T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cfgpu-helper.sh:27- Finding
Arbitrary Command Execution Through eval-Based curl Construction
- Content
View full analysis
- Remediation
View remediation
Security audit
CFGPU API Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but its helper scripts handle credentials and shell commands unsafely while controlling billable cloud resources.
Install only if you are comfortable reviewing and hardening the shell scripts first. Avoid running setup-env.sh as-is, do not store real tokens in shell startup files, rotate any token entered into this skill, and require explicit confirmation before create, stop, release, or change-image operations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/verify-clean.sh:9- Finding
Credential-Like UUID Embedded in Repository and Self-Matching Secret Verification
- Content
View full analysis
/dev/null; then echo "❌ Found hardcoded API token!" exit 1 else echo "✅ No hardcoded API tokens found" fi ``` ### Technical Analysis A UUID-shaped value identified by the script itself as an API token is embedded directly in a tracked source file. Static analysis cannot establish whether the value is active, expired, revoked, or merely a test marker. Nevertheless, embedding a credential-like value in distributed source code creates an avoidable disclosure risk. The verification logic is also defective: when run from the project root, recursive `grep` examines `scripts/verify-clean.sh` itself and finds the literal value on line 9. Consequently, the verifier reports a hardcoded token and exits even when the value appears nowhere else. In addition, this check only searches for one exact token and cannot detect any other leaked credential. ### Attack Path 1. An attacker obtains the repository or a generated package. 2. The attacker extracts the UUID-shaped value from `scripts/verify-clean.sh`. 3. If the value was ever a valid CFGPU token and remains active, the attacker attempts to use it in the CFGPU `Authorization` header. 4. Independently, maintainers may rely on the verifier as a security control, but it either fails on its own source or provides no coverage for different credentials. ### Impact Assessment If the value is an active credential, exposure could permit authenticated CFGPU API access within the token's assigned permissions, including possible cloud-resource inspection or lifecycle operations. Even if the value is not valid, the broken verification process creates a fa ...[truncated 213 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup-env.sh:24- Finding
API Token Exposed During Input and Persisted in Shell Startup Files
- Content
View full analysis
~/.cfgpu/token chmod 600 ~/.cfgpu/token echo "API token saved to ~/.cfgpu/token" # Add to bashrc/zshrc SHELL_RC="" if [ -f ~/.bashrc ]; then SHELL_RC=~/.bashrc elif [ -f ~/.zshrc ]; then SHELL_RC=~/.zshrc fi if [ -n "$SHELL_RC" ]; then if ! grep -q "CFGPU_API_TOKEN" "$SHELL_RC"; then echo "" >> "$SHELL_RC" echo "# CFGPU API Configuration" >> "$SHELL_RC" echo "export CFGPU_API_TOKEN=\"$api_token\"" >> "$SHELL_RC" echo "Added CFGPU_API_TOKEN to $SHELL_RC" fi fi ``` ### Technical Analysis The token is read without silent mode, so it is displayed on the terminal while the user types it. The script then stores the token in two places: - `~/.cfgpu/token`, which is subsequently assigned mode `600`. - `.bashrc` or `.zshrc`, whose permissions are not checked or restricted. Duplicating a long-lived API token into a shell startup file increases its exposure to backup tools, diagnostic collection, dotfile synchronization, accidental publication, and local users when the startup file is permissively readable. The token is also inserted into a double-quoted shell assignment without escaping. A token containing a double quote followed by shell syntax can create executable content in the shell startup file. Normal CFGPU tokens may not contain such characters, but the script performs no validation. ### Attack Path Credential-disclosure path: 1. The user runs `setup-env.sh`. 2. The entered token is vi ...[truncated 1021 chars]- Remediation
View remediation
"$HOME/.cfgpu/token" chmod 600 "$HOME/.cfgpu/token" ``` 4. Use `printf` rather than `echo` for sensitive or untrusted values. 5. Validate token format against the documented CFGPU token syntax before storage. 6. If persistent environment configuration is required, write only the token file path to shell configuration, not the token itself. 7. Warn users to remove tokens already written to `.bashrc` or `.zshrc` and rotate exposed credentials. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/package-for-github.sh:27- Finding
Packaging Script Claims to Sanitize Secrets but Performs Only No-Op Replacements
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (53)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as an API management utility but also includes repository scanning, cleanliness verification, secret-pattern scanning, permission auditing, and large-file detection. Even if intended for hygiene, these behaviors extend access into the local workspace and can expose or process files outside what users expect from a cloud-instance management skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as an API management utility but also includes repository scanning, cleanliness verification, secret-pattern scanning, permission auditing, and large-file detection. Even if intended for hygiene, these behaviors extend access into the local workspace and can expose or process files outside what users expect from a cloud-instance management skill.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: cfgpu-api description: A powerful OpenClaw skill for managing and automating GPU container instances on CFGPU cloud platform. Designed for AI/ML developers, researchers, and content creators, providing full lifecycle management of GPU cloud resources. --- # CFGPU API Skill **CFGPU API Skill** - Your Intelligent GPU Cloud Management Assistant Tired of complex GPU cloud management processes? Want to utilize GPU resources more efficiently? CFGPU API Skill is your perfect solution! ## 🚀 Why Choose This Skill? ✅ **One-Click Deployment**: Say goodbye to tedious configuration, create GPU instances in
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh *.token *.key *.secret .env .env.local .env.*.local
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh *.key *.secret .env .env.local .env.*.local # System files
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh if ! command -v jq &> /dev/null; then echo "jq is not installed. Installing..." if command -v apt-get &> /dev/null; then sudo apt-get update && sudo apt-get install -y jq elif command -v yum &> /dev/null; then sudo yum install -y jq elif command -v brew &> /dev/null; then
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
-
Clone the repository
-
Install dependencies:
bash sudo apt-get install jq curl -
Set up test environment:
-
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Set environment variable
export CFGPU_API_TOKEN="YOUR_API_TOKEN"
Or create token file
echo "YOUR_API_TOKEN" > ~/.cfgpu/token chmod 600 ~/.cfgpu/token
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Or create token file
echo "YOUR_API_TOKEN" > ~/.cfgpu/token chmod 600 ~/.cfgpu/token
text ### 3. Basic Usage
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Or create token file
echo "YOUR_API_TOKEN" > ~/.cfgpu/token chmod 600 ~/.cfgpu/token
text ### 3. Basic Usage
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### 1. Get Your API Token 1. Visit [CFGPU Platform](https://cfgpu.com) 2. Create an account or login 3. Generate an API token from your account settings ### 2. Configure Authentication
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file includes a direct example for releasing (deleting) an instance, which is a destructive operation affecting user resources. Although the README mentions confirmation prompts in general, the usage example itself does not warn that release may permanently remove the instance and potentially any data on it.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
./cfgpu-helper.sh list-regions
Test instance operations (dry run)
./cfgpu-helper.sh quick-create --dry-run
text ### Integration Tests
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises and demonstrates shell-based operations but does not declare an explicit tool scope or permissions boundary. In an agent ecosystem, that increases the chance the skill is invoked with broader shell capability than users expect, enabling unintended command execution paths and reducing auditability.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## 🚀 Why Choose This Skill? ✅ **One-Click Deployment**: Say goodbye to tedious configuration, create GPU instances in 30 seconds ✅ **Cost Transparency**: Real-time expense monitoring, avoid unexpected bills ✅ **Intelligent Scheduling**: Automatically optimizes resource usage, saves up to 40% cost ✅ **Full Compatibility**: Supports all mainstream GPU types and system images
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation normalizes instance creation, stopping, and releasing resources without prominent warnings that these are billable or potentially irreversible operations. In agent-driven contexts, insufficient warnings can lead to accidental spend, service interruption, or unexpected deletion of running resources.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation phrases are broad and can match generic GPU-related requests, increasing the likelihood this skill is selected when a user did not specifically ask to manage CFGPU resources. Because the skill supports billable and destructive operations, overbroad activation materially raises the risk of unintended cloud actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 77% confidence
- Finding
The skill sends an authentication token in outbound requests to an external service, which is expected for API use but still constitutes sensitive data transmission. If logs, shell history, proxies, or misconfigured environments capture these requests, the token could be exposed and abused to manage cloud resources.
- Content
bash # List available regions curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/region/list # List available GPU types curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/gpu/list
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 77% confidence
- Finding
The skill sends an authentication token in outbound requests to an external service, which is expected for API use but still constitutes sensitive data transmission. If logs, shell history, proxies, or misconfigured environments capture these requests, the token could be exposed and abused to manage cloud resources.
- Content
bash # List available regions curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/region/list # List available GPU types curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/gpu/list
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/region/list # List available GPU types curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/gpu/list # Create a GPU instance curl -X POST -H "Authorization: $CFGPU_API_TOKEN" -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/region/list # List available GPU types curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/gpu/list # Create a GPU instance curl -X POST -H "Authorization: $CFGPU_API_TOKEN" -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/region/list # List available GPU types curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/gpu/list # Create a GPU instance curl -X POST -H "Authorization: $CFGPU_API_TOKEN" -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/region/list # List available GPU types curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/gpu/list # Create a GPU instance curl -X POST -H "Authorization: $CFGPU_API_TOKEN" -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/region/list # List available GPU types curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/gpu/list # Create a GPU instance curl -X POST -H "Authorization: $CFGPU_API_TOKEN" -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/region/list # List available GPU types curl -H "Authorization: $CFGPU_API_TOKEN" https://api.cfgpu.com/userapi/v1/gpu/list # Create a GPU instance curl -X POST -H "Authorization: $CFGPU_API_TOKEN" -H "Content-Type: application/json" \
Static analysis
No suspicious patterns detected.