ClawHub
Back to skill

Security audit

Ready Tools On Sciminer

Security checks for vulnerabilities and agentic risk

Overview

The skill is for calling SciMiner APIs, but it lets live remote documentation control authenticated requests and uploads, which could expose the user's SciMiner API key or files if that documentation changes or is compromised.

Review before installing. Use only a revocable, least-privilege SciMiner API key, avoid uploading sensitive files, and verify requests stay on the intended SciMiner API host. The skill would be safer with a fixed local client, strict host/path allowlists, and confirmation before any newly discovered or changed tool definition is invoked.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:50
Finding

Mutable Remote Documentation Controls Generated and Executed Invocation Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–65 and 88–100
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet:

markdown
## Authoritative payload source

The selected Markdown file under `https://sciminer.tech/tool_api_files/` is the
single source of truth for the chosen tool. The agent MUST:

1. Read the selected tool doc before every invocation.
2. Never invent `provider_name`, `tool_name`, parameter names, enum values,
  content type, submission flow, or upload-field names from memory.
3. Extract and follow the document's exact:
   - Base URL
   - API endpoint
   - Content-Type
   - Authentication header
   - Tool Name
  - Section-level tool method
   - Parameter table, including required fields and enum values
  - File-upload instructions and example submission payload structure

The associated execution workflow states:

markdown
## Required workflow

1. Read the index at `https://sciminer.tech/tool_api_files/`.
2. Resolve the Markdown description file for the requested tool from the links
   actually present in the index.
3. Read the full Markdown document for the resolved tool.
4. Choose the tool section that matches the user's request shape.
5. Collect any missing required parameters from the user.
6. Upload any required file inputs and replace local paths with returned
   `file_id` values.
7. Submit the job using the exact `provider_name`, `tool_name`, endpoint,
   content type, and parameter names from the selected doc, following the
   document's example submission flow.
8. Poll for the task result.
9. Return the `share_url` in the final user-facing summary.

Technical Analysis

The Skill designates externally hosted, mutable Markdown as the authoritative source for operational behavior. Remote content controls the base URL, endpoint, authentication header, upload behavior, ...[truncated 2240 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace document-driven code generation with a fixed, locally reviewed API client.
  2. Treat remote Markdown exclusively as untrusted descriptive data; never execute its code examples or follow free-form operational instructions.
  3. Define a strict local schema for permitted tool metadata and reject unknown fields, executable content, unexpected headers, and unsupported submission flows.
  4. Hard-code an allowlist of approved HTTPS origins and API paths independently of the remote documents.
  5. Reject cross-origin redirects and prevent credentials from being forwarded after any redirect.
  6. Pin or cryptographically verify approved tool-document versions before use.
  7. Restrict file uploads to explicitly identified user files and require confirmation showing the destination, file names, and requested tool.
  8. Require explicit user approval before invoking a newly discovered or materially changed remote tool definition.
  9. Run any unavoidable generated code in a sandbox without credential, filesystem, shell, or unrestricted network access.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:69
Finding

Credential May Be Sent to a Destination Controlled by Remote Documentation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69–82
Vulnerability Type: Insecure credential handling and destination validation
Risk Level: High

Vulnerable Code Snippet:

markdown
## Prerequisites

1. Obtain a free SciMiner API key from `https://sciminer.tech/utility`.
2. Store it outside this repository at `~/.config/sciminer/credentials.json`
  with JSON shaped as `{"api_key":"your_api_key_here"}`.
3. For SciMiner calls, read the API key from
  `~/.config/sciminer/credentials.json` and send it as the `X-Auth-Token`
  header.
4. Never print, persist, or store the API key in prompts, logs, or repository
  files. Agents should remember only the credential file path.

If `~/.config/sciminer/credentials.json` is not available or does not contain
an `api_key` field, stop and tell the user to obtain a free SciMiner API key
from `https://sciminer.tech/utility` and store it in that file. Do not try to
complete the task by switching to other tools or services.

The credential handling must be considered together with lines 55–60, which require the agent to extract and follow the remote document's exact base URL, API endpoint, and authentication header.

Technical Analysis

Access to ~/.config/sciminer/credentials.json is functionally related to the declared authenticated SciMiner integration and does not, by itself, exceed the minimum privileges required. Storing the credential outside the repository and prohibiting its appearance in logs are positive controls.

However, the Skill does not bind use of that credential to a fixed, trusted API origin. The destination and authentication behavior are sourced from mutable remote Markdown. No instruction requires verification that the final request host is an approved SciMiner API hostname, and no restriction prevents credential forwarding through redirects.

This creates a credential-confused-deputy condition: the Skill possesses a legit ...[truncated 1521 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bind the credential to an exact, locally configured HTTPS API origin rather than a host obtained from remote documentation.
  2. Maintain separate allowlists for permitted hostnames, ports, paths, methods, and authentication headers.
  3. Refuse to attach X-Auth-Token to any non-allowlisted origin.
  4. Disable automatic redirects for authenticated requests, or strip the credential and require revalidation before following a redirect.
  5. Use a narrowly scoped, revocable token with minimum job-submission permissions and appropriate rate or quota limits.
  6. Validate that the credential file is a regular file owned by the expected user and has restrictive permissions, such as mode 0600.
  7. Ensure exceptions, HTTP traces, generated code, and diagnostic output redact authentication headers.
  8. Keep credential loading inside a fixed local client so generated snippets and remote documents never receive or interpolate the raw secret.
  9. Prompt for confirmation if any request destination differs from the locally configured canonical SciMiner API endpoint.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill explicitly declares a local credential file and is designed to read an API key from it for subsequent outbound requests. Accessing local secrets is a sensitive capability; because the same skill also consumes remote, user-selected documentation to determine invocation behavior, it creates a credible path for secret misuse or exfiltration if downstream instructions are manipulated or if the skill is reused in unsafe contexts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: ready-tools-on-sciminer
description: Discover a user-specified SciMiner tool from the published API-doc index, read its Markdown description, and invoke it through the SciMiner internal API.
credential_files:
  - ~/.config/sciminer/credentials.json
---

# Ready Tools on SciMiner

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This line instructs the agent to read a local API key and place it into an authentication header during tool execution. Even though it says not to print the key, the combination of secret access plus dynamic behavior driven by externally fetched Markdown makes this dangerous: a compromised or malicious tool doc could steer requests in ways that misuse the credential.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
matching Markdown file, reads the document, and writes or runs invocation code
from the selected document's exact fields.

SciMiner calls must read the API key from `~/.config/sciminer/credentials.json`
and send it as the `X-Auth-Token`, and user-facing summaries must include the returned `share_url` for each
successful task.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The prerequisites instruct operators to store a reusable API key in a known path and have the skill consume it automatically. This is a real security concern because it normalizes local secret harvesting by the skill and increases the blast radius if the skill is subverted, misconfigured, or invoked in an untrusted session.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
## Prerequisites

1. Obtain a free SciMiner API key from `https://sciminer.tech/utility`.
2. Store it outside this repository at `~/.config/sciminer/credentials.json`
  with JSON shaped as `{"api_key":"your_api_key_here"}`.
3. For SciMiner calls, read the API key from
  `~/.config/sciminer/credentials.json` and send it as the `X-Auth-Token`

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This instruction operationalizes use of the locally stored API key by sending it as an auth header. While standard for API clients, in an agent skill this is sensitive because the skill is generic and follows remote documentation as the 'single source of truth,' increasing the chance that secret-backed requests could be redirected or abused.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
2. Store it outside this repository at `~/.config/sciminer/credentials.json`
  with JSON shaped as `{"api_key":"your_api_key_here"}`.
3. For SciMiner calls, read the API key from
  `~/.config/sciminer/credentials.json` and send it as the `X-Auth-Token`
  header.
4. Never print, persist, or store the API key in prompts, logs, or repository
  files. Agents should remember only the credential file path.

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This line reinforces dependency on a local credential file and instructs the agent to stop if it is absent. By itself it is less severe than active exfiltration, but it still confirms that the skill expects filesystem secret access as a normal operating mode, which is risky in a generic, network-enabled skill processing potentially adversarial remote content.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
4. Never print, persist, or store the API key in prompts, logs, or repository
  files. Agents should remember only the credential file path.

If `~/.config/sciminer/credentials.json` is not available or does not contain
an `api_key` field, stop and tell the user to obtain a free SciMiner API key
from `https://sciminer.tech/utility` and store it in that file. Do not try to
complete the task by switching to other tools or services.