ClawHub
Back to skill

Security audit

ducc-helper

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it handles reusable company login cookies unsafely and can affect production configuration, so it should be reviewed carefully before use.

Install only if you are authorized to manage JD DUCC configuration from this machine. Treat it as high-impact: avoid running the auth module directly, protect or clear ~/.ducc-helper-cache.json when done, confirm that HTTP transport is acceptable on your corporate network, and require explicit human review before draft deletion or any --confirm release, especially in online production.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
lib/ducc_client.py:31
Finding

Reusable SSO Credential Transmitted over Plaintext HTTP

Content
View full analysis
{e}") return -1, None return self._parse(resp) def post(self, path, body, env=None): url = f"{BASE}{path}" try: resp = requests.post( url, headers=self._headers(env=env, json_body=True), data=json.dumps(body), timeout=60, ) except requests.exceptions.RequestException as e: log(f"请求失败：{url} -> {e}") return -1, None return self._parse(resp) def put(self, path, body=None, env=None): url = f"{BASE}{path}" try: resp = requests.put( url, headers=self._headers(env=env, json_body=body is not None), data=json.dumps(body) if body is not None else None, timeout=60, ) except requests.exceptions.RequestException as e: log(f"请求失败：{url} -> {e}") return -1, None return self._parse(resp) def delete(self, path, body=None, env=None): url = f"{BASE}{path}" try: resp = requests.dele ...[truncated 2752 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
lib/jme_auth.py:283
Finding

Authentication Module Prints the Complete SSO Cookie to Standard Output

Content
View full analysis
` credential is written to stdout. 4. A terminal recorder, CI system, agent transcript, redirected output file, or log collector stores the output. 5. An attacker or unauthorized operator with access to that output retrieves the token. 6. The attacker supplies the cookie in requests to a service that accepts the JD SSO session. 7. The attacker acts with the authenticated privileges of the affected user un ...[truncated 632 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Dependency Version without Integrity Pinning

Content
View full analysis
=2.25.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency declaration accepts every future version of `requests` at or above version 2.25.0 and supplies no package hashes. Consequently, installations performed at different times can resolve to different, previously unaudited artifacts. There is no evidence of typosquatting, dependency confusion, a malicious package name, or an unsafe custom package index in the project. The concern is therefore limited to supply-chain reproducibility and integrity: compromise of the upstream package or package index, malicious index substitution, or an incompatible future release could affect code that handles SSO credentials and sensitive configuration traffic. ### Attack Path 1. A user follows the project documentation and runs `pip install -r requirements.txt`. 2. `pip` queries its configured package index and selects any available `requests` version satisfying `>=2.25.0`. 3. An upstream compromise, malicious index substitution, or future compromised release causes an unsafe artifact to be selected. 4. Because no expected version or hash is enforced, the installer accepts that artifact. 5. The dependency executes in the same Python environment as the Skill and participates directly in authentication and DUCC HTTP requests. 6. Malicious dependency behavior could read cached credentials, intercept request headers and bodies, or alter configuration operations. ### Impact Assessment A compromised networking dependency would execute with the operating-system privileges of the user running the Skill. It could potentially access: - The cached JingME and SSO tokens in the user's home directory. - DUCC configuration values processed by the scripts. ...[truncated 288 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description advertises broad DUCC read/write/publish functionality, but the analyzed behavior reportedly centers on authentication/token acquisition rather than the claimed management operations. This mismatch is dangerous because operators may trust the declared safety model and approve execution without realizing the skill primarily obtains sensitive authentication material or behaves differently than documented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description advertises broad DUCC read/write/publish functionality, but the analyzed behavior reportedly centers on authentication/token acquisition rather than the claimed management operations. This mismatch is dangerous because operators may trust the declared safety model and approve execution without realizing the skill primarily obtains sensitive authentication material or behaves differently than documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The __main__ self-test prints the full reusable sso.jd.com=<token> cookie to stdout. This can leak valid internal authentication credentials into terminal scrollback, shell history capture tools, CI logs, process supervisors, chat paste incidents, or other logging pipelines, enabling session hijacking by anyone who obtains the output.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares powerful capabilities such as shell, network, file read/write, and environment access but provides no explicit tool-scope restrictions. In a configuration-management skill that can authenticate locally and potentially modify or publish production configuration, missing permission boundaries materially increase blast radius if the skill is invoked unexpectedly or its implementation is changed later.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is extremely broad and instructs the agent to use this skill whenever many common DUCC-related terms appear, even if the user did not explicitly request the skill. In the context of a skill that may authenticate automatically and can potentially change or publish configuration, overbroad invocation increases the risk of unintended access, draft modification, or release planning in response to ambiguous prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module persists reusable me_token and sso_token values to a local cache file in the user's home directory. Even with mode 600, storing live authentication artifacts on disk increases exposure to local compromise, malware, backups, shell access by the same account, or accidental disclosure, especially because these tokens can grant internal system access.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · lib/jme_auth.py (reported line 120)May include surrounding context.

python
# ── ① encrypt → ② HiOffice → ③ getWebToken 换 me_token ───────────────────
def _post_hioffice(port, aes_key, content):
    """向单个本机 HiOffice 端口发请求，返回 (body, resp_x_aes_key, port)。"""
    r = requests.post(
        f"http://127.0.0.1:{port}/hioffice?from={requests.utils.quote(HIOFFICE_FROM)}",
        headers={"X-AES-Key": aes_key, "Content-Type": "application/json"},
        data=content.encode("utf-8") if isinstance(content, str) else content,

Tainted flow: 'code' from requests.post (line 212, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · lib/jme_auth.py (reported line 218)May include surrounding context.

python
# Step ⑤：autherp，从 Set-Cookie 提取 sso.jd.com
    return_url = "https://joyspace.jd.com?lang=zh_CN"
    sso_res = requests.get(
        "https://autherp.jd.com/sso/tp",
        params={"name": "joydesk", "token": code, "returnUrl": return_url},
        allow_redirects=False,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation explicitly instructs operators to obtain and reuse an SSO cookie via browser/network interception tooling and states that a single cross-subdomain cookie is sufficient for authenticated access to the backend. That enables credential harvesting and session replay outside the intended UI flow, expanding the skill from DUCC operations into raw credential extraction and reuse against internal services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation combines production-targeted HTTP requests with explicit use of authentication cookies but does not include strong guidance on credential secrecy, storage, transmission risk, or prohibition on logging/reuse. Because the same section identifies a production backend over plain HTTP and shows exactly how to send the cookie, it meaningfully increases exposure of sensitive session material and misuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The standalone curl example operationalizes direct authenticated access to the backend by replaying the SSO cookie and proxy-routing headers, bypassing the helper's higher-level safety constraints. This lowers the barrier for misuse, makes credential replay trivial, and provides a ready-made path to issue sensitive production configuration requests programmatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section gives detailed procedures for adding, modifying, deleting, and releasing configuration—including production rollout and staged gray releases—without a prominent security warning about operational risk, production impact, approval requirements, or rollback expectations. In this skill context, those actions can directly alter live service behavior, so procedural guidance without explicit safeguards materially increases the chance of unsafe or unauthorized changes.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified as requests>=2.25.0, which permits installation of many different versions, including versions later discovered to be vulnerable. In a security-sensitive skill that can authenticate to internal JD systems and read, modify, and publish DUCC configuration, non-reproducible dependency resolution increases supply-chain risk and makes it difficult to verify that a safe version is actually deployed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.25.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Because requests is unpinned, the manifest does not prove that deployment will avoid versions affected by known advisories, including credential leakage and TLS/verification-related issues. Given this skill's stated zero-configuration authentication and ability to access and publish sensitive DUCC configuration, a vulnerable HTTP client could expose SSO credentials, internal endpoints, or allow unsafe network interactions with significant operational impact.

Content

No source excerpt is available for this finding.