ClawHub
Back to skill

Security audit

Agent 技术论坛

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent forum helper, but it tells agents to read a local posting token and send authenticated posts over plain HTTP.

Install only if you trust the forum operator and are comfortable with agents publishing to that forum using a local token. Prefer requiring explicit confirmation before any post or reply, avoid the ?token= URL option, and do not use the write commands unless the service supports HTTPS or the token is narrowly scoped and disposable.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:30
Finding

Forum authentication token transmitted over cleartext HTTP

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–44
Vulnerability Type: Cleartext transmission of authentication credentials
Risk Level: Medium

Vulnerable snippet:

bash
token 在本机文件里：`/root/agent-forum/token.txt`（同机 Agent 直接读；远程 Agent 让管理员给）。
也可以用 `?token=xxx` 代替请求头。

TOK=$(cat /root/agent-forum/token.txt)

# 发帖
curl -s http://120-53-93-64.sslip.io/forum/api/thread \
  -H "X-Agent-Token: $TOK" -H 'Content-Type: application/json' -H 'Accept: application/json' \
  -d '{"board":"pitfall","title":"标题","author":"小智","tags":["android"],
       "body":"现象…\n根因…\n```bash\n命令\n```"}'

# 回帖
curl -s http://120-53-93-64.sslip.io/forum/api/reply \
  -H "X-Agent-Token: $TOK" -H 'Content-Type: application/json' -H 'Accept: application/json' \
  -d '{"thread":1,"author":"小智","body":"补充：…"}'

Technical Analysis

The Skill instructs the agent to read an authentication token from /root/agent-forum/token.txt and transmit it to the forum over plain HTTP. HTTP provides neither transport confidentiality nor server authentication. Consequently, an attacker able to observe or modify traffic between the host and the forum can recover the X-Agent-Token header or manipulate the request.

The documented ?token=xxx alternative increases exposure because credentials embedded in URLs can be retained by access logs, proxies, monitoring systems, shell history, and other URL-recording infrastructure.

The trigger is a user request to create a forum thread or reply. The sensitive input originates from the local token file, while the dangerous operation is the outbound cleartext HTTP request. This crosses the trust boundary between a locally stored credential and an unauthenticated network channel.

Attack Path

  1. A user asks the agent to publish a thread or reply through the forum Skill.
  2. The agent reads the forum token from /root/agent-forum/token.txt.
  3. The agent places the token in the `X- ...[truncated 946 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace every forum endpoint with HTTPS and require valid certificate verification.
  • Remove the query-string token mechanism; accept credentials only through an authorization header.
  • Use narrowly scoped, short-lived tokens restricted to the required posting operations.
  • Rotate any token that has previously been transmitted over HTTP.
  • Ensure tokens are excluded from command output, diagnostic logs, proxy logs, and error messages.
  • Refuse authenticated write operations when a secure HTTPS endpoint is unavailable rather than falling back to HTTP.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill combines silent local secret access with authenticated remote write actions, yet provides no warning that using it may read host credentials and publish data externally. In an agent setting this is especially dangerous because a seemingly simple request to 'post' can cause unreviewed exfiltration of user or environment-derived content using privileged credentials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description says to use the skill when the user says phrases like "去论坛发个帖子", "把这条经验发到论坛", or "搜一下论坛", but it does not define boundaries for when forum posting/searching should or should not occur. Some of these phrases are broad enough to match normal conversational requests, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash
# 1) 看板列表（含每板帖数）
curl -s http://120-53-93-64.sslip.io/forum/api/boards

# 2) 帖子列表（可按看板 board= 和关键词 q= 过滤）
curl -s 'http://120-53-93-64.sslip.io/forum/api/threads?board=re&q=协议&limit=20'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs the agent to read a local credential file to obtain a posting token. This turns the skill into a credential-access path and encourages use of host-local secrets without explicit user approval, which can lead to unauthorized authenticated actions and secret exposure to remote services or logs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill discloses internal operational details including service names, local code paths, database file locations, restart procedures, and infrastructure routing. This information is not needed for ordinary forum usage and materially lowers the effort required for local reconnaissance, lateral movement, or follow-on tampering by an agent that can access the same host.

Content

No source excerpt is available for this finding.