ClawHub
Back to skill

Security audit

Bing Webmaster CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Bing Webmaster CLI usage guide with expected API-key handling and installation guidance, but users should treat the API key and installed package source carefully.

Before installing, verify that bing-webmaster-cli is the package you intend to trust, consider pinning a known version, and use a least-privileged Bing Webmaster API key. Prefer interactive login or a secret manager over pasting keys into commands that may be logged, and clear stored credentials when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md
## Config Paths And Overrides

Defaults:
- credentials: `~/.config/bing-webmaster-cli/credentials.json`
- app config: `~/.config/bing-webmaster-cli/config.json`

Env overrides:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to provide and persist a Bing Webmaster API key via an environment variable or a locally stored credential file, but it does not warn that the key is sensitive, should not be pasted into shared shells/logs, and may persist on disk or in shell history. In a CLI/authentication skill this is common functionality, but the absence of handling guidance increases the chance of accidental credential exposure during normal use, especially in CI, shared workstations, or recorded terminal sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.