ClawHub
Back to skill

Security audit

Avito.ru publish and chat

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Avito API purpose, but its examples and scripts put account secrets and tokens on the command line where they can be exposed.

Install only if you are comfortable granting API access to your Avito account data. Do not paste real client secrets or bearer tokens into command examples, chat transcripts, or shell history; use a secure credential flow or modify the scripts to read from protected environment variables or a secret manager before use. Rotate any Avito secrets or tokens that were previously used with these command-line examples.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:20
Finding

Sensitive credentials exposed through command-line arguments

Content
View full analysis
") sys.exit(1) token_data = get_token(sys.argv[1], sys.argv[2]) ``` `scripts/get_self.py:18-22`: ```python if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: get_self.py ") sys.exit(1) user = get_self(sys.argv[1]) ``` `scripts/get_balance.py:18-22`: ```python if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: get_balance.py ") sys.exit(1) balance = get_balance(sys.argv[1], sys.argv[2]) ``` `scripts/list_items.py:18-22`: ```python if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: list_items.py ") sys.exit(1) items = list_items(sys.argv[1]) ``` `scripts/list_chats.py:18-22`: ```python if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: list_chats.py ") sys.exit(1) chats = list_chats(sys.argv[1], sys.argv[2]) ``` The corresponding usage documented in `SKILL.md` instructs users to place secrets directly on the command line: ```bash python3 scripts/auth.py python3 scripts/get_self.py python3 scripts/get_balance.py python3 scripts/list_items.py python3 scripts/list_chats.py ``` ### Technical Analysis The scripts retrieve the Avito client secret and bearer access tokens from `sys.argv`. Command-line arguments are not an app ...[truncated 2457 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Authentication

Get an access token using your client credentials.

bash
python3 scripts/auth.py <client_id> <client_secret>

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill explicitly describes interacting with the Avito API and includes scripts that perform authentication and account operations, which implies outbound network access. Omitting a declared tool scope or permissions boundary makes the skill less auditable and can allow broader-than-expected network behavior, especially in an environment where skills should clearly declare capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The setup and feature descriptions instruct users to provide client credentials and tokens, but they do not warn that these are sensitive secrets tied to account access and private account/chat data. This increases the chance that users expose credentials in prompts, logs, shell history, or insecure storage, leading to unauthorized access to the Avito account and associated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The script sends client_id and client_secret to a remote token endpoint via requests.post, but there is no confirmation prompt, explanatory log message, or docstring/comment disclosing that sensitive credentials are transmitted over the network. For a code file, this is a safety-relevant operation involving credentials and external communication without any user warning in the file.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/auth.py (reported line 6)May include surrounding context.

python
import json

def list_items(token):
    url = "https://api.avito.ru/core/v1/items"
    headers = {
        "Authorization": f"Bearer {token}"
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_balance.py (reported line 6)May include surrounding context.

python
import json

def list_items(token):
    url = "https://api.avito.ru/core/v1/items"
    headers = {
        "Authorization": f"Bearer {token}"
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_self.py (reported line 6)May include surrounding context.

python
import json

def list_items(token):
    url = "https://api.avito.ru/core/v1/items"
    headers = {
        "Authorization": f"Bearer {token}"
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/list_chats.py (reported line 6)May include surrounding context.

python
import json

def list_items(token):
    url = "https://api.avito.ru/core/v1/items"
    headers = {
        "Authorization": f"Bearer {token}"
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/list_items.py (reported line 6)May include surrounding context.

python
import json

def list_items(token):
    url = "https://api.avito.ru/core/v1/items"
    headers = {
        "Authorization": f"Bearer {token}"
    }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script accepts a bearer token directly from the command line, which can expose the credential through shell history, process listings, audit logs, or job runners. Because this skill manages an Avito account and can access account data and chats, disclosure of the token could allow unauthorized API access to sensitive account information and actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.