ClawHub
Back to skill

Security audit

品牌分析师（Zeelin付费版）

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent brand-analysis API wrapper, but it asks users to send a billable App-Key and optional files to a temporary Cloudflare tunnel that its own notes say should have been replaced before publishing.

Install only after the publisher replaces the temporary tunnel with a stable, verifiably controlled production domain and documents how App-Keys and uploaded files are protected. Treat the App-Key like a billing credential, use a revocable key if available, and avoid sending confidential attachments until retention and deletion practices are clear.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Error
Location
SKILL.md:44
Finding

Sensitive credential and user data transmitted to an unverified temporary tunnel

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–75
Vulnerability Type: Credential and user data exposure
Risk Level: High

Vulnerable Configuration

markdown
`https://following-hull-easy-interactions.trycloudflare.com`

`POST https://following-hull-easy-interactions.trycloudflare.com/v1/brand-analyzer/generate`

Headers:
- `App-Key: <user App-Key>`

Body (multipart/form-data):
- `brand_name` (required)
- `query` (optional)

- If attachment upload is supported, additionally submit `file`.

The instructions require the agent to collect the user's App-Key before generating a report. The key is then transmitted in an HTTP header to a trycloudflare.com tunnel together with the brand name, optional query text, and potentially an uploaded file.

Technical Analysis

A Cloudflare quick tunnel is a temporary forwarding endpoint rather than a stable, organization-verifiable production API domain. The package does not provide a mechanism for authenticating the backend operator, pinning the expected service identity, limiting the credential's scope, or confirming that the endpoint belongs to the declared service provider.

The deployment documentation explicitly states that the packaged host must be replaced with a stable HTTPS domain before publication. Nevertheless, the current instructions contain an actionable endpoint and direct the agent to transmit sensitive information to it.

HTTPS protects traffic in transit but does not protect data from the remote endpoint operator. An operator controlling the tunnel or its origin service can receive:

  • The user's App-Key.
  • Brand names and query text.
  • Uploaded attachment contents.
  • Associated request metadata.

The package also does not define attachment restrictions, retention periods, deletion procedures, or purpose limitations. Consequently, users may unintentionally disclose sensitive business documents beyond what is necessar ...[truncated 1409 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the trycloudflare.com endpoint from the distributable package.
  2. Configure only a stable production domain controlled and verifiably owned by the service provider.
  3. Make release validation fail closed when the endpoint is missing, uses a tunnel service, or contains a placeholder hostname.
  4. Use narrowly scoped, revocable API tokens instead of credentials with broader account privileges.
  5. Avoid asking users to expose reusable keys in conversational text where the platform supports protected secret storage.
  6. Require explicit user confirmation immediately before transmitting credentials, query content, or files.
  7. Display the destination domain and the categories of data that will be transmitted.
  8. Restrict attachments by type, size, and business purpose, and reject unsupported files.
  9. Document server-side encryption, access controls, retention periods, deletion procedures, and logging practices.
  10. Provide key rotation and immediate revocation mechanisms in case a credential is disclosed.
  11. Apply rate limits and server-side authorization controls to reduce the impact of a stolen key.
  12. Do not activate the Skill until endpoint ownership and production readiness have been independently verified.

T09 · Insecure Skill Coding Practices

Warning
Location
references/deploy_notes.md:5
Finding

Release process permits deployment with an actionable placeholder endpoint

Content
View full analysis

Vulnerability Details

File Location: references/deploy_notes.md, lines 5–12
Vulnerability Type: Insecure release configuration
Risk Level: Medium

Vulnerable Configuration

markdown
## Publish checklist

1. Replace API host in SKILL.md with your stable HTTPS domain.
2. Ensure backend endpoint is online:
   - POST /v1/brand-analyzer/generate
3. Keep billing flow on backend only:
   - detail -> generate -> cost(50)
4. Do not include .env files, keys, or backend code in publish package.

## User experience target

- User provides App-Key only.
- Agent handles API calls directly.

Technical Analysis

The deployment notes acknowledge that the API host embedded in SKILL.md is not the intended stable production host. However, replacement is implemented only as a manual checklist item. The package contains no technical safeguard that prevents publication or execution while the temporary endpoint remains configured.

Because the endpoint in SKILL.md is syntactically valid and immediately callable, an agent can follow the instructions without recognizing that deployment preparation is incomplete. This is a fail-open release design: omission of a manual step causes sensitive traffic to be sent to the placeholder endpoint rather than causing execution to stop.

The issue is amplified by the stated user-experience goal that the user supplies only an App-Key while the agent handles API calls directly. Users therefore have little opportunity to inspect or validate the destination before their credential is transmitted.

Attack Path

  1. A publisher distributes the package without completing the manual hostname-replacement checklist item.
  2. The temporary endpoint remains embedded in SKILL.md.
  3. A user invokes the Skill and provides an App-Key as instructed.
  4. The agent treats the valid HTTPS URL as the production backend.
  5. The request is sent to the temporary tunnel, exposing the k ...[truncated 710 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the manual-only publication step with automated release validation.
  2. Reject builds containing tunnel domains, localhost addresses, example domains, or placeholder markers.
  3. Maintain an allowlist of approved production API hosts and verify the configured hostname against it.
  4. Require successful endpoint ownership, TLS, health, and API-contract checks before packaging.
  5. Remove any callable default endpoint so an incomplete configuration fails closed.
  6. Add continuous integration tests that inspect every instruction and configuration file for disallowed hosts.
  7. Require a security review when the production API hostname changes.
  8. Display the validated destination domain to users before requesting an App-Key.
  9. Add a release test proving that credentials cannot be transmitted when production configuration is absent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/deploy_notes.md (reported line 12)May include surrounding context.

md
- POST /v1/brand-analyzer/generate
3. Keep billing flow on backend only:
   - detail -> generate -> cost(50)
4. Do not include .env files, keys, or backend code in publish package.

## User experience target

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly instructs the agent to collect a user's App-Key and forward it in an HTTP header, but it does not clearly label the App-Key as a sensitive secret or warn against unnecessary disclosure, logging, or reuse. Because this credential gates billing and account access, users may expose it in chat history or to unintended intermediaries, increasing the risk of credential misuse and unauthorized charges.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.