ClawHub
Back to skill

Security audit

Apiosk Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for Apiosk API publishing, but it handles wallet private keys and can deactivate listings without enough safety controls.

Review before installing. Use a dedicated low-value wallet or safer signer, avoid passing private keys on the command line, protect ~/.apiosk/wallet.json permissions, and manually confirm the exact slug and wallet before running update or delete actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
auth-utils.sh:117
Finding

Wallet Private Key Exposed Through Process Arguments

Content
View full analysis

Vulnerability Details

File Location: auth-utils.sh, line 117
Vulnerability Type: Sensitive credential exposure through command-line arguments
Risk Level: Medium

Vulnerable Code:

bash
AUTH_SIGNATURE="$(cast wallet sign --private-key "$private_key" "$message" | tr -d '\r\n')"

Technical Analysis

The signing helper passes the raw wallet private key to cast through the --private-key command-line option. Although the key is used locally and is not included in gateway requests, it becomes part of the spawned process's argument vector.

Depending on operating-system controls and deployment configuration, process arguments may be visible to other local users, privileged processes, monitoring agents, audit systems, debugging tools, or process snapshots. The public --private-key option exposed by the management scripts can additionally place the key in the invoking shell's history and the parent script's process arguments.

The functionality requires signing authority, but exposing the raw key through process arguments is not the minimum-risk way to provide that authority.

Attack Path

  1. A victim invokes a management operation such as registration, update, listing, or deletion.
  2. The script obtains the private key from --private-key, APIOSK_PRIVATE_KEY, or ~/.apiosk/wallet.json.
  3. sign_wallet_auth starts cast wallet sign and includes the raw key in the child process's argument vector.
  4. A local attacker or monitoring component with sufficient process-observation access captures the command-line arguments while signing occurs.
  5. The observer extracts the private key and uses it independently to impersonate the wallet or authorize other wallet operations.

Exploitation requires local process-inspection, logging, debugging, or equivalent visibility; the audited code does not transmit the private key to gateway.apiosk.com.

Impact Assessment

Disclosure compromises the w ...[truncated 387 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not provide raw private keys through command-line arguments.
  • Prefer an encrypted keystore, hardware wallet, operating-system credential service, isolated signing agent, or secure IPC-based signer.
  • Use a protected standard-input or file-descriptor mechanism if supported by the signing tool, ensuring the secret never enters the process argument vector.
  • Remove or strongly discourage the management scripts' --private-key option because it can also expose credentials through shell history and the parent process command line.
  • Validate and document restrictive permissions for ~/.apiosk/wallet.json, such as owner-only access.
  • Keep secret variables scoped as narrowly as possible and unset them immediately after signing.
  • Review operational logging and monitoring configurations to ensure they do not capture secret-bearing environment variables or historical command lines.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (20)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SECURITY.md (reported line 14)May include surrounding context.

md
### What This Means

- ✅ No arbitrary code execution
- ✅ No `curl | bash` patterns
- ✅ All external requests go to verified Apiosk infrastructure
- ✅ Private keys are never sent to third parties (used locally for signing only)
- ✅ No write access outside `~/.apiosk/` directory

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The script's actual function is to authenticate with a wallet signature and fetch '/v1/apis/mine' to display the user's registered APIs, request counts, and earnings. It is a read-only 'my APIs' viewer with signed auth. While it prints hints about separate update/delete scripts, this code does not implement publish, update, delete, or listing-group categorization behavior. Therefore the declared description materially overstates and misrepresents the code chunk's primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The supplied code accurately supports parts of the description: publishing a gateway listing, signed wallet authentication, and listing-group-aware categorization. However, this specific code chunk only implements creation/registration of a new API listing. It does not implement update or delete operations, nor broader listing management behavior. There are no obvious undeclared sensitive or unrelated capabilities, but the declared description overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about managing Apiosk gateway listings, including authenticated publish/update/delete behavior and listing-group categorization. The supplied code does none of that. It is a simple API test utility that accepts a slug/path/method, builds a gateway URL, and sends a curl request to probe the endpoint. It explicitly notes that it sends no x402 payment proof and contains no wallet signing, listing CRUD, or categorization features. This is a materially different primary purpose, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The code is narrowly focused on updating an existing API listing. It validates wallet/auth inputs, signs a request, builds a JSON payload with selected fields, and submits it to the Apiosk gateway for update. This aligns with the 'update' portion of the description and the signed wallet authentication aspect. However, the declared purpose claims broader capabilities—publishing listings, delete operations, and listing-group aware categorization—that are not implemented in this supplied code chunk. Because those advertised functions are absent and the description materially overstates the behavior of the provided code, this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

The skill exposes a destructive endpoint parameterized by a user-controlled slug and wallet in the request path/query, but does not describe validation, canonicalization, or confirmation controls around those parameters. In an agent workflow, this can enable misuse such as deleting the wrong resource, operating on attacker-supplied identifiers, or forwarding manipulated parameters into a high-impact action.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
- `POST /v1/apis/register`
- `GET /v1/apis/mine?wallet=0x...`
- `POST /v1/apis/:slug`
- `DELETE /v1/apis/:slug?wallet=0x...`

## Signed wallet auth

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file includes a deactivation command (delete-api.sh --slug ...) but does not warn the user that the action will disable availability of the published API. For markdown files, omissions of warnings about behaviors affecting user data or system/service integrity should be flagged.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 17)May include surrounding context.

md
- ✅ No `curl | bash` patterns
- ✅ All external requests go to verified Apiosk infrastructure
- ✅ Private keys are never sent to third parties (used locally for signing only)
- ✅ No write access outside `~/.apiosk/` directory
- ✅ All dependencies declared (`curl`, `jq`, `cast`)

## Network Access

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill explicitly requires and describes use of network-capable and shell-capable tools (curl, jq, cast) but does not declare any tool scope restrictions such as permissions or allowed-tools. In an agent environment, this widens the execution surface and makes it easier for the skill to invoke powerful capabilities without explicit containment or review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages update, deactivate, and delete lifecycle operations but provides no user-facing confirmation or warning guidance before destructive actions. In an agentic setting, that omission increases the chance of accidental deletion or deactivation of production listings through ambiguous prompts or automation mistakes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented DELETE endpoint is presented alongside other management endpoints without any warning about destructive effects or a requirement for explicit confirmation. That makes unintended destructive actions more likely, especially when an agent translates natural-language requests into API calls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest describes publishing and managing Apiosk gateway listings with signed wallet authentication, which justifies signing operations but does not explicitly justify harvesting private keys from process environment variables and local files. This file implements secret-discovery behavior by pulling a private key from APIOSK_PRIVATE_KEY and ~/.apiosk/wallet.json, expanding capability beyond straightforward request signing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function silently reads a private key from environment variables or local wallet files without any user-facing notice or consent boundary. In an agent skill context, implicit credential pickup is risky because the user may trigger publishing actions without realizing the skill will access sensitive signing material from their environment or home directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This function performs cryptographic signing with a loaded private key and produces an authorization signature without any visible disclosure, confirmation, or display of the exact action scope to the user. In an agent setting, silent signing can authorize unintended operations if higher-level inputs are manipulated, making the context more dangerous than a purely local CLI helper.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · delete-api.sh (reported line 61)May include surrounding context.

sh
WALLET="$(load_wallet_address "$WALLET" || true)"
if [[ -z "$WALLET" ]]; then
  echo "Error: Wallet not found. Provide --wallet or create ~/.apiosk/wallet.json"
  exit 1
fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · my-apis.sh (reported line 49)May include surrounding context.

sh
WALLET="$(load_wallet_address "$WALLET" || true)"
if [[ -z "$WALLET" ]]; then
  echo "Error: Wallet not found. Provide --wallet or create ~/.apiosk/wallet.json"
  exit 1
fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · register-api.sh (reported line 122)May include surrounding context.

sh
WALLET="$(load_wallet_address "$WALLET" || true)"
if [[ -z "$WALLET" ]]; then
  echo "Error: Wallet not found. Provide --wallet or create ~/.apiosk/wallet.json"
  exit 1
fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · update-api.sh (reported line 87)May include surrounding context.

sh
WALLET="$(load_wallet_address "$WALLET" || true)"
if [[ -z "$WALLET" ]]; then
  echo "Error: Wallet not found. Provide --wallet or create ~/.apiosk/wallet.json"
  exit 1
fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · register-api.sh (reported line 171)May include surrounding context.

sh
echo "  Category: $CATEGORY"
echo ""

RAW_RESPONSE="$(curl -s -w "\n%{http_code}" -X POST "$GATEWAY_URL/v1/apis/register" \
  -H "Content-Type: application/json" \
  -H "x-wallet-address: $WALLET" \
  -H "x-wallet-signature: $AUTH_SIGNATURE" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · update-api.sh (reported line 147)May include surrounding context.

sh
echo "Updating API '$SLUG'..."
echo ""

RAW_RESPONSE="$(curl -s -w "\n%{http_code}" -X POST "$GATEWAY_URL/v1/apis/$SLUG" \
  -H "Content-Type: application/json" \
  -H "x-wallet-address: $WALLET" \
  -H "x-wallet-signature: $AUTH_SIGNATURE" \

Static analysis

No suspicious patterns detected.