ClawHub
Back to skill

Security audit

Http Api Test Runner

Security checks for vulnerabilities and agentic risk

Overview

This API testing skill is mostly purpose-aligned, but its bundled runner can leak environment secrets and overwrite arbitrary writable files when run on unsafe test definitions.

Install only if you will use it with trusted, local API test definitions and non-production or short-lived credentials. Avoid running imported .http files, avoid full browser cookies when possible, run with a minimized environment, and constrain or remove expect.save until paths are restricted to a dedicated output directory.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
templates/basic.api-verify.sh:55
Finding

Arbitrary Ambient Environment Variable Disclosure Through HTTP Variable Substitution

Content
View full analysis
"$detail_file")" ``` ### Technical Analysis For variable names outside a small predefined set, `env_override_for` derives an uppercase environment-variable name and uses Bash indirect expansion, `${!env_name-}`, to retrieve its value. There is no allowlist restricting which ambient variables may be accessed. A test definition can therefore declare ...[truncated 2150 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
templates/basic.api-verify.sh:426
Finding

Authentication Header Disclosure Through Cross-Origin Redirects

Content
View full analysis
"$request_body_file" curl_args+=(--data-binary "@$request_body_file") fi local curl_output curl_status http_status content_type time_total curl_output="$(curl "${curl_args[@]}" 2>"$detail_file")" ``` Typical test artifacts supply authentication as custom headers: ```http Authorization: Bearer {{token}} ``` or: ```http Cookie: {{cookie}} ``` ### Technical Analysis The runner unconditionally enables `curl --location`, causing HTTP redirects to be followed automatically. At the same time, all `.http` headers are passed as custom `-H` arguments. Custom `Authorization` and `Cookie` headers require special handling because they contain reusable credentials. When a request is redirected to another origin, replaying these custom headers can disclose credentials to a host that was not selected by the user. The runner does not: - Disable redirects for authenticated requests - Validate the redirect destination - Enforce same-origin redirects - Strip sensitive custom headers before following redirects - Ask the user to approve a cross-origin destination Following redirects may be useful for general HTTP testing, but forwarding authentication material beyond the original scheme, host, and port exceeds the minimum privilege necessary for ordinary authenticated endpoint validation. ...[truncated 1619 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
templates/basic.api-verify.sh:340
Finding

Arbitrary File Overwrite Through Unrestricted expect.save Path

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
- `templates/basic.api-verify.sh`

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill explicitly instructs the agent to generate files and run shell commands, which implies file read/write and shell execution capabilities, but it does not declare any tool scope restrictions such as permissions or allowed-tools. That mismatch is dangerous because an orchestrator may grant broader default capabilities than intended, allowing the skill to read or modify unrelated files or execute commands beyond API-test generation if invoked with adversarial input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enables implicit invocation while its activation description is broad enough to match many common user requests around HTTP, API checks, request replay, validation, and reporting. This can cause the agent to invoke the skill in situations the user did not clearly intend, increasing the chance of processing sensitive endpoints, credentials, or test artifacts without sufficient user confirmation or contextual boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/async-job-polling/async-job-polling.prepare-and-verify.sh (reported line 67)May include surrounding context.

sh
local body="${3:-}"

  if [[ -n "$body" ]]; then
    curl -sS --max-time "$MAX_TIME" \
      -X "$method" "$url" \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer ${AUTH_TOKEN}" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly instructs users to paste a full Cookie header into an environment variable and run it in a shell command, but provides no warning about the sensitivity of session cookies or safer alternatives. This increases the chance of credential leakage through shell history, process listings, shared terminals, logs, screenshots, or accidental reuse of production session tokens.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/http_test_artifact_example.md (reported line 31)May include surrounding context.

text
[PASS] Detail positive: should expose enabled status
  URL: https://api.example.test/v1/resources/sample-123
  method: GET
  expectation: json_path data.status == enabled
  HTTP=200 cost=203ms

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script honors an untrusted metadata field, expect.save, and copies the full HTTP response body to whatever filesystem path the test definition specifies. In this skill, .http test artifacts are user-provided inputs, so a crafted test can write attacker-controlled content into arbitrary writable locations, potentially overwriting files, dropping data into sensitive directories, or planting content later consumed by other tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This is effectively the same underlying issue: the script performs file output based solely on metadata embedded in the test case, with no warning, consent, or path restrictions. Because this skill is designed to process externally supplied API test definitions, that behavior increases risk: simply running a test can persist attacker-influenced server responses to arbitrary paths on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown instructs the skill to ask follow-up questions using Chinese text only. This creates a language/locale policy issue because it does not offer the user any language choice or indicate that Chinese is optional or region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This is a plain-text template file, so vague-trigger review applies. The instructions 'Export secrets when the endpoint requires authentication' and 'Run the verification script' are generic and do not specify exact trigger conditions, scope, or exclusions, which could lead to overly broad invocation in contexts beyond this template's intended API test workflow.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
examples/auth-login-required/README.md:20