ClawHub
Back to skill

Security audit

wild-idea

Security checks for vulnerabilities and agentic risk

Overview

This is a real brainstorming skill, but it uses unsafe search and credential patterns that users should review before installing.

Install only if you are comfortable with the skill sending search terms to Tavily and using a local Tavily API key. Avoid using it with confidential product ideas unless external search is approved, and prefer replacing the curl/.env examples and unpinned home-directory helper with a scoped, reviewed API client.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
references/tavily-curl-example.md:34
Finding

Shell Command Injection Through Unescaped Search Queries

Content
View full analysis
Remediation
View remediation
1000: raise ValueError("Search query is too long") payload = json.dumps({ "api_key": key, "query": q, "search_depth": "basic", "max_results": 3, }).encode("utf-8") request = urllib.request.Request( "https://api.tavily.com/search", data=payload, headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(request, timeout=15) as response: result = json.load(response) ``` 5. Where supported by the API, transmit credentials in an authorization header rather than in the JSON body. 6. Ensure logs and error messages redact credentials. 7. If an external program must be used, invoke it with an argument array and without a shell. Do not place secrets directly in command-line arguments. 8. Add tests containing quotes, semicolons, command substitution syntax, newlines, and Unicode control characters to confirm that query values cannot alter command execution. ]]>

T08 · Insecure Dependencies

Warning
Location
scripts/search_char.py:14
Finding

Execution of an Unverified Mutable Script from the User Home Directory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (28)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a mechanism for injecting concrete examples from specific remote domains and directly pairing them with user-domain counterparts under two gates: a comfort check and prior-web-verification check. The supplied code does none of that. It is a simple random picker over a static list of Mao-era sayings and abstract thematic labels, outputting selected entries as JSON. There is no handling of user-domain counterparts, no remote-domain inventory matching the declaration, no gating logic, no web access, and no reroll behavior. This is a clear material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description describes a high-level content-generation mechanism: choosing concrete examples from specific remote domains, placing them directly against user-domain counterparts, and applying two gates (comfort and prior-web-verification). The supplied code instead implements a utility for generating a search query from random Chinese characters and fetching search results through an external search script. Its primary purpose is search/query generation, not analogy/domain injection. There is no logic related to the listed domains, no user-domain counterpart handling, no juxtaposition output, no comfort filter, and no reroll or already-done verification. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The example instructs readers to extract a credential from ~/.openclaw/.env, demonstrating direct access to local secrets from within skill content. In this context, the skill's stated purpose is ideation and verification, so embedding local credential harvesting behavior is broader than necessary and normalizes unsafe secret access patterns.

Content

Scanner excerpt · references/tavily-curl-example.md (reported line 10)May include surrounding context.

bash
# 读取 API key
KEY=$(grep TAVILY_API_KEY ~/.openclaw/.env | cut -d'=' -f2)

# 单条搜索
curl -s "https://api.tavily.com/search" \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/tavily-curl-example.md (reported line 13)May include surrounding context.

md
KEY=$(grep TAVILY_API_KEY ~/.openclaw/.env | cut -d'=' -f2)

# 单条搜索
curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "'"$KEY"'",

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

This Python example programmatically shells out to grep a local .env file for credentials, then reuses that secret in later requests. That combines credential access with command execution and makes the skill materially more dangerous because it operationalizes secret extraction rather than merely mentioning configuration.

Content

Scanner excerpt · references/tavily-curl-example.md (reported line 34)May include surrounding context.

md
import json
from hermes_tools import terminal

key = terminal("grep TAVI ~/.openclaw/.env | cut -d'=' -f2", timeout=5)['output'].strip()

queries = [
    "候选建议1",

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/tavily-curl-example.md (reported line 43)May include surrounding context.

md
for q in queries:
    r = terminal(
        f'''curl -s "https://api.tavily.com/search" -H "Content-Type: application/json" -d '{{
            "api_key": "{key}",
            "query": "{q}",
            "search_depth": "basic",

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description claims targeted use of concrete remote domains such as hydrothermal vents, monasteries, bee dances, and similar categories. This code loads a file of common Chinese characters, randomly combines two characters or accepts an arbitrary query, and searches for that term, which does not implement the stated domain-injection or counterpart-juxtaposition behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares operational behavior that includes file access, shell execution, and network access, but it does not define any tool scope or permission boundaries. In an agent environment, this increases the chance that the skill can invoke capabilities beyond what a user would reasonably expect, especially because the workflow explicitly calls scripts and external APIs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill activates its second-iteration mode when the user says phrases like "iterate" or "go deeper," which are common conversational expressions and not specific to this skill's operation. The file provides no exclusion conditions or negative examples to distinguish ordinary discussion from an invocation signal.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill instructs the agent to send generated search queries to Tavily via curl, which is an external transmission of potentially sensitive user-derived content. Because the skill's purpose is to transform user problems into novel counterparts, those queries may contain confidential product ideas, internal terminology, or business context that would be disclosed to a third party.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

No fabricating.

Web Verification (Tavily)

Use curl + Tavily API to verify counterparts are novel:

bash
curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This finding confirms a concrete outbound destination, https://api.tavily.com, and shows that the skill uses an API key plus user-influenced query text for web verification. In context, the danger is elevated because the skill repeatedly rerolls and searches for novelty, which can amplify leakage of proprietary prompts, concepts, or outputs to an external service.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

Web Verification (Tavily)

Use curl + Tavily API to verify counterparts are novel:

bash
curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "'"$TAVILY_API_KEY"'", "query": "your search", "search_depth": "basic", "max_results": 5}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The entire skill reference file is written only in Chinese and provides no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The document is written as output-format instructions in Chinese and explicitly prescribes presentation formats and phrases, but it does not mention any user opt-in for language selection. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file is entirely written in Chinese and the invocation guidance does not indicate any language choice, opt-in, or region-specific justification. Under the policy, a skill that effectively requires a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code transmits data to an external service, including a locally retrieved API key and search query content. External transmission is expected for web search, but embedding it in skill documentation with direct secret injection increases the chance that sensitive local context or credentials are sent out without clear authorization boundaries.

Content

Scanner excerpt · references/tavily-curl-example.md (reported line 13)May include surrounding context.

md
KEY=$(grep TAVILY_API_KEY ~/.openclaw/.env | cut -d'=' -f2)

# 单条搜索
curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "'"$KEY"'",

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code transmits data to an external service, including a locally retrieved API key and search query content. External transmission is expected for web search, but embedding it in skill documentation with direct secret injection increases the chance that sensitive local context or credentials are sent out without clear authorization boundaries.

Content

Scanner excerpt · references/tavily-curl-example.md (reported line 13)May include surrounding context.

md
KEY=$(grep TAVILY_API_KEY ~/.openclaw/.env | cut -d'=' -f2)

# 单条搜索
curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "'"$KEY"'",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example code invokes a terminal helper to run shell commands and reads a local secret from ~/.openclaw/.env even though this reference file is framed as search guidance, not local secret handling. It also interpolates both the API key and query text directly into a shell command, creating unnecessary command-execution and secret-exposure risk if copied into an agent workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The batch example sends dynamically constructed queries to a remote endpoint through a shell command assembled with Python f-strings. Because the query value is inserted into shell syntax, an attacker-controlled or malformed query could break quoting and trigger unintended shell behavior in addition to external data transmission.

Content

Scanner excerpt · references/tavily-curl-example.md (reported line 43)May include surrounding context.

md
for q in queries:
    r = terminal(
        f'''curl -s "https://api.tavily.com/search" -H "Content-Type: application/json" -d '{{
            "api_key": "{key}",
            "query": "{q}",
            "search_depth": "basic",

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The batch example sends dynamically constructed queries to a remote endpoint through a shell command assembled with Python f-strings. Because the query value is inserted into shell syntax, an attacker-controlled or malformed query could break quoting and trigger unintended shell behavior in addition to external data transmission.

Content

Scanner excerpt · references/tavily-curl-example.md (reported line 43)May include surrounding context.

md
for q in queries:
    r = terminal(
        f'''curl -s "https://api.tavily.com/search" -H "Content-Type: application/json" -d '{{
            "api_key": "{key}",
            "query": "{q}",
            "search_depth": "basic",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This Python file contains user-facing natural-language content entirely in Chinese, including the module docstring and the seed texts it emits as output. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script executes another skill script from a user-home directory path that is outside this project and not integrity-checked. In a skill ecosystem, this expands the trust boundary: if that external file is replaced or tampered with, running this script will execute attacker-controlled code under the current user's privileges.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a dual-gate behavior including web verification of whether an idea was already done and rerolling if so. In this file, the code merely generates or accepts a query, invokes a Tavily search helper, and prints up to three results; there is no logic to determine whether a juxtaposition is already done, no comfort check, and no reroll path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

User-provided or randomly generated queries are sent to an external search component without clear notice or opt-in, which creates a privacy and data-handling risk. In a skill context, users may not expect their input to be transmitted off-box, and sensitive terms could be disclosed to third-party services or logs.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/search_char.py (reported line 39)May include surrounding context.

python
"""调用Tavily脚本搜索"""
    if not TAVILY_SCRIPT.exists():
        return None
    result = subprocess.run(
        [sys.executable, str(TAVILY_SCRIPT), "--query", query,
         "--max-results", str(max_results), "--format", "brave"],
        capture_output=True, text=True, timeout=30

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template hard-codes Chinese output (for example, the title and body labels) without any apparent user language or locale negotiation. This can cause unsafe or misleading behavior when users expect another language, leading to misunderstanding of generated content and reduced usability, though it is not a direct code-execution or data-exfiltration issue.

Content

No source excerpt is available for this finding.