ClawHub
Back to skill

Security audit

sn-image-doctor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent environment doctor, but it may print resolved API configuration in plain text and its documentation does not clearly match the script's actual behavior.

Install only if you are comfortable reviewing the script and its output before sharing logs. Do not paste doctor output into support tickets or chats unless API keys and tokens are redacted, and prefer setting credentials through a secure secret store instead of a plaintext .env file when possible.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check_environment.py:157
Finding

Potential Disclosure of API Credentials Through Unredacted Configuration Output

Content
View full analysis

Vulnerability Details

File Location: scripts/check_environment.py:157-168
Vulnerability Type: Sensitive configuration disclosure
Risk Level: Medium

python
def inspect_configs(_verbose: bool):
    global_configs = _load_configs(SKILLS_DIR)
    if global_configs is None:
        print(
            "❌ Cannot import Configs from sn-image-base, skipping config inspection",
            file=sys.stderr,
        )
        return

    print("Resolved configs:")
    if hasattr(global_configs, "to_string"):
        print(indent(global_configs.to_string(), "  * "))
    else:
        print(indent(str(global_configs), "  * "))

Technical Analysis

The function serializes and prints the complete resolved configuration without locally redacting sensitive fields. The documented configuration contains credential-bearing variables such as SN_API_KEY and SN_IMAGE_GEN_API_KEY.

Configuration inspection is invoked during every environment check at line 151, regardless of whether --verbose was supplied. Protection therefore depends entirely on the external global_configs.to_string() implementation. The fallback to str(global_configs) similarly provides no explicit redaction guarantee.

If either representation includes credential values, secrets will be written in plaintext to standard output. Diagnostic output is commonly retained in CI logs, terminal transcripts, support records, or Agent-visible conversation context.

Attack Path

  1. A user configures an API key in the process environment or another source consumed by sn-image-base.
  2. The user or an automated job runs python scripts/check_environment.py.
  3. check_env_vars() invokes inspect_configs() unconditionally.
  4. inspect_configs() loads the resolved configuration object.
  5. The object is serialized through to_string() or the fallback str() and printed without local field-level redaction.
  6. If the external repre ...[truncated 823 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not serialize the complete configuration object for diagnostic output.
  2. Define an explicit allowlist of non-sensitive fields that may be displayed.
  3. For credential-bearing fields, print only presence status, such as configured or missing.
  4. Explicitly redact field names containing terms such as key, token, secret, password, credential, or authorization.
  5. Remove the unrestricted str(global_configs) fallback because its output contract does not guarantee redaction.
  6. Restrict detailed non-secret diagnostics to --verbose; the current _verbose parameter is unused.
  7. Add automated tests using sentinel secrets and assert that neither normal nor verbose output contains those values.
  8. Document that diagnostic output is safe to share only after verifying that all sensitive values are redacted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The documented behavior and the detected implementation behavior diverge in security-relevant ways, especially around handling environment variables and printing resolved configuration values. When a diagnostic skill touches secrets, mismatches between description and behavior can mislead users into approving actions that reveal or mishandle credentials.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill is explicitly designed to prompt for API keys and save them into a .env file, which is direct credential handling. In a diagnostic skill with broad triggers and unclear permission declarations, collecting and storing secrets creates real risk of leakage, accidental overwrite, or later exfiltration by other tooling.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
Environment diagnostic skill for SenseNova-Skills project.
  Checks that sn-image-base is properly installed and configured, validates dependencies
  and environment variables. Prompts user to configure missing required variables and saves
  them to .env file. After configuration, reloads environment and suggests agent restart if needed.
triggers:
  - "SenseNova-Skills环境检查"
  - "SenseNova-Skills doctor"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
export SN_API_KEY="your-api-key"
export SN_BASE_URL="https://your-api-endpoint.com"

# Or create a .env file
cat > .env << EOF
SN_API_KEY=your-api-key
SN_BASE_URL=https://token.sensenova.cn/v1

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
export SN_API_KEY="your-api-key"
export SN_BASE_URL="https://your-api-endpoint.com"

# Or create a .env file
cat > .env << EOF
SN_API_KEY=your-api-key
SN_BASE_URL=https://token.sensenova.cn/v1

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
export SN_API_KEY="your-api-key"
export SN_BASE_URL="https://your-api-endpoint.com"

# Or create a .env file
cat > .env << EOF
SN_API_KEY=your-api-key
SN_BASE_URL=https://token.sensenova.cn/v1

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
export SN_API_KEY="your-api-key"
export SN_BASE_URL="https://your-api-endpoint.com"

# Or create a .env file
cat > .env << EOF
SN_API_KEY=your-api-key
SN_BASE_URL=https://token.sensenova.cn/v1

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill documents behavior that involves reading environment variables and interacting with a .env file, but it declares no explicit tool scope or permissions. In an agent ecosystem, missing scope declarations can let a broadly triggered skill access files or environment data without clear user visibility or policy enforcement, increasing the chance of unintended secret exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Broad triggers like 'environment check' and 'health check' increase the chance of accidental or contextually inappropriate activation. Because this skill is capable of examining environment configuration and potentially interacting with sensitive files, unintended invocation could lead to unnecessary exposure of system details or secrets.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script prints fully resolved configuration values after loading environment-derived settings, which can include secrets such as API keys or tokens. Diagnostic output is often captured in logs, terminals, CI systems, or chat transcripts, so exposing resolved configs can leak credentials beyond the immediate user session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Printing resolved settings derived from environment variables without masking or warning can disclose sensitive values directly to users, logs, and automation systems. Because the tool's purpose is environment diagnosis, operators are likely to run it in troubleshooting contexts where output is widely shared, increasing the chance of accidental secret exposure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Resolved configuration values are emitted in plain text, creating a direct secret-disclosure risk if configuration objects include credentials like SN_API_KEY. In the context of an environment diagnostic skill, this is more dangerous because users may paste the output into issue trackers, support chats, or agent conversations, unintentionally leaking production secrets.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes this skill as checking whether sn-image-base is installed and configured, validating dependencies and environment variables for that base skill. In addition to that, the code iterates through every directory under the skills root and reports all directories that look like sn-* skills, which broadens behavior beyond the stated diagnostic scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.