ClawHub
Back to skill

Security audit

IndustryInformation

Security checks for vulnerabilities and agentic risk

Overview

The skill’s news-query purpose is legitimate, but it handles API credentials in unsafe ways and sends them over plaintext HTTP.

Review before installing. Do not paste API keys into chat, do not let an agent print `.env`, and rotate any FEEDAX key already used with this version. Only use this skill if the endpoint is changed to HTTPS and the key is passed through a secure environment or secret store without appearing in URLs or logs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/query_industry_information.py:35
Finding

FEEDAX API Key and Search Data Transmitted Over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:23
Finding

Overbroad Environment File Inspection and Unnecessary Credential Retention Request

Content
View full analysis
**GE1003**: API Key is not configured. Go to https://www.feedax.cn to apply for one for free, then tell me the API Key so I can remember it. ``` ```markdown ### Step 1: Check API Key configuration ```bash cat .env | grep FEEDAX_API_KEY ``` * If the result is empty or the file does not exist, tell the user: "API Key is not configured. Go to https://www.feedax.cn to apply, then tell me the API Key so I can remember it." ``` ### Technical Analysis The Skill directs the agent to execute `cat .env`, which reads and exposes the entire environment file even though the task requires only the presence of `FEEDAX_API_KEY`. Project `.env` files commonly hold unrelated database passwords, cloud credentials, signing secrets, tokens, and service configuration. Reading all entries exceeds the minimum access needed to determine whether one named variable is configured. The later `cat .env | grep FEEDAX_API_KEY` instruction is narrower, but it still prints the credential value into tool output and agent context. The instruction to ask the user to provide the key conversationally “so I can remember it” creates additional unnecessary disclosure and retention risk. The executable already supports reading the named environment variable directly, so neither conversational disclosure nor full-file inspection is needed. There is no evidence that this package implements a persistent memory-writing mechanism. Therefore, this finding concerns unsafe secret access and handling rather than a confirmed persistent memory-poisoning behavior. ### Attack Path 1. A project contains a `.env` file with `FEEDAX_API_KE ...[truncated 1155 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:51
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 2. Generate and verify cryptographic hashes for all direct and transitive dependencies, then install with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Use a trusted package index configured explicitly for the deployment environment. 4. Periodically update pinned versions through a controlled review process that includes vulnerability scanning and regression testing. 5. Install dependencies in an isolated virtual environment with the minimum filesystem and network privileges required. 6. Add automated dependency scanning to CI so known vulnerabilities in pinned packages are detected before release. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill explicitly instructs access to .env, a common repository of secrets, to verify API key presence. In context, this is more dangerous because .env often stores multiple credentials; reading it exposes far more than the single FEEDAX key needed for the stated functionality.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

查看 .env 文件是否存在且包含有效的 API Key：

bash
cat .env

如果未配置

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Requesting that users provide their API key to the agent so it can 'remember' it is an unsafe credential-handling pattern with no warning about privacy, storage, or exposure. In skill context, this is especially dangerous because the requested secret is unrelated to conversational memory and could be retained in logs, model context, or downstream systems.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instruction to ask the user for the API key and 'remember' it is a direct request to retain a secret in natural-language agent memory. This is dangerous because LLM memory, chat transcripts, and telemetry are not appropriate secret stores and may later reveal the credential to unauthorized parties or unrelated tasks.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The command cat .env | grep FEEDAX_API_KEY still requires opening a secret file and may surface credential material in terminal output, logs, or model-visible context. Even targeted grep-based checks are inappropriate when the agent does not need direct secret access to perform news retrieval.

Content

Scanner excerpt · SKILL.md (reported line 579)May include surrounding context.

Step 1: 检查 API Key 配置

bash
cat .env | grep FEEDAX_API_KEY
  • 如果返回空或文件不存在，提示用户："未配置 API Key，请前往 https://www.feedax.cn 申请，完成后请告诉我 API Key 以便我记住"

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The execution flow repeats the instruction to solicit and remember the user's API key, reinforcing insecure credential collection and persistence as a required operational step. Repetition in procedural steps makes accidental compliance by the agent more likely and increases the chance of long-term secret exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script hardcodes a plain HTTP base URL and sends the API key in both the query string and headers, along with user search terms and returned metadata. This exposes credentials and potentially sensitive query activity to interception or modification by any party on the network path, and the query-string placement further increases leakage via logs, proxies, and monitoring systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes querying industry information via the FEEDAX API but does not clearly warn that user-supplied keywords and query parameters will be transmitted to an external third-party service. This creates a privacy and data-handling transparency issue: users may unknowingly send sensitive research interests, internal project names, or regulated business context outside their environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes capabilities to read environment files, execute shell/Python commands, write local files, and access a remote API, but it declares no explicit tool scope or permissions boundary. This mismatch increases the chance an agent will perform sensitive actions without clear user/admin approval or sandboxing expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to inspect the local .env file using shell commands to determine whether an API key exists. Reading a general secret file is broader than necessary for the task and can expose unrelated credentials or sensitive configuration contents to the agent and logs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs the agent to ask the user for an API key 'so it can remember' it, which turns a news-query workflow into credential collection and retention. Asking an LLM agent to store secrets in conversation or memory creates a clear risk of credential exposure, reuse outside user intent, or later leakage in prompts/logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill requires automatic saving of all returned data to local CSV and Markdown files without clear prior notice or consent about persistence. This creates privacy and data-governance risk because potentially sensitive query results and content are retained on disk by default and may be accessible to other users or processes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill prescribes executing local shell and Python CLI commands as part of normal operation, expanding the attack surface beyond simple query/analysis behavior. If user-controlled inputs flow into command construction or if the script is modified locally, this can lead to command misuse, unauthorized file access, or unintended system interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The execution flow tells the agent to read .env to inspect API key configuration without warning that this file may contain sensitive credentials. Even if only one variable is intended, the behavior normalizes secret-file access and risks over-collection or accidental disclosure in command output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring, CLI description, help text, and user-facing messages are presented in Chinese only, which imposes a specific language on users without any opt-in or alternative locale. Under the stated policy, forcing a language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This code transmits user-supplied keywords and associated request metadata to an external service, which is expected for the skill but still constitutes data exfiltration from the local environment to a third party. In this specific skill context, external transmission is necessary functionality, but it becomes riskier because the destination is an IP-based endpoint over insecure HTTP and the transmitted data includes an API key.

Content

Scanner excerpt · scripts/query_industry_information.py (reported line 98)May include surrounding context.

python
}
    
    try:
        response = requests.post(url, params=params, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README specifically directs use of an English-language variant ("Readme_en.md") as a supported language example, which can imply a language preference without offering user choice or documenting a justified locale constraint. This is a natural-language policy concern because the file is explicitly language-scoped yet does not explain whether language selection is optional or user-driven.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

全文说明、示例对话、参数解释和输出示例均默认使用中文，没有提供语言选择、用户偏好说明或该语言限制的业务理由。根据语言/locale 政策，技能不应在未获用户明确选择的情况下强制单一语言。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.