ClawHub
Back to skill

Security audit

Codex Adapter Toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent local adapter guide, but it asks users to handle API keys and email credentials through command-line commands without enough security guidance.

Review this skill carefully before installing. Use environment variables or a credential manager for provider API keys and email passwords instead of pasting real secrets into commands. Treat webhook URLs as secrets, check what any referenced scripts actually do before running them, and confirm backup restore and startup registration behavior before enabling them.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:56
Finding

API Credentials Passed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56-85
Vulnerability Type: Exposure of sensitive credentials through process arguments and shell history
Risk Level: Medium

Vulnerable Code

powershell
.\scripts\install-adapter.ps1 -Provider deepseek -ApiKey "your-api-key"
bash
python adapters/universal_adapter.py <port> <provider-type> [api_key] [failover-providers...]

# DeepSeek primary provider
python adapters/universal_adapter.py 18669 deepseek "sk-xxxx"

# DeepSeek primary provider with OpenAI and Gemini failover
python adapters/universal_adapter.py 18669 deepseek "sk-xxxx" openai gemini

Technical Analysis

The documented invocation patterns pass provider API credentials directly as command-line arguments. Although the examples use placeholders, users are instructed to replace them with real credentials.

Command-line secrets can be exposed through:

  • PowerShell or shell command history.
  • Process command-line inspection while the adapter is running.
  • Process-monitoring and diagnostic utilities.
  • Terminal transcripts, support bundles, or automation logs.
  • Wrapper scripts that record their received arguments.

The project contains only SKILL.md, so the referenced scripts and adapter implementation were unavailable. Consequently, it was not possible to determine whether they additionally log, persist, or otherwise expose these arguments.

Attack Path

  1. A user follows the documentation and substitutes a valid provider API key for the placeholder.
  2. The shell records the command in persistent history, or the adapter remains active with the key present in its process command line.
  3. A local user, monitoring agent, diagnostic process, or log reader obtains access to that history or process metadata.
  4. The exposed API key is recovered.
  5. The key is used against the corresponding provider API until it is revoked, expires, or reaches its ...[truncated 847 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove API keys from command-line examples and interfaces.
  • Read secrets from provider-specific environment variables or a protected operating-system credential store.
  • Prefer Windows Credential Manager, macOS Keychain, Linux Secret Service, or an equivalent managed secret system.
  • If interactive configuration is necessary, use a masked prompt and avoid echoing the value.
  • Pass only a credential identifier or environment-variable name to the adapter process.
  • Ensure scripts never log secret values and redact credentials from diagnostics and error messages.
  • Disable unnecessary command transcription and prevent secret-bearing commands from being written to history.
  • Restrict configuration-file permissions to the owning user if secrets must be persisted.
  • Rotate any real credentials previously supplied using the documented command-line pattern.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:159
Finding

Email Password Embedded in a Command-Line Configuration Value

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 159
Vulnerability Type: Plaintext email credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

powershell
.\notify.ps1 -Config -Channel email -ConfigAction set -ConfigValue "smtp:port:user:pass:from:to"

Technical Analysis

The notification configuration format places the SMTP username and password inside a colon-delimited command-line argument. When a user replaces user and pass with actual credentials, the complete SMTP credential can become visible in shell history, process metadata, terminal transcripts, automation logs, and diagnostic output.

Bundling several fields into one plaintext value also makes reliable redaction more difficult. The referenced notify.ps1 implementation was not present in the audited project, so its storage protections, logging behavior, transport security, and parsing safety could not be verified.

Attack Path

  1. A user follows the documented example and inserts a real SMTP username and password into -ConfigValue.
  2. PowerShell records the command, or local monitoring captures the notification process arguments.
  3. A local user, administrator, support operator, monitoring service, or log reader accesses the captured command.
  4. The attacker extracts the SMTP host, username, and password from the delimited value.
  5. The credentials are used to authenticate to the mail service, subject to the account's permissions and any additional authentication controls.

The reviewed artifact does not establish remote exploitation; access to local history, process information, or generated logs is a prerequisite.

Impact Assessment

Compromise may grant the attacker the same mail-service capabilities as the configured account, potentially including:

  • Sending unauthorized messages or spam.
  • Impersonating the configured sender.
  • Consuming service quotas or c ...[truncated 330 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not accept SMTP passwords through -ConfigValue or any other command-line argument.
  • Collect the password with a masked secure prompt or retrieve it from a protected credential store.
  • Separate non-sensitive SMTP configuration from secret material.
  • Use application-specific passwords or scoped notification tokens rather than a primary mailbox password.
  • Require encrypted SMTP transport with certificate validation.
  • Redact usernames, passwords, and notification endpoints from logs and diagnostic reports.
  • Protect any persisted notification configuration with owner-only permissions and encryption at rest.
  • Rotate credentials previously entered through this command-line pattern.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Most of the user-facing documentation is presented in Chinese, but the file does not indicate that this locale is optional or limited to a specific audience. This can violate language/locale policy when a skill effectively forces a language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown instructs users to configure webhook URLs and email credentials, including a smtp:port:user:pass:from:to value, which affects sensitive data handling and external transmission. The description does not provide any warning about storing credentials securely, exposing secrets in command history, or sending data to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documentation exposes backup and restore operations, including restoring the latest backup, but does not warn that restore actions may overwrite current configuration or revert state. For markdown files, behaviors that can affect user data or system integrity should be accompanied by explicit warnings.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.