ClawHub
Back to skill

Security audit

lingjingtest

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real JoyCreator API helper, but it needs review because it handles a sensitive App Key in ways that can expose the credential.

Install only if you intend to use JD Cloud JoyCreator. Provide the App Key through a protected environment variable or hidden secret input, not chat text or --api-key. Avoid submitting confidential prompts, private images, or non-expiring public media URLs unless you are comfortable sending them to the external provider and potentially incurring account usage.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/joycreator.py:562
Finding

JoyCreator App Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/joycreator.py, lines 562–568
Vulnerability Type: Credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python
parser.add_argument("--api-key")
parser.add_argument("--duration", default="5")
parser.add_argument("--aspect-ratio", default="16:9")
parser.add_argument("--image-url")
args = parser.parse_args()

app_key = args.api_key or os.environ.get("JOYCREATOR_APP_KEY","").strip()

Technical Analysis

The script permits users to provide the JoyCreator App Key through the --api-key command-line option. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through:

  • Shell history files
  • Process inspection utilities and process metadata
  • CI/CD job logs and command tracing
  • Monitoring or endpoint-management agents
  • Terminal session recordings
  • Crash diagnostics and automation telemetry

The supplied value is subsequently placed in the Authorization: Bearer request header and therefore represents a reusable API credential. Although transmission to the fixed JoyCreator HTTPS endpoint is necessary for the declared functionality, accepting the credential on the command line creates an avoidable local disclosure channel and exceeds the minimum safe credential-handling requirements.

Attack Path

  1. A user invokes the script with a command such as python scripts/joycreator.py --api-key SECRET ....
  2. The complete command is retained in shell history, captured by CI logging, or exposed through process metadata while the script is running.
  3. A local user, monitoring service, log reader, or compromised automation component retrieves the App Key.
  4. The attacker supplies the stolen key as a Bearer credential to the JoyCreator API.
  5. The attacker submits generation tasks under the victim's account until the key is revoked or otherwise restricted.

This pat ...[truncated 696 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key command-line option entirely.
  2. Obtain the key only from the JOYCREATOR_APP_KEY environment variable, a protected secret manager, or hidden interactive input through getpass.getpass().
  3. For CI/CD usage, inject the key through the platform's masked secret mechanism and ensure command tracing is disabled around secret handling.
  4. Update documentation to explicitly prohibit placing App Keys in command lines, source files, shell scripts, or unprotected configuration files.
  5. Avoid logging request headers or complete request objects in future changes.
  6. Recommend key rotation for users who previously supplied credentials through --api-key, especially where shell history or build logs may be accessible.
  7. Where supported by JoyCreator, use narrowly scoped, short-lived, quota-limited credentials to reduce the impact of disclosure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)

Tainted flow: 'app_key' from os.environ.get (line 568, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/joycreator.py (reported line 429)May include surrounding context.

python
def submit_task(app_key: str, api_id: str, params: dict) -> str:
    payload = {"apiId": api_id, "params": params}
    print(f"\n📤 阶段三：提交任务 (apiId={api_id})...")
    resp = requests.post(BASE_URL, json=payload, headers=build_headers(app_key), timeout=30)
    resp.raise_for_status()
    data = resp.json()
    if not data.get("success"):

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger rules are overly broad and include a mandatory invocation requirement for common requests like drawing or making videos. This can force use of the skill in situations where it is unnecessary, increasing the chance of unnecessary credential collection, external API calls, and prompt-routing away from safer or more appropriate handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill describes capabilities that require network access and handling credentials, but it does not declare any explicit tool scope or permission boundaries. That increases the risk of over-privileged execution and makes it harder for a host system or user to understand and constrain what the skill may access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill asks the user to provide a JoyCreator App Key directly before any stage begins, but it does not clearly warn that this credential is sensitive and should not be pasted into chat. In context, this is especially risky because the skill is designed to send authenticated network requests, so a leaked key could allow unauthorized API use, billing abuse, or account misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructions, rules, and examples are fully Chinese-language and do not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The trigger terms include broad, common phrases such as speed, cost, and batch-oriented language that can match many benign user requests outside the intended scope. In an agent pipeline, overbroad matching can cause unintended skill activation, leading to wrong downstream API calls, unexpected external data transmission, or bypass of more appropriate routing logic.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The image recommendation rule treats generic product/reference signals as sufficient to select a model, which can incorrectly capture unrelated requests that merely mention a product, reference image, or similar broad concept. Because this skill ultimately submits jobs to an external API, accidental invocation can expose user prompts or assets and create unintended cost-incurring operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example explicitly sends user prompts and an Authorization bearer token to a remote third-party API, but the documentation does not warn that submitted content may leave the local environment and be processed or logged externally. In a skill that is designed to auto-route user requests to generation APIs, this omission increases the chance that users unknowingly transmit sensitive prompts, metadata, or asset references.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This example performs an outbound POST to an external API and includes an Authorization bearer token plus user-generated prompt content. External transmission is expected for this integration, but it is still security-relevant because the documentation normalizes sending potentially sensitive content and credentials off-platform without adjacent disclosure or handling guidance.

Content

Scanner excerpt · references/doubao.md (reported line 44)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This example sends video-generation prompts and an Authorization token to a remote service, creating an external data flow that could expose sensitive creative content or account credentials if copied into insecure environments. In the context of an automation skill that may be invoked broadly, users may not appreciate that their requests are leaving the system boundary.

Content

Scanner excerpt · references/doubao.md (reported line 77)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation requires image-to-video inputs to be publicly accessible URLs, which can expose private images to anyone with the link or to unintended indexing/logging paths, yet it provides no warning about that privacy tradeoff. Because this skill supports user-supplied media generation flows, users may be encouraged to publish personal or proprietary images just to satisfy the API requirement.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This outbound request transmits not only an Authorization token and prompt but also public image URLs, which can reveal user assets and associated metadata to an external service. Combined with the public URL requirement, the data exposure risk is higher because users may have to stage private images on public infrastructure before submission.

Content

Scanner excerpt · references/doubao.md (reported line 107)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/hailuo.md (reported line 35)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/hailuo.md (reported line 76)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/kling.md (reported line 51)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/kling.md (reported line 105)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/kling.md (reported line 190)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/paiwo.md (reported line 46)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/paiwo.md (reported line 98)May include surrounding context.

请求示例

bash
curl -X POST "https://model.jdcloud.com/joycreator/openApi/submitTask" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${JOYCREATOR_APP_KEY}" \
  -H "x-jdcloud-request-id: $(uuidgen)" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file includes concrete HTTP request examples that transmit an authorization bearer token and user inputs to a remote cloud API. The document explains how to send prompts and image URLs but does not include any warning that user content and credentials are being sent to an external service, which is required for markdown under the missing user warnings category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file includes curl examples that POST user-supplied prompts and, in other sections, media URLs to JD Cloud's JoyCreator API. The document does not include any warning that user content will be transmitted to an external service, which is relevant to privacy and data-handling expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The example instructs users to pass an API credential via the Authorization header using JOYCREATOR_APP_KEY, but the markdown does not caution users to protect the token or avoid exposing it in shared shells, logs, or screenshots. Because this affects credential safety and privacy, a user-facing warning is warranted in documentation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The image-generation trigger list includes very generic terms such as ‘画’, ‘照片’, and ‘设计稿’, which can appear in ordinary conversation or unrelated requests. In this skill, broad matching can cause unintended routing into the JoyCreator pipeline, leading the agent to transform or forward user input to an external generation API when the user did not actually request that behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The video-generation trigger terms are also overly broad, including words like ‘视频’, ‘动画’, and ‘做视频’ without scope constraints. Because the skill metadata says the skill must be used whenever such terms are mentioned, ambiguous language can force incorrect activation and external API use, creating unintended actions, privacy exposure of prompts, and reduced user control.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code file contains user-facing natural-language instructions that assume Chinese as the interaction language, including usage, environment variable guidance, and generation examples. The skill does not offer an explicit language/locale choice or justify a Chinese-only constraint, which can violate a language/locale policy requiring user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.