ClawHub
Back to skill

Security audit

文件加解密 (file-crypto)

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for internal file encryption, but it needs review because it can alter server files, exposes reusable auth tokens, and its local-only claims conflict with a plaintext remote API endpoint.

Install only after the publisher clarifies the network data flow, replaces plaintext HTTP with authenticated HTTPS or removes the remote dependency, documents what file or token data is sent, constrains allowed file paths, and changes command guidance to use safe argument-array execution with explicit confirmation for each operation. Treat authId values as secrets, not normal chat output.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:70
Finding

Shell Command Injection Through Unquoted User-Controlled Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:70-80 and SKILL.md:142
Vulnerability Type: OS command injection
Risk Level: High

Complete Code Snippet

bash
cd /data/endecode-win-linux && python3 -m file_crypto --action encrypt --filePath <文件路径> --authId <身份令牌>
bash
cd /data/endecode-win-linux && python3 -m file_crypto --action encrypt --filePath <文件路径> --authId <身份令牌> --outputPath <输出路径> --expireTime <时间戳>
bash
cd /data/endecode-win-linux && python3 -m file_crypto --action decrypt --filePath <文件路径> --authId <身份令牌>
bash
cd /data/endecode-win-linux && python3 -m file_crypto --action getAuth --agentId <Agent标识>

Technical Analysis

The Skill instructs the Agent to interpolate user-controlled file paths, output paths, authentication identifiers, expiration values, and Agent identifiers directly into shell command strings. None of these values are quoted, escaped, or validated before being placed in the command.

If the Agent executes these templates through a shell, metacharacters such as semicolons, command substitutions, redirection operators, pipes, or additional logical operators will be interpreted by the shell rather than passed as literal argument content. Validation performed by the Python module cannot prevent this issue because shell interpretation occurs before file_crypto receives the arguments.

File paths are particularly exposed because legitimate paths may contain spaces and shell-significant characters. The Skill also explicitly instructs the Agent to preserve paths as supplied, without defining an allowed directory, canonicalization process, or metacharacter restrictions.

Attack Path

  1. An attacker asks the Agent to encrypt or decrypt a purported server file.
  2. The attacker supplies a crafted path, output path, token, or Agent identifier containing shel ...[truncated 1648 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not construct a shell command by concatenating or interpolating user-controlled values.
  2. Invoke Python with an argument-array API that does not use a shell. For example, an implementation should use an equivalent of:
    python
    subprocess.run(
    [
        "python3",
        "-m",
        "file_crypto",
        "--action",
        action,
        "--filePath",
        file_path,
        "--authId",
        auth_id,
    ],
    cwd="/data/endecode-win-linux",
    shell=False,
    check=True,
    capture_output=True,
    text=True,
)
  3. Restrict action to an explicit allowlist: encrypt, decrypt, or getAuth.
  4. Parse expireTime as an integer in application code and reject non-positive values before execution.
  5. Canonicalize file paths and enforce an allowlisted server data root. Reject traversal outside that root, symbolic-link escapes, device files, directories, and unexpected file types.
  6. Enforce the documented maximum length and expected character format for authId and agentId.
  7. Ensure output paths cannot overwrite configuration, executables, credentials, or other security-sensitive files.
  8. If shell invocation cannot be removed, apply robust platform-specific argument escaping to every value. Simple quote replacement or blacklist-based filtering is not sufficient.
  9. Run the file processor under a dedicated, minimally privileged operating-system account with filesystem and network restrictions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:193
Finding

Plaintext External API Endpoint Contradicts the Declared Local-Only Data Flow

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-13 and SKILL.md:193-202
Vulnerability Type: Insecure plaintext network configuration and inaccurate security disclosure
Risk Level: Medium

Complete Code Snippet

The Skill states at lines 12-13 that execution is local, does not access an external network, and does not upload data to a third party. However, the documented configuration contains the following external plaintext endpoint:

json
{
  "endecode_path": "endecode",
  "api_base_url": "http://47.98.150.16:52027",
  "timeout_seconds": 30
}

Technical Analysis

The api_base_url points to a public IP address using unencrypted HTTP. This configuration is inconsistent with the Skill's explicit claim that it does not access an external network. The document also discusses backend responses, authentication failures, expired sessions, and keys, which indicates that the configured backend may participate in authentication or file-processing operations.

Plaintext HTTP does not provide transport confidentiality, server authentication, or response integrity. Any network intermediary capable of observing or modifying the connection may inspect requests, alter responses, impersonate the backend, or capture data sent by the SDK.

The package contains only SKILL.md; it does not include the file_crypto SDK implementation. Consequently, the audit cannot determine exactly which request fields, tokens, file identifiers, keys, or file contents are transmitted. This uncertainty does not remove the transport weakness, but it limits the ability to establish the exact exposed data set.

Attack Path

  1. The Agent invokes getAuth, encryption, or decryption as documented.
  2. The preinstalled SDK reads api_base_url from file-crypto.json.
  3. The SDK establishes a plaintext HTTP connection to 47.98.150.16:52027.
  4. An attacker with a suitable network position intercepts or modifies the HTTP tr ...[truncated 1343 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the plaintext HTTP endpoint with an authenticated HTTPS endpoint.
  2. Use a company-controlled DNS name instead of a bare public IP address, and enforce certificate hostname and trust-chain validation.
  3. Consider certificate or public-key pinning where the deployment and certificate-rotation model can support it safely.
  4. Accurately document all network access, the operator of the endpoint, transmitted fields, retention policy, and whether file contents or cryptographic material leave the server.
  5. If the design is genuinely local-only, remove the remote endpoint and all backend dependencies.
  6. Never transmit authId, keys, file contents, or sensitive metadata over plaintext transport.
  7. Add explicit request and response schemas, reject unexpected fields, and authenticate responses at the application layer where appropriate.
  8. Restrict outbound network access for the file-processing account to only approved destinations and ports.
  9. Provide the SDK implementation or a verifiable security specification for review so that the complete data flow and server trust model can be audited.
  10. Avoid printing complete long-lived authentication tokens in conversation output; mask tokens and store them through an approved secret-management mechanism.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs the agent to return the internal authId directly to the user. Exposing bearer-style internal identity tokens in plain text can enable replay, impersonation, unauthorized file operations, and lateral abuse if the token is copied from chat logs or shared across users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are overly broad and mandatory, causing the skill to activate whenever file encryption/decryption or certain path-like inputs are mentioned without sufficient guardrails. In context, this increases the chance of unintended execution on arbitrary server-local paths and bypasses safer confirmation or eligibility checks before invoking a sensitive file-processing tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

文件整体以中文规定技能行为与返回文案，但未说明是否应根据用户语言偏好响应，也未提供多语言或用户选择机制。对于自然语言技能，若默认或强制单一语言而无用户选择，可能构成语言/locale 策略违反。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill claims it does not access external networks, yet later documents a remote API endpoint and backend-driven error conditions. This mismatch can mislead operators and downstream policy engines into treating the skill as local-only, reducing scrutiny for data egress and network trust boundaries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The inline safety claim conflicts with later sections that describe backend/API interaction, including a configured API base URL and server-side auth behavior. Contradictory trust statements are dangerous because they can cause users or automation to ignore real network exposure and mishandle sensitive files or tokens.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.