Yufluent Clawhub Publish Yufluentcn Ecommerce Render

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:24 AM UTC
• Version: 1.1.2

Overview

This skill has a coherent cloud-rendering purpose, but it can send local file contents, API credentials, and rendering data to configurable network endpoints without tight scoping.

Install only if you are comfortable sending product/template data to the configured Yufluent endpoint. Keep TOKENAPI_BASE_URL unset unless you fully trust the destination, avoid non-local plaintext HTTP, and pass only intended JSON data files rather than arbitrary paths or sensitive local files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cloud_cli.py:12

Finding

Arbitrary Local Text Files Can Be Included in Remote Rendering Requests

Content

View full analysis

str: """CLI argument: read an existing file path, otherwise treat it as literal text.""" raw = (value or "").strip() if not raw: return "" path = Path(raw) if path.is_file(): return path.read_text(encoding="utf-8") return raw ``` ```python # scripts/run.py:55-68 if args.render_data: payload["render_data"] = read_text_arg(args.render_data) if args.title: payload["title"] = args.title.strip() if args.subtitle: payload["subtitle"] = args.subtitle.strip() if args.headers: payload["headers"] = read_text_arg(args.headers) if args.rows: payload["rows"] = read_text_arg(args.rows) if args.specs: payload["specs"] = read_text_arg(args.specs) if args.features: payload["features"] = read_text_arg(args.features) ``` ```python # scripts/yufluent_api.py:232-235 root = base_url or os.getenv("TOKENAPI_BASE_URL", "") url = skill_run_url(root, skill_id) try: resp = _post_json(url, api_key=key, body=payload, timeout=timeout) ``` ### Technical Analysis The CLI accepts either literal structured data or an existing filesystem path for several arguments. If a supplied value resolves to any readable file, the implementation reads the entire file as UTF-8 text. It does not enforce: - A permitted workspace or data directory - Expected file extensions - JSON parsing or schema validation - A maximum file size - Confirmation before reading files outside the project - Rejection of credential, configuration, or other sensitive paths The resulting file contents are placed in the payload and submitted to the configured rendering service. The declared functionality only requires str ...[truncated 1441 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/yufluent_api.py:22

Finding

Bearer Credentials and Rendering Data Can Be Sent over Plaintext HTTP

Content

View full analysis

str: base = (base_url or "").strip().rstrip("/") if not base: base = "http://localhost:8080/v1" if base.endswith("/v1"): return base return f"{base}/v1" ``` ```python # scripts/yufluent_api.py:53-56 def _auth_headers(api_key: str) -> dict[str, str]: return { "Authorization": f"Bearer {api_key}", "Accept": "application/json", } ``` ```python # scripts/yufluent_api.py:139-150 def _post_json( url: str, *, api_key: str, body: dict[str, Any] | None = None, timeout: float, ) -> requests.Response: kwargs: dict[str, Any] = { "headers": _json_headers(api_key) if body is not None else _auth_headers(api_key), "timeout": timeout, } if body is not None: kwargs["json"] = body return requests.post(url, **kwargs) ``` ```python # scripts/yufluent_api.py:223-235 key = (api_key or os.getenv("TOKENAPI_KEY", "")).strip() if not key: msg = ( "TOKENAPI_KEY is not configured." ) raise YufluentApiError(msg) root = base_url or os.getenv("TOKENAPI_BASE_URL", "") url = skill_run_url(root, skill_id) try: resp = _post_json(url, api_key=key, body=payload, timeout=timeout) ``` ### Technical Analysis The API root accepts a caller-supplied or environment-supplied URL without validating its scheme or host. The client then sends `TOKENAPI_KEY` as a bearer credential and transmits the complete rendering payload to that destination. The default endpoint uses HTTP on loopback, which is generally less exposed than remote plaintext transport. However, the sam ...[truncated 1940 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency Version Is Not Reproducibly Pinned

Content

View full analysis

=2.31.0 ``` The same open-ended requirement is also declared in the installation metadata in `SKILL.md:16`: ```yaml packages":["requests>=2.31.0"] ``` ### Technical Analysis The project permits installation of any current or future `requests` version greater than or equal to 2.31.0. No lockfile or cryptographic hashes are provided. Consequently, separate installations can resolve to different dependency versions without changes to the audited project. The package name is legitimate and no typosquatting or dependency-confusion package was identified. The risk arises from non-reproducible resolution: a compromised, malicious, or unexpectedly incompatible future release could be selected automatically during installation. ### Attack Path 1. A future version satisfying `requests>=2.31.0` becomes compromised, malicious, or otherwise unsafe, or an upstream distribution channel is compromised. 2. A user installs the Skill dependencies without a lockfile, version pin, or hash verification. 3. The package resolver selects the affected future release. 4. Installation or subsequent import and execution runs the affected dependency under the privileges of the user operating the Skill. This path depends on an upstream package or distribution compromise; the audited repository does not itself retrieve or execute an identified malicious package. ### Impact Assessment Potential impact depends on the behavior of the compromised dependency and could extend to the privileges of the account performing installation or running the Skill. Because no malicious dependency is presently identified and exploitation requires a separate upstream compromise, the current risk is Low. The immediate confirmed effects are reduced build reproducibility and increased supply-chain exposure. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/yufluent_api.py (reported line 150)May include surrounding context.

python

}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

powershell

cd skills\yufluentcn-ecommerce-render
pip install -r requirements.txt   # requests only
copy .env.example .env
# 编辑 TOKENAPI_KEY = "tk-***"

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill can invoke arbitrary remote skills by skill_id, call a generic agent orchestration endpoint, and record outcomes unrelated to rendering, then it is materially more powerful than claimed. This creates a confused-deputy risk where a seemingly narrow rendering skill becomes a general remote action proxy, potentially causing unauthorized operations, data egress, or billing abuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill can invoke arbitrary remote skills by skill_id, call a generic agent orchestration endpoint, and record outcomes unrelated to rendering, then it is materially more powerful than claimed. This creates a confused-deputy risk where a seemingly narrow rendering skill becomes a general remote action proxy, potentially causing unauthorized operations, data egress, or billing abuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the skill can invoke arbitrary remote skills by skill_id, call a generic agent orchestration endpoint, and record outcomes unrelated to rendering, then it is materially more powerful than claimed. This creates a confused-deputy risk where a seemingly narrow rendering skill becomes a general remote action proxy, potentially causing unauthorized operations, data egress, or billing abuse.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

## 快速开始（3 步，60 秒）

1. **注册获取 API 密钥** → https://claw.changzhiai.com/login （新用户即送体验积分，无需绑卡）
2. **设置环境变量**：export TOKENAPI_KEY=*** 或写入 .env 文件
3. **运行**：参照下方 Examples 示例执行 python scripts/run.py ...

> 还没注册？前往 https://claw.changzhiai.com/login 免费获取密钥。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill documentation is written in Chinese and explicitly states Chinese rendering requirements, but it does not indicate that the skill is China/Chinese-specific or offer any language/locale choice. Under the policy, a skill that effectively forces a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises environment-variable and network-backed execution but does not declare an explicit tool scope such as allowed-tools or permissions. In an agent ecosystem, this weakens least-privilege controls and can let the skill access capabilities broader than users or reviewers expect, especially when the same file also instructs use of secrets and remote API calls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Broad trigger phrases without scope limits make accidental or overbroad invocation more likely, which is dangerous for a networked, billable skill that accepts user-supplied data and uses an API key. This can cause unintended remote calls, surprise charges, or the skill activating in contexts where template rendering was not actually requested.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language strings at L01 and L13 are written only in Chinese and describe the CLI behavior without offering any language choice. Under the policy, forcing a specific language or locale without user opt-in is a reportable natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The CLI sets --lang to zh by default, which imposes a specific language choice when the user does not provide one. Under the policy, forcing a language or locale without opt-in is a natural-language policy violation unless the constraint is clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When the direct skill endpoint fails, the client falls back to a general /agent/turn orchestration endpoint and constructs a natural-language execution request. This broadens the trust boundary from a declared single-purpose rendering API to a more capable agent interface, which may process inputs differently, invoke additional behaviors, or expose data to a wider backend path than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code file performs outbound network requests using requests.post and includes a Bearer API key header, while also sending request bodies that may contain user-provided or system data. Although the module docstring says it is a cloud thin client, there is no user-facing warning, confirmation, logging, or comment disclosing that payloads and credentials are transmitted to a remote service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module sends additional telemetry to /v1/agent/outcomes beyond the core rendering call described in the skill metadata. That can transmit user/job metadata off-box without clear necessity or disclosure, increasing privacy and data-governance risk, especially in enterprise or regulated use.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as requests>=2.31.0 without an upper bound or exact pin, which makes builds non-reproducible and allows installation of different versions over time. In a server-side rendering skill that may fetch remote assets or call external services, this increases supply-chain and stability risk because a newly released version could introduce a breaking change or vulnerable transitive behavior.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Because the manifest does not pin the requests version, it is impossible to determine whether deployment will resolve to a release affected by known advisories. In this ecommerce rendering context, server-side code may process attacker-influenced URLs or outbound HTTP requests, which makes unresolved requests-version exposure more relevant than in a purely offline package.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring says this is a "ClawHub 云端薄客户端" and the CLI description says "TokenApi 模板渲染（Pillow）", but the implementation imports yufluent_api and invokes run_skill with SKILL_API_ID = "commerce-render". This is an active documentation mismatch about the backend/service identity, which can mislead users about what system is performing the rendering and billing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The code reads a credential from the TOKENAPI_KEY environment variable and uses it for remote API authentication, but the file does not include any explicit warning about handling sensitive credentials. The existing error text explains how to set the variable, yet it does not warn users that the skill consumes a secret for network authentication.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.