ClawHub
Back to skill

Security audit

csgo

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed CSGO item price monitor, but users should protect API tokens and understand that alerts and monitoring data may go to external services.

Before installing, treat the CSQAQ API token and DingTalk/Feishu webhook URLs as secrets, prefer environment variables or a private local config, and avoid committing them. Enable notifications only if you are comfortable sharing alert content with those providers, and review or clear persistent monitor data if the monitored items or thresholds are sensitive.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:258
Finding
Plaintext API and webhook credential storage<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–56, 258–268, and 282–299 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium The documented configuration instructs users to embed API credentials and notification webhook tokens directly in configuration files and source-style configuration objects. ```javascript { notification: { enabled: true, channels: { dingtalk: { enabled: true, webhook: 'https://oapi.dingtalk.com/robot/send?access_token=XXX', useMarkdown: true }, feishu: { enabled: false, webhook: 'https://open.feishu.cn/open-apis/bot/v2/hook/XXX' } } } } ``` ### Technical Analysis DingTalk and Feishu webhook URLs contain bearer-like credentials that grant access to notification bots. The documentation also directs users to place the CSQAQ API token directly in `config.json`. Storing these values in plaintext configuration creates a risk that they will be disclosed through: - Accidental source-control commits - Configuration backups or artifact archives - Debug output and exception logging - Support bundles or screenshots - Unauthorized local file access - Process or application diagnostics that print configuration values The project provides no documented environment-variable integration, secret-manager support, restrictive file-permission requirements, log redaction, or source-control exclusion rules. Although the displayed values are placeholders rather than live credentials, following the documented deployment pattern would result in real secrets being stored in plaintext. ### Attack Path 1. A user follows the setup instructions and replaces the placeholder API token or webhook URL with a real credential. 2. The resulting configuration file is committed to a repository, copied into an artifact, included in a backup, printed in logs, or read by another local user or process. 3. An attacker extracts the CSQAQ ...[truncated 965 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Load API tokens and webhook URLs from environment variables or a dedicated secret manager rather than storing them directly in tracked configuration: ```javascript const apiToken = process.env.CSQAQ_API_TOKEN; const dingtalkWebhook = process.env.DINGTALK_WEBHOOK_URL; const feishuWebhook = process.env.FEISHU_WEBHOOK_URL; ``` 2. Provide a non-sensitive configuration template containing only variable references or empty placeholders. 3. Add secret-bearing files such as `.env`, `config.local.json`, and production configuration files to `.gitignore`. 4. Document restrictive file permissions for any local secret file, such as owner-only read and write access. 5. Redact API tokens, webhook query parameters, and complete webhook URLs from logs, errors, monitoring data, and diagnostic output. 6. Validate required environment variables at startup without printing their values. 7. Use a repository secret scanner and a pre-commit hook to detect accidentally committed tokens and webhook URLs. 8. Rotate and revoke any credential that has already been stored in source control, logs, published artifacts, or shared backups. Removing a secret from the latest revision alone is insufficient because it may remain in repository history. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
All user-facing instructions, commands, examples, and stated compatible interaction patterns are presented exclusively in Chinese, with no indication that other languages are supported or that the language requirement is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly supports outbound DingTalk/Feishu/webhook notifications and also stores monitoring configuration and notification logs over time, but the documentation does not clearly warn users that their monitored items, alert thresholds, market activity, and related metadata may be sent to third-party services and retained. This creates a privacy and transparency issue because users may unknowingly expose trading interests or behavioral data to external platforms and local persistence layers.

External Transmission

Medium
Category
Data Exfiltration
Content
```json
{
  "apiToken": "你的CSQAQ_API_TOKEN",
  "baseURL": "https://api.csqaq.com/api/v1",
  "requestDelay": 30000,
  "monitor": {
    "checkInterval": 1800000,
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.