ClawHub
Back to skill

Security audit

Yufluent Clawhub Publish Yufluentcn Visual Craft

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed cloud client for ecommerce content, but it sends an API key and user-provided listing data to a configurable HTTP endpoint without host or HTTPS validation.

Install only if you are comfortable sending product, listing, and brief content to the Yufluent service under your TOKENAPI_KEY. Set TOKENAPI_BASE_URL deliberately, avoid non-HTTPS remote endpoints, and treat the API key as a billing credential that should not be shared with untrusted local services.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:
Confidence
96% confidence
Finding
The client builds request destinations from a base URL that can come directly from the environment and then sends authenticated requests with a Bearer token and arbitrary payloads to that URL. Because there is no allowlist, scheme enforcement, or host validation, an attacker who can influence TOKENAPI_BASE_URL can redirect secrets and user data to an attacker-controlled endpoint, creating SSRF-style exfiltration and credential leakage risk.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger phrases are broad enough to match common ecommerce writing requests, which can cause the agent to invoke this external cloud-backed skill when the user may only want local assistance. That increases the chance of unneeded data transfer to a third-party service and can lead to overscoped tool use without clear user intent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code defaults to an HTTP endpoint (http://localhost:8080/v1) and also accepts arbitrary base URLs without warning, while attaching a Bearer API key to requests. If used across a network or with a non-local insecure endpoint, credentials and payload contents can be intercepted or modified in transit.

Static analysis

No suspicious patterns detected.