ClawHub
Back to skill

Security audit

Content Audit Expert

Security checks for vulnerabilities and agentic risk

Overview

This is a content-auditing guidance skill with disclosed OpenAI API use and no hidden execution, persistence, or destructive behavior.

Install in a virtual environment, consider pinning dependency versions, and avoid pasting sensitive unpublished content unless you are comfortable sending it through the configured AI and integration services. Use a safer API-key verification method than placing the bearer token directly in a shell command argument.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:177
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 177
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash
pip install openai python-dotenv textstat

Technical Analysis

The documented installation command retrieves the latest available versions of three third-party packages without version constraints, cryptographic hashes, or a lockfile. Consequently, installation results can change over time and do not correspond to a reproducible, reviewed dependency set.

The package names are not visibly typosquatted, and the document does not direct pip to an untrusted package index. Exploitation therefore depends on an upstream package, maintainer account, distribution channel, or future release being compromised. If that occurs, a user following the documented command could install attacker-controlled package content. Python packages can execute code during installation or when subsequently imported.

Attack Path

  1. An attacker compromises one of the named packages, its maintainer account, or its distribution process.
  2. The attacker publishes a malicious release under the legitimate package name.
  3. A user follows the setup instructions and runs the unpinned pip install command.
  4. Pip resolves the affected dependency to the malicious release.
  5. Malicious installation or runtime code executes under the account that invoked pip.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the installing or running user. Depending on those privileges, the payload could read user-accessible files and environment variables, including OPENAI_API_KEY, alter the Python environment, access application data, or make outbound network requests. The scope is limited by the invoking account and its operating-system permissions; the documented command does not itself obtain elevated privileges.

Remediation
View remediation

Remediation Suggestions

  • Replace the ad hoc command with a reviewed requirements or lock file containing exact versions.
  • Require cryptographic hashes, for example through pip install --require-hashes -r requirements.txt.
  • Document the trusted package index explicitly and disable unintended extra indexes where practical.
  • Install dependencies in a dedicated virtual environment under a non-privileged account.
  • Use automated dependency scanning and promptly review security advisories before updating locked versions.
  • Periodically rebuild the lock file through a controlled review process rather than automatically accepting the latest releases.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:183
Finding

OpenAI API Key Is Expanded into Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 183
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Complete Code Snippet:

bash
curl https://api.openai.com/v1/models -H "Authorization: Bearer $OPENAI_API_KEY"

Technical Analysis

The shell expands $OPENAI_API_KEY before starting curl, placing the resulting bearer token in the process argument vector. Depending on the operating system, process visibility settings, execution environment, audit configuration, terminal tooling, or monitoring software, command arguments may be observable or recorded.

This does not transmit the key to an undeclared endpoint: the command uses HTTPS and targets the official OpenAI API. The issue is local secret exposure through the command-line interface. Exploitation requires access to process metadata, audit records, diagnostic output, or another system that captures command arguments.

Attack Path

  1. A user exports a valid OPENAI_API_KEY and executes the documented verification command.
  2. The shell substitutes the environment variable into the Authorization header argument.
  3. The full bearer token becomes part of the curl process arguments.
  4. A local process observer, auditing service, telemetry collector, or diagnostic tool captures those arguments.
  5. An attacker obtains the captured token and submits API requests using the victim's credentials.

Impact Assessment

A stolen key could permit unauthorized OpenAI API calls within the permissions and limits assigned to that credential. Potential consequences include quota consumption, financial charges, access to API resources available to the key, and loss of confidentiality for information retrievable through those permissions. This issue does not directly provide operating-system privilege escalation. Exposure depends on local process-isolation controls and whether command arguments are logged or visible to the at ...[truncated 7 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not place bearer tokens directly in command-line arguments.
  • Prefer an official SDK or credential provider that reads the key from a protected environment or secret store without reproducing it in process arguments.
  • For curl-based verification, load sensitive header configuration through a protected file or standard input, ensuring the secret is not present in the command argument vector.
  • Restrict any temporary credential file to the current user, remove it immediately after use, and avoid writing it to the project directory.
  • Ensure shell tracing is disabled while handling credentials and configure telemetry and audit systems to redact authorization headers.
  • Use narrowly scoped credentials where supported, rotate any key suspected of exposure, and monitor account usage for unauthorized requests.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
{"openclaw":{"requires":{"env":["OPENAI_API_KEY"],"bins":["curl"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"📋"}}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
2. **Authenticate with OpenAI**:
   - Get your API key from https://platform.openai.com/api-keys
   - Set the `OPENAI_API_KEY` environment variable
   - Verify access: `curl https://api.openai.com/v1/models -H "Authorization: Bearer $OPENAI_API_KEY"`

3. **Integration Setups**:
   - **WordPress**: Use the ClawHub WordPress plugin to send content directly from editor

Static analysis

No suspicious patterns detected.