Yufluent Clawhub Publish Yufluentcn Record Outcome

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:23 AM UTC
• Version: 1.1.2

Overview

The skill’s stated outcome-recording purpose is plausible, but it handles an API key and seller metrics with broader cloud execution code and under-scoped endpoint/import controls.

Install only if you trust the Yufluent endpoint configuration and the local skills/_shared directory. Avoid setting TOKENAPI_BASE_URL to any untrusted or remote HTTP server, and confirm the payload before sending seller metrics.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/run.py:9

Finding

External Python Module Path Can Override the Bundled Bootstrap Module

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/yufluent_api.py:21

Finding

Bearer Credential and Seller Analytics Can Be Sent to an Insecure or Untrusted Endpoint

Content

View full analysis

str: base = (base_url or "").strip().rstrip("/") if not base: base = "http://localhost:8080/v1" if base.endswith("/v1"): return base return f"{base}/v1" ``` The API credential is placed in the authorization header: ```python def _auth_headers(api_key: str) -> dict[str, str]: return { "Authorization": f"Bearer {api_key}", "Accept": "application/json", } ``` The request helper sends the credential and JSON body to the supplied URL: ```python def _post_json( url: str, *, api_key: str, body: dict[str, Any] | None = None, timeout: float, ) -> requests.Response: kwargs: dict[str, Any] = { "headers": _json_headers(api_key) if body is not None else _auth_headers(api_key), "timeout": timeout, } if body is not None: kwargs["json"] = body return requests.post(url, **kwargs) ``` The outcome destination is selected directly from an argument or environment variable without scheme or host validation: ```python url = agent_outcomes_url(base_url or os.getenv("TOKENAPI_BASE_URL", "")) try: resp = _post_json(url, api_key=key, body=payload, timeout=timeout) ``` The transmitted payload contains seller-provided identifiers and commercial analytics: ```python payload = { "run_id": args.run_id.strip(), "event": args.event.strip() or "published", "external_id": args.external_id.strip(), "impressions": max(0, args.impressions), "clicks": max(0, args.clicks), "orders": max(0, args.orders), "revenue_cny": max(0.0, args. ...[truncated 2291 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Open-Ended Dependency Version Prevents Reproducible and Integrity-Verified Installation

Content

View full analysis

=2.31.0 ``` The same open-ended constraint is also declared in the installation metadata at `SKILL.md:17` and `scripts/yufluent_api.py:287-290`. ### Technical Analysis The dependency specification accepts every future `requests` release greater than or equal to version 2.31.0. As a result, installations performed at different times may resolve to different package versions without a corresponding review or change to this project. No malicious dependency or currently compromised `requests` release was identified in the audited files. The risk arises from the absence of deterministic version selection and package-integrity verification. A future compromised, incompatible, or unexpectedly changed eligible release could enter the environment automatically. Because this client handles an API bearer token and sensitive analytics, dependency integrity is particularly relevant to the confidentiality of request headers and payloads. ### Attack Path 1. A future eligible release is compromised, maliciously replaced at its distribution source, or introduces a security regression. 2. A user runs `pip install -r requirements.txt`. 3. The resolver selects that release because it satisfies `requests>=2.31.0`. 4. The dependency is installed without a reviewed lock file or required hash. 5. The affected dependency executes in the Skill process and can access network request data available to the library. This is a supply-chain exposure rather than evidence of a presently malicious package. ### Impact Assessment The potential scope is the privilege of the Python installation or Skill process. A compromised networking dependency could observe the bearer credential and outcome payload, alter destinations or responses, or execute code available through package installation/runtime behav ...[truncated 212 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The module allows the HTTP destination to be derived from TOKENAPI_BASE_URL/environment input and sends the bearer API key in the Authorization header to that URL. If an attacker can influence the environment or caller-supplied base_url, they can redirect requests to an attacker-controlled host and exfiltrate credentials and outcome data; the default use of plain HTTP for localhost also weakens transport assumptions.

Content

Scanner excerpt · scripts/yufluent_api.py (reported line 150)May include surrounding context.

python

}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation explicitly says the skill does not use /v1/skills/*/run and only posts to /v1/agent/outcomes, but the detected behavior suggests it can invoke arbitrary skills and agent-turn orchestration through more general Yufluent client paths. That creates a significant trust violation: a user approving a simple outcome-registration helper could unknowingly grant a general-purpose remote execution/orchestration surface.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documentation explicitly says the skill does not use /v1/skills/*/run and only posts to /v1/agent/outcomes, but the detected behavior suggests it can invoke arbitrary skills and agent-turn orchestration through more general Yufluent client paths. That creates a significant trust violation: a user approving a simple outcome-registration helper could unknowingly grant a general-purpose remote execution/orchestration surface.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documentation explicitly says the skill does not use /v1/skills/*/run and only posts to /v1/agent/outcomes, but the detected behavior suggests it can invoke arbitrary skills and agent-turn orchestration through more general Yufluent client paths. That creates a significant trust violation: a user approving a simple outcome-registration helper could unknowingly grant a general-purpose remote execution/orchestration surface.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

## 快速开始（3 步，60 秒）

1. **注册获取 API 密钥** → https://claw.changzhiai.com/login （新用户即送体验积分，无需绑卡）
2. **设置环境变量**：export TOKENAPI_KEY=*** 或写入 .env 文件
3. **运行**：参照下方 Examples 示例执行 python scripts/run.py ...

> 还没注册？前往 https://claw.changzhiai.com/login 免费获取密钥。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The advertised skill scope is outcome recording only, but this module also exposes generic skill execution through /skills/{skill_id}/run and /agent/turn. That scope expansion materially increases privilege and abuse potential, because any consumer expecting a narrow telemetry helper can instead use it to trigger arbitrary remote skill execution with the same tk-* credential.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The '何时使用' section says to use the skill when a user says phrases like 'Listing 上架了' or '这周卖了 N 单', which are common conversational statements and not clearly bounded trigger conditions. The file does not provide exclusions, negative examples, or tighter constraints beyond the presence of a prior run_id in the conversation, so the activation scope remains ambiguous.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares runtime-affecting capabilities such as environment variable access, file interaction, and outbound network use, but does not explicitly scope or constrain allowed tools/permissions in the manifest. That weakens sandboxing and reviewability, making it easier for a supposedly narrow outcome-recording skill to access broader resources than users or operators expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad and conversational, which can cause the skill to activate in contexts where the user did not intend to submit outcome data. In a skill that can access credentials and make network requests, accidental invocation can lead to unintended data transmission or confusing side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring and argparse help text are written entirely in Chinese, which imposes a specific language on users of the skill. Under the policy, language constraints should either be optional/opt-in or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language text that presents the skill as Chinese-only ('Yufluent 技能云端薄客户端') and all user-facing messages in the file are likewise Chinese, with no indication that users can opt into another language. Under the policy, forcing a specific language without user choice or a documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The inline comments/docstrings describe a narrow transport fallback for skill execution, but in context the skill manifest says this package should only post outcomes and not use /v1/skills/*/run. These comments frame the behavior as an implementation detail while the code actually introduces an alternate orchestration path that can execute skills, contradicting the package’s stated intent and documentation scope.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency specification uses a lower-bound only constraint (requests>=2.31.0) rather than pinning to a specific vetted version. This makes builds non-reproducible and can unexpectedly pull in vulnerable or behavior-changing releases, which is a real supply-chain risk even if no exploit is guaranteed from this file alone.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Because requests is unpinned, it is impossible to verify from this manifest whether deployment will use a release affected by known advisories. In a skill that submits outcome data over HTTP APIs and may handle authentication tokens (tk-*), using an affected requests version could increase the chance of credential leakage or other client-side request handling issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The natural-language strings in the module docstring and function docstrings are written only in Chinese, which indicates a language-specific skill context without offering any user language choice or documenting a justified locale restriction. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.