Niu Vehicle

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:57 PM UTC
• Version: 0.1.0

Overview

This skill does what it claims: it uses a NIU API key to fetch scooter status, including sensitive location data, from a NIU endpoint.

Install only if you are comfortable giving this skill access to your NIU API key and scooter telemetry, including current location. Avoid running it with shell tracing or shared process/log visibility, and rotate the NIU API key if you think the query URL may have been logged.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

API Credential Exposed in URL Query String

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: API credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

bash

curl -s "https://ai-mcp.niu.com/claw/scooter_info?key=$NIU_API_KEY"

Technical Analysis

The command expands NIU_API_KEY directly into the request URL. Although HTTPS encrypts the request in transit, it does not protect the credential from exposure through locations where complete URLs may be recorded, including process inspection interfaces, diagnostic output, HTTP access logs, reverse proxies, observability systems, and endpoint monitoring products.

URL query parameters are commonly logged by default and may receive weaker redaction than authentication headers. Consequently, a legitimate skill invocation can unintentionally leave reusable credential material in systems accessible to users or services that should not possess the NIU API key.

Attack Path

1. A user invokes the skill to obtain scooter information.
2. The shell expands $NIU_API_KEY into curl's URL argument.
3. A local process observer, diagnostic system, proxy, access logger, or monitoring component records the complete URL.
4. An attacker with access to that record extracts the key query parameter.
5. The attacker submits requests to the NIU scooter endpoint using the exposed key.
6. If the key remains valid and the service does not impose additional authorization controls, the endpoint returns the associated vehicle information.

Impact Assessment

Successful exploitation may allow unauthorized access to private scooter information available through the API, including battery level, estimated range, charging state, remaining charging time, current location, total mileage, and last-update time.

The impact is limited to the permissions assigned to the compromised API key. No evidence indicates that the key provides operating-system privileges, code execution, persistence, or contr ...[truncated 153 chars]

Remediation

View remediation

Remediation Suggestions

1. Modify the API to accept the credential in an authorization header rather than a query parameter. For example:

   bash

   curl -s \
     -H "Authorization: Bearer $NIU_API_KEY" \
     "https://ai-mcp.niu.com/claw/scooter_info"
   

2. Configure the server to reject query-string credentials so clients cannot continue using the insecure pattern.

3. Ensure authorization headers are redacted from application, proxy, monitoring, and debugging logs.

4. Avoid enabling shell tracing while handling the credential, and restrict access to processes and configuration files containing it.

5. Rotate API keys that may previously have appeared in URL, proxy, access, diagnostic, or monitoring logs.

6. Apply short expiration periods, least-privilege scopes, revocation support, and rate limiting to reduce the consequences of credential disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends a sensitive API key to a remote NIU endpoint and retrieves precise scooter status data including location, charging state, and mileage, but it does not disclose this data flow or privacy impact to the user. This creates a real privacy and credential-handling risk because users may invoke the skill without understanding that live location and account-linked vehicle telemetry are being transmitted and exposed.

Content

No source excerpt is available for this finding.