ClawHub
Back to skill

Security audit

302ai Api Integration Skill

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a 302.AI API helper, but it uses overly broad activation rules and unnecessarily asks for and embeds a live API key, so users should review it carefully before installing.

Install only if you intentionally want a 302.AI-focused integration helper. Do not paste a live API key into chat; configure credentials locally with environment variables or a secret manager, review generated code before running it, and confirm endpoints remain on the expected 302.AI domains before sending real project data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:31
Finding

Mandatory API-Key Disclosure and Hardcoded Credential Generation

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:1
Finding

Overbroad Proactive Routing Hijacks Unrelated API Requests

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/parse_api_list.py:52
Finding

Unvalidated Remote Documentation Links Are Passed into WebFetch

Content
View full analysis
子分类 [API名称](文档链接): 描述 # 示例：- 语言大模型 > OpenAI [Chat（聊天）](https://doc.302.ai/147522039e0.md): 描述内容 pattern = r'^-\s+(.+?)\s+\[(.+?)\]\((.+?)\):\s*(.*)$' for line in content.split('\n'): line = line.strip() if not line or not line.startswith('-'): continue match = re.match(pattern, line) if match: category = match.group(1).strip() name = match.group(2).strip() link = match.group(3).strip() description = match.group(4).strip() apis.append({ 'category': category, 'name': name, 'link': link, 'description': description }) ``` `SKILL.md:145-170`: ```markdown ### Step 5: Display Candidate APIs Show found APIs to user for selection: ``` I found the following available APIs: 1. **OpenAI Chat** - Category: Language Models > OpenAI - Description: Supports GPT-4, GPT-3.5 and other chat models - Docs: https://doc.302.ai/147522039e0.md 2. **Claude Chat** - Category: Language Models > Claude - Description: Supports Claude 3.5 Sonnet, Claude 3 Opus and other models - Docs: https://doc.302.ai/xxxxxxxxx.md Please select the API you want to use (enter number): ``` ### Step 6: Get Detailed Documentation After user selection, use WebFetch to get detailed API documentation: ``` WebFetch( url="[user_selected_api_doc_link]", prompt="Extract API endpoint, request parameters, response format, usage examples and other detailed information" ) ``` ``` ### Technical Analysis The executable script fetches the catalog from the fixed HTTPS URL `ht ...[truncated 2354 chars]
Remediation
View remediation
str: parsed = urlparse(link) if parsed.scheme != "https": raise ValueError("Documentation URL must use HTTPS") if parsed.hostname != "doc.302.ai": raise ValueError("Untrusted documentation host") if parsed.username or parsed.password: raise ValueError("Embedded URL credentials are not allowed") if parsed.port not in (None, 443): raise ValueError("Unexpected documentation port") if not parsed.path.endswith(".md"): raise ValueError("Unexpected documentation path") return link ``` 5. Apply the same origin policy after redirects; reject any redirect leaving `https://doc.302.ai`. 6. Treat fetched documentation as untrusted reference data. Explicitly instruct the Agent to ignore commands, role changes, secret requests, tool-use directions, and unrelated instructions found in fetched content. 7. Extract only expected structured fields such as endpoint, HTTP method, parameters, and response schema. 8. Require user confirmation before generating code that sends credentials or application data to any origin other than the expected API host. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

There is a clear description-to-behavior mismatch. The description claims a broad, proactive skill for any API functionality, including automatic discovery across 302.AI's APIs and generation of integration code. The actual code only retrieves a text file listing APIs, parses its lines, performs basic local filtering by keyword/category, and prints results. It does not call downstream APIs, generate code snippets, integrate with AI/image/video/audio services, or implement logic to 'always use' the skill when API capabilities are mentioned. The primary purpose of the code is API catalog parsing/search, which is much narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction to ALWAYS use this skill for any API functionality is an overly broad trigger that can hijack unrelated user requests and route them into a third-party integration workflow. In context, this is more dangerous because the skill also asks for a user's API key and encourages external lookups, increasing the chance of unnecessary credential solicitation and data transfer.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list includes vague categories such as 'any AI functionality' and 'API needs,' which are broad enough to match a large fraction of normal conversations. That creates a prompt-scope vulnerability: the skill can be invoked outside its legitimate domain and pressure users into providing API keys or using 302.AI when they did not ask for it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README states that the skill 'automatically' searches 1400+ APIs and fetches the latest API list in real time, but it does not provide a clear upfront privacy or network-use warning near that behavior. In an agent setting, this can lead users to disclose prompts, requirements, or metadata to external services without informed consent, making the behavior more risky than a normal static documentation example.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README uses broad natural-language prompts like 'Integrate speech-to-text API' and explicitly says to 'always use this skill' for any API functionality. In an agentic environment, that can cause over-broad or unintended invocation, especially when user requests merely mention APIs or AI capabilities, increasing the chance of unnecessary network access, data disclosure to external services, or unexpected code generation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 98)May include surrounding context.

md
BASE_URL = "https://api.302.ai"

def call_gpt4(prompt):
    response = requests.post(
        f"{BASE_URL}/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_CN.md (reported line 97)May include surrounding context.

md
BASE_URL = "https://api.302.ai"

def call_gpt4(prompt):
    response = requests.post(
        f"{BASE_URL}/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {API_KEY}",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill explicitly instructs use of network-capable behaviors (fetching API lists/docs and generating code that transmits data to external endpoints) but does not declare any tool scope or allowed-tools restrictions. That creates a governance gap: the runtime may permit broader-than-expected outbound access, and reviewers/users are not clearly informed what external actions the skill requires.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This code template sends arbitrary request data and an Authorization bearer token to an external API endpoint. In the context of a skill that proactively asks for a user's API key, this increases the risk of credential exposure, accidental transmission of sensitive prompts/data, and unsafe copy-paste practices if users embed secrets directly into generated code.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md
url = f"{BASE_URL}{endpoint}"

    try:
        response = requests.post(url, headers=headers, json=data)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The streaming example also transmits request data and credentials to an external endpoint, with less visible control over downstream handling because responses are streamed incrementally. In this skill context, the risk is elevated by the broad triggers and credential solicitation, which can normalize sending secrets or sensitive content to third-party services without sufficient user intent or review.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md
url = f"{BASE_URL}{endpoint}"

    response = requests.post(url, headers=headers, json=data, stream=True)

    for line in response.iter_lines():
        if line:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file is entirely written in Chinese and presents itself as a general API integration template, but it does not offer users an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking audience. Under the natural-language policy rule, forcing a specific language without opt-in is a locale-policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/integration_examples.md (reported line 36)May include surrounding context.

md
url = f"{BASE_URL}{endpoint}"

    try:
        response = requests.post(url, headers=headers, json=data)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/integration_examples.md (reported line 80)May include surrounding context.

md
url = f"{BASE_URL}{endpoint}"

    try:
        response = requests.post(url, headers=headers, json=data)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/integration_examples.md (reported line 189)May include surrounding context.

});

text

## cURL 命令模板

### 基础请求

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/integration_examples.md (reported line 194)May include surrounding context.

基础请求

bash
curl -X POST "https://api.302.ai/v1/endpoint" \
  -H "Authorization: Bearer your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/integration_examples.md (reported line 206)May include surrounding context.

基础请求

bash
curl -X POST "https://api.302.ai/v1/endpoint" \
  -H "Authorization: Bearer your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document presents this file as the Chinese documentation variant ("English | 中文文档"), which indicates a fixed locale for the skill description rather than offering language choice within the file itself. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The SVG element uses Chinese text values in id and data-name (_图层_1, 图层 1). This is a natural-language locale choice embedded in the file, and there is no indication that the asset is intentionally region-specific or that a locale choice is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill document is written only in Chinese and does not offer any language or locale choice for users. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the regional restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

Line L188 states that the latest version will be automatically fetched before each use, but the provided file contains only static Markdown content and no code or mechanism to perform such retrieval. This is an intent/documentation contradiction within the skill materials rather than a mere omission, because it explicitly describes behavior not implemented here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file presents all usage instructions, examples, and warnings only in Chinese. Under the policy rule for language or locale constraints, forcing a single language without user opt-in can be a natural-language policy issue unless the restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language strings that force a specific language/locale for documentation and CLI interaction. The policy scope for SQP-3 covers language or locale constraints unless the skill offers user choice or clearly documents a justified regional limitation, which is not present here.

Content

No source excerpt is available for this finding.