ClawHub
Back to skill

Security audit

Secret Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local secret-scanning skill, but its JSON reports can include unredacted secret-containing source lines despite claiming masked output.

Install only if you are comfortable treating all scanner output, especially JSON and saved reports, as sensitive. Run it only on directories you intentionally choose, avoid sharing JSON reports, and avoid writing reports over existing files until the line preview redaction and overwrite behavior are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
secret_scanner.py:524
Finding

Unmasked Secrets Exposed in JSON Reports

Content
View full analysis

Vulnerability Details

File Location: secret_scanner.py, lines 524–531 and 625
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: High

Vulnerable Code

python
line_preview = line.strip()[:120]

finding = SecretFinding(
    pattern_name=pattern_def["name"],
    severity=pattern_def["severity"],
    file_path=rel_path,
    line_number=i,
    line_preview=line_preview,
    secret_preview=masked,
    description=pattern_def["description"],
    remediation=pattern_def["remediation"]
)
python
'findings': [asdict(f) for f in report.findings],

Technical Analysis

The scanner masks the regex match before assigning it to secret_preview, but separately stores the first 120 characters of the original source line in line_preview. No redaction is applied to that field.

The JSON formatter serializes the entire SecretFinding dataclass through asdict(f), including the unredacted line_preview. Consequently, a detected credential located within the first 120 characters of its source line is reproduced in plaintext in JSON output.

This violates the documented claim that secret masking makes reports safe to share. The Markdown formatter currently does not display line_preview, but the sensitive value remains stored in the report object and is disclosed by JSON serialization.

Attack Path

  1. A scanned file contains a hardcoded credential within the first 120 characters of a line.

  2. A user or CI pipeline executes:

    bash
    python secret_scanner.py /path/to/project --json

  3. A configured regular expression detects the credential.

  4. The scanner masks the matched text for secret_preview.

  5. The scanner also copies the original source line into line_preview without redaction.

  6. format_json() serializes every finding field using asdict(f).

  7. The complete credential is exposed in terminal output, CI logs, report artifacts, tickets, or other systems receiving the JSON report.

No special p ...[truncated 980 chars]

Remediation
View remediation

Remediation Suggestions

  1. Redact every matched span before retaining a line preview. Construct the preview from the source line with all secret-pattern matches replaced by a fixed marker such as [REDACTED].
  2. Prefer not to store raw source lines in SecretFinding. Retain only the file path, line number, pattern name, and a safely masked match.
  3. Explicitly select safe JSON fields instead of serializing the complete dataclass with asdict().
  4. Ensure masking handles multiple credentials on the same line and overlapping pattern matches.
  5. Avoid partial masking that leaves enough material to reconstruct or misuse credentials.
  6. Add regression tests asserting that the original matched value never appears in:
    • JSON output
    • Markdown output
    • Standard output
    • Reports written through --output
  7. Review downstream logs and previously generated reports for exposed credentials. Rotate any credential that may already have been disclosed.
  8. Update documentation only after all output paths have been verified to redact sensitive values consistently.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
- AWS Access Keys, Secret Keys, Session Tokens
  - Azure Storage Keys, Connection Strings, SAS Tokens
  - GCP Service Account Keys, API Keys
  - GitHub / GitLab / Bitbucket Personal Access Tokens
  - OpenAI, Anthropic, Hugging Face API Keys
  - Slack Bot Tokens, Webhooks
  - Stripe, Twilio, SendGrid Keys

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 194)May include surrounding context.

python
- AWS Access Keys, Secret Keys, Session Tokens
  - Azure Storage Keys, Connection Strings, SAS Tokens
  - GCP Service Account Keys, API Keys
  - GitHub / GitLab / Bitbucket Personal Access Tokens
  - OpenAI, Anthropic, Hugging Face API Keys
  - Slack Bot Tokens, Webhooks
  - Stripe, Twilio, SendGrid Keys

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 366)May include surrounding context.

python
- AWS Access Keys, Secret Keys, Session Tokens
  - Azure Storage Keys, Connection Strings, SAS Tokens
  - GCP Service Account Keys, API Keys
  - GitHub / GitLab / Bitbucket Personal Access Tokens
  - OpenAI, Anthropic, Hugging Face API Keys
  - Slack Bot Tokens, Webhooks
  - Stripe, Twilio, SendGrid Keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 38)May include surrounding context.

python
'.py', '.js', '.ts', '.jsx', '.tsx', '.java', '.go', '.rb', '.php',
    '.cs', '.rs', '.c', '.cpp', '.h', '.swift', '.kt',
    '.json', '.yaml', '.yml', '.toml', '.ini', '.cfg', '.conf', '.xml',
    '.env', '.sh', '.bash', '.zsh', '.ps1', '.bat', '.cmd',
    '.md', '.txt', '.rst', '.properties',
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 44)May include surrounding context.

python
'.py', '.js', '.ts', '.jsx', '.tsx', '.java', '.go', '.rb', '.php',
    '.cs', '.rs', '.c', '.cpp', '.h', '.swift', '.kt',
    '.json', '.yaml', '.yml', '.toml', '.ini', '.cfg', '.conf', '.xml',
    '.env', '.sh', '.bash', '.zsh', '.ps1', '.bat', '.cmd',
    '.md', '.txt', '.rst', '.properties',
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 44)May include surrounding context.

python
SCAN_FILENAMES = {
    'Dockerfile', 'docker-compose.yml', 'docker-compose.yaml',
    'Makefile', '.env', '.env.local', '.env.development', '.env.production',
    '.env.staging', '.env.test', '.npmrc', '.pypirc', 'credentials',
    'config', '.htpasswd', 'wp-config.php',
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 44)May include surrounding context.

python
SCAN_FILENAMES = {
    'Dockerfile', 'docker-compose.yml', 'docker-compose.yaml',
    'Makefile', '.env', '.env.local', '.env.development', '.env.production',
    '.env.staging', '.env.test', '.npmrc', '.pypirc', 'credentials',
    'config', '.htpasswd', 'wp-config.php',
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 44)May include surrounding context.

python
SCAN_FILENAMES = {
    'Dockerfile', 'docker-compose.yml', 'docker-compose.yaml',
    'Makefile', '.env', '.env.local', '.env.development', '.env.production',
    '.env.staging', '.env.test', '.npmrc', '.pypirc', 'credentials',
    'config', '.htpasswd', 'wp-config.php',
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 45)May include surrounding context.

python
SCAN_FILENAMES = {
    'Dockerfile', 'docker-compose.yml', 'docker-compose.yaml',
    'Makefile', '.env', '.env.local', '.env.development', '.env.production',
    '.env.staging', '.env.test', '.npmrc', '.pypirc', 'credentials',
    'config', '.htpasswd', 'wp-config.php',
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 168)May include surrounding context.

python
},
    # --- GitHub ---
    {
        "name": "GitHub Personal Access Token",
        "pattern": r"(?<![A-Za-z0-9])(ghp_[A-Za-z0-9]{36,})(?![A-Za-z0-9])",
        "severity": "critical",
        "description": "GitHub Personal Access Token detected",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 171)May include surrounding context.

python
},
    # --- GitHub ---
    {
        "name": "GitHub Personal Access Token",
        "pattern": r"(?<![A-Za-z0-9])(ghp_[A-Za-z0-9]{36,})(?![A-Za-z0-9])",
        "severity": "critical",
        "description": "GitHub Personal Access Token detected",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 178)May include surrounding context.

python
},
    # --- GitHub ---
    {
        "name": "GitHub Personal Access Token",
        "pattern": r"(?<![A-Za-z0-9])(ghp_[A-Za-z0-9]{36,})(?![A-Za-z0-9])",
        "severity": "critical",
        "description": "GitHub Personal Access Token detected",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 190)May include surrounding context.

python
},
    # --- GitHub ---
    {
        "name": "GitHub Personal Access Token",
        "pattern": r"(?<![A-Za-z0-9])(ghp_[A-Za-z0-9]{36,})(?![A-Za-z0-9])",
        "severity": "critical",
        "description": "GitHub Personal Access Token detected",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 193)May include surrounding context.

python
},
    # --- GitHub ---
    {
        "name": "GitHub Personal Access Token",
        "pattern": r"(?<![A-Za-z0-9])(ghp_[A-Za-z0-9]{36,})(?![A-Za-z0-9])",
        "severity": "critical",
        "description": "GitHub Personal Access Token detected",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill describes scanning directories and repositories and producing reports, which implies file read access and potentially file write access when saving output, but it does not explicitly declare any tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may grant broader filesystem capabilities than necessary, increasing the risk of unintended access to sensitive files or uncontrolled report writes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata says it scans files and repositories, but the implementation also writes a report to any user-supplied path via --output. This is not arbitrary code execution, but it is a capability mismatch that can overwrite local files if a caller assumes the tool is read-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code writes directly to the path provided in --output without checking whether the file already exists or warning about modification of local files. In an agent context, this can lead to unintended overwrites of user data or writes to sensitive locations if the path is influenced externally.

Content

No source excerpt is available for this finding.