more dangerous because agent-integrated code may run in environments where users do not expect long-lived credential material to be stored locally or where config storage may be inadequately protected.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill does not prominently warn users that attached files and pasted URLs will be uploaded to an external API for processing. Because the skill handles potentially sensitive documents, spreadsheets, audio, and URLs, missing consent and transparency can lead to unintended exposure of confidential data to a remote service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases include generic language such as "convert file" and "make it flow," which are likely to collide with ordinary user requests. Overbroad triggers can cause the skill to activate unexpectedly and process attachments or URLs without sufficiently clear user intent, increasing the chance of unintended external data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill documentation does not prominently warn users that attached files and pasted URLs may be sent to a third-party service for conversion. Because the skill is designed to process potentially sensitive content, missing disclosure undermines informed consent and can lead to unintentional exfiltration of confidential documents, internal URLs, or personal data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

This skill explicitly uploads local files and user-supplied URLs to an external API endpoint, which is a real data egress path. In this skill's context, that behavior is part of the intended functionality, but it is still security-relevant because it can expose confidential file contents, embedded metadata, spreadsheets, audio, and internal-only URLs to a third party if invoked without strict consent and scope controls.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

POST /convert

bash
curl -X POST "https://tokenflow.fly.dev/convert" \
  -H "Authorization: Bearer ${TOKENFLOW_API_KEY}" \
  -F "file=@document.pdf" \
  -F "output_format=markdown"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation directs users to place a long-lived API key in a local config file under their home directory, but provides no guidance on file permissions, secret rotation, or safer alternatives such as environment variables or OS keychains. This increases the risk of credential exposure through overly permissive filesystem access, backups, logs, dotfile syncing, or accidental sharing of the config file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest states that files and URLs are converted using the TokenFlow API but does not warn users that submitted content may be transmitted to a third-party service. This creates a meaningful data-handling transparency issue: users may provide sensitive documents or internal URLs without understanding that the data leaves the local agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The convert method sends entire user files to a third-party remote service, which can expose sensitive content if users or downstream integrators are not clearly informed. In an agent-skill context, automatic attachment processing increases risk because files may contain secrets, PII, contracts, or internal documents that leave the local trust boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list includes broad natural-language phrases like "convert file" and "flow this," which are likely to collide with ordinary user requests and invoke the skill unintentionally. In a skill that sends files and URLs to a third-party service, accidental activation increases the chance of unintended data disclosure and surprising behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This skill is explicitly designed to upload user-supplied files to a third-party API endpoint, which is a real external transmission of potentially sensitive content. While this may be core functionality rather than malicious behavior, it remains security-relevant because it expands the data exposure boundary and could leak confidential information if users are not clearly informed or if the endpoint is not trusted.

Content

Scanner excerpt · tokenflow-v1.0.0/SKILL.md (reported line 143)May include surrounding context.

POST /convert

bash
curl -X POST "https://tokenflow.fly.dev/convert" \
  -H "Authorization: Bearer ${TOKENFLOW_API_KEY}" \
  -F "file=@document.pdf" \
  -F "output_format=markdown"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation describes converting local files and URLs via an API-backed service, but it does not clearly warn users that document contents and fetched remote data may be transmitted to an external provider. This creates a real transparency and privacy risk: users may submit sensitive files or internal URLs under the assumption processing is local, leading to unintended data disclosure to a third party.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file is presented as a reference client for agent skill integration, but it also includes signup/signin flows and local API key persistence, expanding the trust and credential-handling scope beyond what a consumer may expect from the module description. In a skill context, this can mislead integrators into embedding account and secret-management behavior without appropriate review, increasing the chance of unsafe deployment and credential exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The convert() method uploads arbitrary user-provided files to a third-party remote service using the configured API key, with no disclosure, consent check, or policy gate in this code path. In an agent skill, this is dangerous because attachments may contain sensitive data, and automatic exfiltration to an external service can violate user expectations, privacy requirements, or data-handling rules.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The signup/signin flow stores returned API keys locally via saveConfig() without explicit notice, storage-hardening guarantees, or user opt-in at this call site. Persisting long-lived credentials in local configuration can expose them to other local users, malware, logs, backups, or accidental disclosure if the config storage is not adequately protected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

processFile() can automatically upload supported attachments to the remote TokenFlow service based on preferences and filetype behavior, even when the user did not explicitly request conversion. In an agent setting, this materially increases the danger because routine attachment handling may silently exfiltrate sensitive documents to an external service without clear disclosure or affirmative consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest says the command converts an "attached file or URL to structured text" with usage "/flow", but it does not describe any constraints, exclusions, or narrower activation scope. In a manifest file, this broad invocation description can make it unclear when the skill should be used versus other file- or URL-processing skills.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The comment at L109 makes a stronger behavioral assurance about backend side effects ('no session creation') than this client code can verify. The function simply issues an authenticated request to /billing/summary and returns the JSON response, so the documentation asserts an intent that is not actually enforced by the code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The convertUrl method transmits user-supplied URLs to the external TokenFlow service without any visible disclosure in this file. This can reveal private or internal URLs, access patterns, or sensitive query parameters to a third party, though the impact is generally lower than direct file exfiltration unless internal-only URLs are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The convertUrl() method sends user-supplied URLs to the remote TokenFlow service without any user-facing notice or validation. While this does not directly upload local file contents, it still discloses browsing targets or internal URLs to an external service and may enable unintended handling of sensitive endpoints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.