Security audit

apihz-cn

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent ApiHz API client, but its credential handling can expose user API keys through HTTP fallback paths and unvalidated catalog URLs.

Review before installing with real credentials. Use a low-privilege ApiHz account, rotate any exposed/test key, force HTTPS-only APIHZ_BASE_URL and APIHZ_LIST_URL, avoid HTTP fallback nodes, and do not use remotely supplied catalog URLs unless the destination is validated against trusted ApiHz hosts. Verify that .credentials/apihz.txt is ignored and owner-readable only before committing or sharing the workspace.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: TEST-REPORT-FINAL.md:5
Finding: Live API Credential Published in the Test Report
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/auth.js:481
Finding: Reusable Credentials Transmitted Through Plaintext HTTP Fallback Nodes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/call-api.js:154
Finding: Untrusted Remote Catalog URLs Can Receive Automatically Attached Credentials
Content: View full analysis
{ ``` For POST requests, the same credentials are written to the request body: ```javascript if (method === 'POST') { req.write(querystring.stringify(allParams)); } ``` ### Technical Analysis `api.apiurl` comes from an externally retrieved catalog. JavaScript ...[truncated 2487 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: .gitignore:1
Finding: Credential Files Are Not Ignored and Are Written Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation frames the skill as API consumption, but it also performs initialization, workspace configuration management, and credential setup. Hidden or under-disclosed setup behavior is risky because it expands the trust boundary from simple API calls to local state management and secret lifecycle operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation frames the skill as API consumption, but it also performs initialization, workspace configuration management, and credential setup. Hidden or under-disclosed setup behavior is risky because it expands the trust boundary from simple API calls to local state management and secret lifecycle operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The report includes what appears to be a full API key value directly in markdown and later repeats a visible prefix of the key. Even if the author claims it is "encrypted storage," publishing credential material in a report can enable unauthorized API use, account abuse, and downstream compromise if the secret is still valid or reused elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The backup servers use plain HTTP, and the script sends id and key in URL query parameters to those endpoints. That exposes credentials to interception by network attackers and to leakage via logs, proxies, or monitoring systems; because the same credentials are used for account actions, compromise can enable unauthorized access and account abuse.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code comments claim backup nodes do not transmit sensitive credentials, but multiple call paths build URLs containing id and key and then send them to HTTP backup servers during failover. This exposes API credentials to interception or modification by any network attacker on the path and is made worse by the misleading security documentation, which may cause maintainers to underestimate the risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: At this call site, the code fetches API data using a backup HTTP endpoint while embedding id and key in the query string. Cleartext transmission of credentials allows passive capture and active tampering, and because this skill is specifically an API client handling authentication material, the context makes the exposure more serious.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The phoneLookup and idcardLookup methods send highly sensitive personal data to a third-party API without any visible warning, consent flow, or safeguards in this code. Because phone numbers and national ID values are regulated identifiers in many jurisdictions, unauthorized transmission can cause serious privacy, compliance, and abuse risks.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill documents use of environment variables and credential handling but does not declare any tool scope or permissions boundaries. In an agent ecosystem, this omission weakens reviewability and can allow the skill to access local environment-derived secrets or configuration without explicit user awareness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language content throughout the file forces a specific language experience for users, and the document does not provide an opt-in, alternative language, or a justification that this skill is intended only for a Chinese-speaking or region-specific context. This matches the policy category for language or locale constraints without user choice.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The skill encourages persistence via cron for daily automated check-in. Persistence is not inherently malicious here, but scheduled execution increases risk because secrets are reused automatically over time, network actions continue without active user review, and compromise of the script or workspace would yield recurring unauthorized activity.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
自动签到脚本:

bash
# 添加到 crontab (每天 00:02 执行) crontab -e # 添加以下行 (替换路径) 2 0 * * * OPENCLAW_WORKSPACE=/your/path node /your/path/skills/apihz/scripts/auto-checkin.js

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The skill explicitly supports fetching service endpoints and using a cluster IP over plain HTTP. Even if the documentation says credentials are not sent when querying the list, relying on externally supplied endpoints and advertising non-TLS transport increases the risk of tampering, traffic interception, or redirection to malicious infrastructure.
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
| 集群 IP | http://101.35.2.25/api/... | 速度快，CC 防火墙严格 | ⭐⭐ 备用 | | VIP 线路 | https://vip.apihz.cn/api/... | 超高稳定，CC 防火墙宽松 | ⭐⭐⭐⭐ 企业 |

获取最优 IP: 访问 https://api.apihz.cn/getapi.php 获取当前最优 IP 地址

示例 (天气 API):

bash

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill claims credentials are stored with AES-256-GCM encryption, yet the same file documents a plaintext-style credential file layout containing ID, KEY, and DMSG values. Security documentation that overstates protection can lead users to store sensitive secrets under false assumptions, increasing exposure if the workspace is read by other tools or users.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This section again documents retrieval of the 'best IP' from an external service and use of plain HTTP cluster IPs. Dynamic endpoint selection without authenticated integrity checks can expose users to man-in-the-middle manipulation or unsafe failover behavior, especially because the skill handles account credentials and automated requests.
Content: Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.
md
- 🟢 **域名接口** (默认): `https://cn.apihz.cn` - 自动分发，CC 防火墙适中 - 🟢 **集群 IP**: `http://101.35.2.25` 等 - 速度快，CC 防火墙严格，定期更新 - 🟡 **VIP 线路**: `https://vip.apihz.cn` - 超高稳定，CC 防火墙宽松 (需购买) - 📖 **获取最优 IP**: 访问 `https://api.apihz.cn/getapi.php` 获取当前最优 IP 4. **网络传输:** - ✅ 主 API 使用 HTTPS 加密 (`https://cn.apihz.cn`)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The report recommends using an HTTP fallback node for synchronization without clearly warning that HTTP lacks transport encryption and strong integrity protection. In an API aggregation skill handling credentials and fetched API metadata, this could expose requests to interception, tampering, replay, or malicious content injection by a network attacker.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Comments and console messages throughout the file are presented only in Chinese, including the primary user-visible execution output. This creates a language/locale restriction without indicating that the skill is region-specific or offering an alternative language selection.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Manifest 将技能描述为提供“天气/地震/IP 归属地/临时邮箱/翻译等”企业级 API 接口集合，但该脚本实际执行的是读取本地认证文件、解密凭据、自动签到以及查询账户会员/调用量信息。这不是对外提供 API 接口的显然实现细节，而是一个账户自动化维护能力，和清单描述的能力范围存在语义偏移。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 76% confidence
Finding: 代码读取主机名、当前用户名和工作目录生成机器指纹，并将其作为解密密钥的一部分，用于访问认证信息。对于一个宣称提供 API 接口的技能而言，本机身份采集与设备绑定并非其公开目的所直接要求的能力，属于与 stated purpose 不完全相称的附加能力。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's user-facing description and prompts are written exclusively in Chinese, presenting the skill as an interactive assistant without any indication that language selection is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · src/auth.js (reported line 46)May include surrounding context.
js
'http://81.68.149.132' // 接口地址 3 - 备用 ]; // 最优 IP 获取接口 (定期调用更新备用服务器列表) this.bestIpUrl = options.bestIpUrl || 'https://api.apihz.cn/getapi.php'; // 官方注册链接 this.registerUrl = 'https://www.apihz.cn/?shareid=你的 ID';

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: saveConfig persists API ID and encrypted secret material to .credentials/apihz.txt, which is a safety-relevant file write involving credentials. The file contains comments and success logs, but there is no confirmation prompt before overwriting or creating the credentials file, and the initialization flow presents this as automatic setup behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 注释写明“这里调用 cron 工具创建任务”，且 initialize() 会向用户报告“自动签到任务已创建”，但 createCheckInTask() 只是直接返回成功对象，没有进行任何调度、持久化或外部调用。该文档与用户提示共同造成了代码意图和实际行为的明显背离。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code constructs a GET URL for dcan that includes id and key in the query string, and the default apiUrl uses plain HTTP. This can expose credentials through browser/proxy/server logs, monitoring systems, referer leakage, and network interception, especially because the request is sent to a configurable external endpoint rather than the main HTTPS base URL.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generic request helper automatically sends API credentials together with all user-supplied query parameters to an external service, but this file provides no disclosure, consent, or data-minimization controls. That creates a broad data-exfiltration surface because any input passed to the client is transmitted off-system to a third party.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The client exposes ping, port scanning, WHOIS, ICP, and SSL probing methods that enable network reconnaissance against arbitrary targets. While these may be legitimate API features, they expand the skill from general information retrieval into infrastructure-enumeration capability, which can be abused for target discovery and reconnaissance in environments where users may not expect offensive-adjacent functionality.
Content: No source excerpt is available for this finding.