Security audit

api-key-auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent API-key auditor, but its fix mode can persist secrets into OpenClaw configuration with insufficient safeguards and can migrate mcporter-managed credentials despite saying they do not need migration.

Review this skill before installing. Use read-only audit mode first. Avoid --fix unless you are comfortable copying detected secrets into openclaw.json, have checked the destination file permissions, and have verified that mcporter-managed keys will not be duplicated or exposed in an additional plaintext location.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/audit.py:148
Finding: Credential Configuration Is Written Without Enforcing Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/audit.py:135
Finding: mcporter-Managed Credentials Are Incorrectly Duplicated During Automatic Migration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/audit.py (reported line 48)May include surrounding context.
python
} # 文件扩展名白名单 SCAN_EXTENSIONS = {'.py', '.sh', '.js', '.ts', '.json', '.yaml', '.yml', '.md', '.env'} SKIP_DIRS = {'__pycache__', '.git', 'node_modules', '.venv', 'venv', 'dist', 'build'}

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises capabilities that imply reading and writing sensitive files, but it does not declare any explicit tool scope or permissions boundary. In practice, this increases the chance of overbroad file access or unintended credential modification because callers and reviewers cannot clearly see or constrain what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill includes an automatic '--fix' mode that writes discovered credentials into credential storage, but the documentation does not clearly warn users that this is a sensitive modification affecting secrets management. That omission can lead to accidental migration of live secrets, unsafe handling expectations, or users invoking a write operation without understanding the security consequences.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file's natural-language documentation and user-facing messages are written in Chinese, which imposes a locale/language expectation without any visible opt-in or alternative. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill reads ~/.mcporter/mcporter.json and extracts key material from MCP server URLs, which expands access beyond the declared purpose of scanning skills files and integrating with openclaw.json. Even though it uses those secrets only for classification, it still accesses unrelated credential sources and increases secret exposure surface without clear user consent or scope disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The --fix path persists discovered secrets into openclaw.json automatically, which can duplicate sensitive values onto disk without an explicit warning or confirmation step. This increases the number of stored plaintext secret copies and may create unintended retention or permission risks if openclaw.json is less protected than the original source.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The main flow automatically loads ~/.mcporter/mcporter.json during a normal scan, causing the skill to inspect credentials outside the stated scope of ~/.openclaw/workspace/skills and ~/.openclaw/openclaw.json. This violates least privilege and can surprise users by pulling in external secret material for trust decisions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language description and invocation guidance are primarily in Chinese, which can impose a language expectation on users without explicit opt-in. The file does not indicate that the skill supports multiple languages or that the locale restriction is intentional and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The docstring says these keys are managed by mcporter and '不需要抽取到 openclaw.json', which implies they are outside the migration target set. However, scan_skills_dir still appends such matches to all_findings and only adds a flag, so the behavior is to report them rather than truly omit them from extraction consideration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.