Lerwee API Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:51 PM UTC
• Version: 1.0.2

Overview

This skill is a broad infrastructure administration API client with disclosed but high-impact powers and weak safety framing around credentials, plaintext HTTP, destructive actions, and remote execution.

Review before installing. Use this only with an authorized Lerwee environment, prefer HTTPS with certificate validation, replace all example credentials and tokens with real secrets stored outside prompts and files, and require explicit human confirmation for delete, uninstall, user-management, credential-bearing, file-transfer, and script-execution operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lerwee_api.py:18

Finding

Sensitive API and Administrative Data Can Be Transmitted Over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/lerwee_api.py:18-30, 74-80; related insecure defaults in README.md:23-24, 39-40, SKILL.md:16, 22, 238-239, 257, 265, and references/config.json:1-6
Vulnerability Type: Cleartext transmission of sensitive information
Risk Level: High

Vulnerable Code

python

def __init__(self, base_url: str, secret: str):
    """
    初始化客户端

    Args:
        base_url: API 基础地址 (如: http://192.168.1.79:8081/api/v6)
        secret: API 密钥
    """
    self.base_url = base_url.rstrip('/')
    self.secret = secret
    self.session = requests.Session()
    self.session.headers.update({
        'Content-Type': 'application/json',
        'Accept': 'application/json'
    })

python

url = f"{self.base_url}{endpoint}"
response = self.session.post(url, json=params, timeout=30)
response.raise_for_status()

return response.json()

The distributed configuration also explicitly selects HTTP:

json

{
  "base_url": "http://192.168.1.79:8081/api/v6",
  "secret": "",
  "timeout": 30,
  "retry": 3
}

Technical Analysis

The client accepts any URL scheme and submits the complete JSON request body through requests.Session.post. The documented and configured default URL uses unencrypted HTTP rather than HTTPS.

The generic request method is used for sensitive operations, including requests containing SSH passwords, user account passwords, API signatures, monitoring information, and destructive administrative commands. The request signature only attempts to establish request authenticity; it does not encrypt request content or prevent passive traffic inspection.

An attacker with access to the same network path, such as a compromised gateway, malicious Wi-Fi access point, local network peer capable of address-resolution poisoning, or upstream network observer, can inspect plaintext requests and responses. Because HTTP provides no ...[truncated 1397 chars]

Remediation

View remediation

Remediation Suggestions

1. Require HTTPS for all non-test endpoints and reject http:// URLs during client initialization.
2. Replace every documented and distributed default with an https:// URL.
3. Keep TLS certificate verification enabled and do not introduce verify=False.
4. Support a deliberately configured private certificate authority where internal deployments use private PKI.
5. Avoid placing reusable SSH passwords in API requests where key-based or short-lived authentication is available.
6. Add tests that verify client initialization fails for plaintext URLs unless an explicit, prominently warned local-development override is supplied.
7. Rotate any credentials previously transmitted over plaintext networks.
8. Consider application-level encryption for especially sensitive deployment credentials in addition to TLS.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lerwee_api.py:43

Finding

Destructive Array and Object Parameters Are Excluded from Request Signatures

Content

View full analysis

Vulnerability Details

File Location: scripts/lerwee_api.py:43-57; duplicated in scripts/sign_test.py:24-37 and documented in SKILL.md:56-65, 244-246
Vulnerability Type: Incomplete request integrity protection
Risk Level: High

Vulnerable Code

python

# 按字母顺序排序
sorted_items = sorted(params.items())

# 拼接参数（跳过 sign 字段、空值和数组）
str_to_sign = ''
for k, v in sorted_items:
    if k == 'sign':
        continue
    if v != "" and v is not None and not isinstance(v, (list, dict)):
        str_to_sign += f"{k}{v}"

# 加密钥前缀并 SHA1 加密
sign_str = self.secret + str_to_sign
return hashlib.sha1(sign_str.encode('utf-8')).hexdigest().lower()

Sensitive unsigned parameters are subsequently sent in the request body. For example:

python

def delete_hosts(self, hostids: List[int]) -> Dict[str, Any]:
    """
    删除监控对象

    Args:
        hostids: 对象ID数组

    Returns:
        删除结果
    """
    params = {'hostids': hostids}
    return self._request('/monitor/host-delete', params)

python

def delete_users(self, userids: List[int]) -> Dict[str, Any]:
    """
    删除用户

    Args:
        userids: 用户ID数组

    Returns:
        删除结果
    """
    params = {'userids': userids}
    return self._request('/auth/user-delete', params)

Technical Analysis

The signing routine explicitly excludes every list and dictionary from the signed input while those values remain present in the transmitted JSON body. Consequently, the signature does not cryptographically bind the entire request to the sender's intent.

Affected fields include destructive target lists such as hostids and userids, authorization-related lists such as group_ids, nested host interface settings, and externally received event collections. Two requests that differ only in an array or dictionary value produce the same signature when their scalar fields and timestamp are identical.

This issue is ...[truncated 1967 chars]

Remediation

View remediation

Remediation Suggestions

1. Sign the complete request body, including all arrays, nested objects, empty values whose presence is meaningful, and scalar fields.
2. Define one canonical JSON representation with stable object-key ordering, UTF-8 encoding, and unambiguous number, Boolean, and null handling.
3. Replace the custom prefix-hash construction with HMAC-SHA-256:

   python

   canonical = json.dumps(params, sort_keys=True, separators=(',', ':'), ensure_ascii=False)
   signature = hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()
   

4. Exclude only the signature field itself from the canonical payload.
5. Update server-side verification and all clients atomically to use the same canonicalization rules.
6. Enforce HTTPS independently of request signing.
7. Add replay protection using a short timestamp acceptance window and a unique nonce tracked by the server.
8. Add negative tests demonstrating that changing any nested value or array element invalidates the signature.
9. Version the signing protocol so legacy incomplete signatures can be rejected after migration.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:19

Finding

Reusable-Looking Administrator Password and Application Token Are Embedded in Documentation

Content

View full analysis

Vulnerability Details

File Location: README.md:19-29; additional token-like value in references/api_details_alert.md:202-209
Vulnerability Type: Hardcoded sensitive credentials
Risk Level: Medium

Vulnerable Content

json

{
  "base_url": "http://192.168.1.79:8081/api/v6",
  "secret": "",
  "admin": {
    "username": "admin",
    "password": "ITIM_p@ssw0rd"
  }
}

The API documentation also contains a realistic token-like value:

json

{
    "data": "{\"appid\":\"4133289624\",\"token\":\"1989b431c60ecc7fc0b957f7afe9c5f602f8c66f\",\"event_id\":123344,\"trigger_id\":5538,\"recovery_time\":1680745901}",
    "timestamp": 1680745901,
    "sign": "1989b431c60ecc7fc0b957f7afe9c5f602f8c6321"
}

Technical Analysis

The README presents a fixed password associated with the admin username and a specific internal API endpoint. Another documentation file includes an application identifier and a token-like hexadecimal value. These values are distributed to every recipient of the Skill package and may also be retained indefinitely in source-control history and downstream archives.

Static review cannot establish whether these values are currently valid, historical, or synthetic. Nevertheless, they are not marked as placeholders and have the form and context of reusable credentials. If either value was copied from a live environment or reused elsewhere, possession of the repository is sufficient to attempt unauthorized authentication.

Attack Path

1. An attacker obtains a copy of the Skill package or its repository history.
2. The attacker extracts the documented admin password, internal endpoint, application ID, and token-like value.
3. The attacker obtains network access to the configured service or identifies a reachable deployment where the credentials were reused.
4. The attacker attempts administrative login or event-platform authentication using the extracted values ...[truncated 832 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the password with an unmistakable placeholder such as YOUR_ADMIN_PASSWORD.
2. Replace the application token and signature with clearly nonfunctional placeholders.
3. Remove environment-specific internal IP addresses where they are not necessary for documentation.
4. Determine whether the exposed values were ever valid. If so, immediately rotate the administrator password, application token, API secret, and related sessions.
5. Review source-control history and published package versions for earlier exposure.
6. Add automated secret scanning to commits and release pipelines.
7. Store operational credentials in environment variables or an approved secret manager rather than documentation or tracked configuration.
8. Explicitly label all examples as synthetic and nonfunctional.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (34)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The README exposes what appears to be real administrator credentials (admin / ITIM_p@ssw0rd) in plaintext configuration examples. Even if intended as sample data, publishing privileged credentials in documentation encourages credential reuse, risks accidental deployment with defaults, and can directly compromise any reachable Lerwee instance using those values.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code chunk contains a helper function make_sign and a test_sign() routine that prints example signatures for sample parameter sets. This aligns with only one narrow part of the description: API signature generation/authentication logic. However, the declared purpose emphasizes a full API integration tool with extensive endpoint calling capabilities across many functional areas. No HTTP client usage, authentication workflow beyond local hashing, endpoint wrappers, resource management, query handling, or event platform interactions are present in this code. Therefore the description materially overstates the behavior of the supplied code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

md

- `scripts/lerwee_api.py` - Python API 客户端封装

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file documents a remote script execution API (/automation/script-exec) that enables arbitrary script content to run on specified hosts, which is materially more dangerous than a simple monitoring/integration capability suggested by the manifest. This mismatch can mislead reviewers or users into granting the skill broader trust and permissions than intended, increasing the risk of unauthorized remote code execution on managed infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented /automation/script-exec endpoint accepts arbitrary script content and target host_ids, enabling direct remote code execution across managed hosts. Without prominent warnings, restrictions, or safety controls in the skill documentation, this is extremely dangerous in an agent setting because prompt-driven or mistaken use could execute attacker-influenced commands on infrastructure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The README content is effectively Chinese-only, including usage instructions and operational notes, without offering an alternative language or stating that the skill is intentionally limited to a Chinese-speaking context. This can violate a language/locale policy when users are not given an opt-in or choice.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents network-capable behavior and includes examples that send requests to an API endpoint, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates a governance and least-privilege gap: an agent may be granted broader network capability than users expect, especially given the skill’s broad management and automation claims.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document specifies a fixed locale/timezone requirement of Beijing time (UTC+8), and later reinforces it in usage notes and examples, but does not present this as optional or explain why the skill must enforce that locale. Per policy, forcing a specific language or locale without opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises destructive and high-impact actions such as create, update, delete, uninstall, and script execution without prominent safeguards, confirmation requirements, or warnings about operational consequences. In an agent context, this increases the risk of unintended destructive changes, privilege misuse, or socially engineered execution of dangerous admin operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The example code performs an outbound HTTP POST to a private-network API endpoint, demonstrating external data transmission without transport security. If copied into practice, requests and signatures could be exposed to interception or tampering on the network, and sensitive operational queries could be sent to unintended systems if base_url is modified.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

params["timestamp"] = int(time.time()) params["sign"] = make_sign(params)

response = requests.post(f"{base_url}/monitor/host-list", json=params) print(response.json())

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The cURL example likewise demonstrates outbound transmission to an HTTP endpoint and can encourage insecure copy-paste usage. Because the skill concerns infrastructure management and monitoring, even seemingly routine requests may reveal internal topology, host data, or authenticated administrative actions if used in real environments.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

print(response.json())

text

### cURL 示例

```bash
# 获取监控对象列表

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents operations that acknowledge or change alert/event state, such as confirming problems and closing events/alerts, but it does not include any warning that these actions modify platform state or may be irreversible in practice. Under the markdown-specific SQP-2 criteria, descriptions of behaviors affecting operational data or system integrity should disclose that impact to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The request example includes what appears to be a real app token and derived signature value in documentation. If these are authentic or reused credentials, an attacker could use them to submit forged recovery requests or study the signing format for unauthorized API access; even if illustrative, publishing secrets normalizes unsafe handling of credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents multiple add, update, and delete operations for business objects, organizations, links, and topology records, but does not include any warning about potential impact on user data or system configuration. For markdown files, SQP-2 applies when descriptions omit warnings for behaviors that can affect data integrity or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs callers to provide raw SSH credentials, including ssh_pass, for batch install and update operations without any guidance on secure handling, storage, masking, or transport protections. In an agentic environment, this increases the risk of credential exposure through logs, prompts, telemetry, screenshots, or insecure client implementations, enabling unauthorized host access and lateral movement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file describes endpoints for uninstalling Agents and deleting Agent records/tasks, which can affect system integrity and operational state. The documentation provides request/response details only and does not include any caution, confirmation, or impact warning for these actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file describes the POST /monitor/host-delete endpoint and required hostids parameter, but it does not include any warning that the operation deletes monitoring objects or may be irreversible. For markdown files, destructive behaviors that can affect user data or system integrity should be accompanied by an explicit caution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states that displayed time '需转换为北京时间 (UTC+8)', which imposes a specific locale/timezone behavior rather than allowing user preference or clarifying that this is region-specific documentation. This is a natural-language locale policy issue because it mandates a fixed locale presentation without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Across the file, the documented API surface includes broad administrative operations such as user/role management, deletion endpoints, virtualization credential management, network changes, CMDB mutations, and system information access. Presenting the skill merely as a monitoring API integration understates its privileged control-plane scope, which can cause unsafe deployment decisions and excessive trust.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes destructive operations such as /user/delete without any cautionary language, confirmation requirements, or rollback guidance. In an agent skill context, omission of safety framing around deletion APIs raises the chance that an automated agent or operator will perform irreversible administrative actions unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The virtualization management endpoints handle highly sensitive fields such as username and password for virtual center connections, yet the documentation provides no guidance on secure secret handling, masking, storage, or transmission. In a skill context, this increases the risk of credentials being logged, exposed in prompts, or mishandled by downstream tooling while also enabling high-impact infrastructure modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file documents deletion-style operations such as deleting monitored objects, uninstalling agents, deleting users, departments, roles, tags, instances, and groups, but does not include any caution about irreversible or service-impacting actions. For markdown files, omitting warnings for behaviors that can affect data or system integrity meets the SQP-2 criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation explicitly references credential parameters such as ssh_user and ssh_pass for task modification without any guidance on secret handling, masking, storage, or logging avoidance. In an agent skill context, this increases the chance that downstream tools or users will pass credentials insecurely, expose them in logs, or persist them in plaintext during automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents high-impact operations such as script execution, file distribution, file upload, and likely remote host interaction, but provides no cautionary note about effects on user systems or managed hosts. Under the markdown-specific SQP-2 criteria, descriptions should warn when behavior could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code exposes deletion operations for monitored hosts and immediately sends the requests without any confirmation prompt, user-facing log, or cautionary comment beyond the function name/docstring. Because these operations can remove monitoring objects, the file lacks an explicit disclosure mechanism for a safety-critical action.

Content

No source excerpt is available for this finding.