ClawHub
Back to skill

Security audit

Bioinfo Daily

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does the described PubMed report generation, but one wrapper executes a local .env file as shell code and the docs make an unsupported claim that credential files are git-ignored.

Review this skill before installing. Prefer setting NCBI_EMAIL and NCBI_API_KEY through OpenClaw config or process environment, avoid using the project-local .env path with the shell wrapper, and add your own .gitignore before creating any .env file. Treat Feishu publishing as manual or incomplete unless you add and review separate upload logic.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_daily.sh:13
Finding

Project-local .env file is executed as shell code

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_daily.sh, lines 13-15
Vulnerability Type: Unsafe configuration-file execution
Risk Level: Medium

bash
if [ -f "$SKILL_DIR/.env" ]; then
    source "$SKILL_DIR/.env"
fi

Technical Analysis

The wrapper loads .env with the Bash source command. This does not merely parse environment-variable assignments; it executes the entire file as shell code under the identity of the user running the wrapper.

The Skill only needs to retrieve NCBI_EMAIL and NCBI_API_KEY. Granting a configuration file arbitrary command-execution capability exceeds that requirement. Shell substitutions, redirections, function definitions, and ordinary commands embedded in .env will all execute.

Attack Path

  1. An attacker, compromised process, or malicious project distribution obtains the ability to create or modify the project-local .env.
  2. The attacker inserts shell commands, for example:
    bash
    NCBI_EMAIL=user@example.com
NCBI_API_KEY=example
malicious_command
  3. The user manually invokes scripts/generate_daily.sh, or an explicitly configured scheduled workflow invokes it.
  4. Bash executes malicious_command when processing source "$SKILL_DIR/.env".
  5. The command runs with the permissions and environment of the invoking user.

Impact Assessment

Successful exploitation provides arbitrary command execution as the user running the Skill. An attacker could read files accessible to that user, access inherited environment variables, steal configured credentials, alter user-owned files, modify OpenClaw configuration, or establish additional user-level persistence.

This flaw does not independently grant root privileges. Exploitation requires the attacker to influence the .env file before the wrapper runs. No malicious .env file was present in the audited project.

Remediation
View remediation

Remediation Suggestions

  • Do not use source, ., or eval to load a dotenv file.
  • Parse the file as non-executable data using a maintained dotenv implementation or a strict custom parser.
  • Allow only the exact keys NCBI_EMAIL and NCBI_API_KEY.
  • Reject command substitutions, shell metacharacters, malformed assignments, duplicate keys, and unexpected variable names.
  • Verify that the configuration file is a regular file, is owned by the expected user, and is not writable by other users.
  • Prefer credentials supplied by the process environment or a dedicated secret manager instead of a project-local plaintext file.
  • Run the scheduled workflow with a dedicated, minimally privileged account where practical.

T09 · Insecure Skill Coding Practices

Note
Location
README.md:50
Finding

Documentation falsely claims that credential-bearing .env files are ignored by Git

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 50-59
Vulnerability Type: Missing secret-exclusion control
Risk Level: Low

markdown
#### Method 3: .env file

Create a `.env` file in the project directory:

NCBI_EMAIL=your@email.com NCBI_API_KEY=your_api_key

text

> Security notice: Only place NCBI credentials in `.env`; do not place unrelated secrets in the same file. This file is already included in `.gitignore` and will not be committed to Git.

The repository structure supplied for audit contains no .gitignore file, despite the documentation asserting that .env is already excluded.

Technical Analysis

The documentation directs users to store an email address and API key in a project-local plaintext .env file. It then states that Git will not commit that file because it is covered by .gitignore. The claimed safeguard is absent from the audited project.

Git does not automatically exclude .env. Without a global user-specific ignore rule, the file is untracked and can be staged by commands such as git add .. The misleading assurance makes accidental credential disclosure more likely.

Attack Path

  1. A user follows the documented configuration method and creates .env containing NCBI_EMAIL and NCBI_API_KEY.
  2. The user relies on the statement that .env is already ignored.
  3. The user runs a broad staging command such as git add . and commits the resulting changes.
  4. The commit is pushed to a shared or public repository.
  5. Anyone with repository access can retrieve the exposed credentials, including from Git history after the working-tree file is removed.

Impact Assessment

Exposure can disclose the user's email address and NCBI API key. An attacker could consume the victim's NCBI API quota, cause throttling or service disruption, and associate API activity with the victim's account.

The impact is limited to secrets actually placed in the file ...[truncated 129 chars]

Remediation
View remediation

Remediation Suggestions

  • Add a project-root .gitignore containing:
    gitignore
    .env
.env.*
!.env.example
  • Commit a non-sensitive .env.example containing placeholder values only.
  • Correct the documentation so its claims match the repository's actual controls.
  • Recommend checking git status and git diff --cached before every commit.
  • Add automated secret scanning to local hooks and continuous-integration workflows.
  • If credentials have ever been committed, revoke and rotate them immediately; deleting the current file does not remove secrets from Git history.
  • Prefer process-level environment injection or a secret manager over plaintext project-local credential storage.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)

Tainted flow: 'params' from os.environ.get (line 119, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/pubmed_search.py (reported line 102)May include surrounding context.

python
}
    
    try:
        response = requests.get(search_url, params=params, timeout=30)
        response.raise_for_status()
        data = response.json()

Tainted flow: 'params' from os.environ.get (line 119, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/pubmed_search.py (reported line 128)May include surrounding context.

python
}
    
    try:
        response = requests.get(fetch_url, params=params, timeout=30)
        response.raise_for_status()
        
        # 解析 XML

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

The code chunk is only a cron wrapper around another script. Its direct behavior is to execute a Python script, parse the path of a generated report, and print that report to stdout. This partially aligns with a supporting role for automated daily report generation, but it does not implement several important declared capabilities, especially sending the report to Feishu and manual date-based querying. Because the declared purpose presents a fuller end-user skill while the supplied code chunk only provides a limited wrapper and omits key advertised behaviors, the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

该技能的整体领域方向与代码相关，都是围绕生物信息学/肿瘤学研究进展汇总；但描述中的核心实现方式和功能承诺与代码实际行为存在明显差异。描述强调的是基于 PubMed API 的结构化文献检索、按特定顶级期刊和日期筛选、挑选高影响力研究并生成中文亮点摘要，属于较为专业的文献监测工作流。实际代码只是对几个主题进行一般性网页搜索，截取输出并保存为本地文本文件。虽然“生成日报”这一高层目标相近，但关键能力、数据来源、筛选标准和输出质量都与声明不符，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The script sources a .env file directly into the shell with source "$SKILL_DIR/.env", which executes arbitrary shell code, not just variable assignments. If an attacker can modify that file in the skill directory or workspace, they can achieve code execution whenever the script runs, potentially stealing API keys or pivoting to other local resources. In this skill context, the script is intended for scheduled automation, which makes the risk more dangerous because malicious code in .env could execute repeatedly without user review.

Content

Scanner excerpt · scripts/generate_daily.sh (reported line 12)May include surrounding context.

sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# 加载 .env 文件（如果存在）
if [ -f "$SKILL_DIR/.env" ]; then
    source "$SKILL_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This finding is part of the same unsafe pattern: loading "$SKILL_DIR/.env" via shell sourcing treats the file as executable shell script. A crafted .env could run arbitrary commands under the user's account during routine execution, exposing credentials or altering generated outputs. Because this skill handles API credentials and is likely to be run in automation, the blast radius is elevated beyond a simple local convenience script.

Content

Scanner excerpt · scripts/generate_daily.sh (reported line 13)May include surrounding context.

sh
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# 加载 .env 文件（如果存在）
if [ -f "$SKILL_DIR/.env" ]; then
    source "$SKILL_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The source "$SKILL_DIR/.env" statement is the dangerous sink: any content in the .env file is executed in the current shell context. An attacker who can influence that file can run commands, exfiltrate NCBI_API_KEY, tamper with report generation, or persist malicious behavior via scheduled runs. The skill context increases concern because it encourages daily unattended execution, making stealthy repeated exploitation plausible.

Content

Scanner excerpt · scripts/generate_daily.sh (reported line 14)May include surrounding context.

sh
# 加载 .env 文件（如果存在）
if [ -f "$SKILL_DIR/.env" ]; then
    source "$SKILL_DIR/.env"
fi

# 获取日期

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md
import xml.etree.ElementTree as ET
import time

# PubMed API 配置（从环境变量或 .env 文件读取，避免硬编码）
import os

# 尝试加载 .env 文件（方式3）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 166)May include surrounding context.

md
import xml.etree.ElementTree as ET
import time

# PubMed API 配置（从环境变量或 .env 文件读取，避免硬编码）
import os

# 尝试加载 .env 文件（方式3）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
import xml.etree.ElementTree as ET
import time

# PubMed API 配置（从环境变量或 .env 文件读取，避免硬编码）
import os

# 尝试加载 .env 文件（方式3）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/pubmed_search.py (reported line 16)May include surrounding context.

python
import xml.etree.ElementTree as ET
import time

# PubMed API 配置（从环境变量或 .env 文件读取，避免硬编码）
import os

# 尝试加载 .env 文件（方式3）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/pubmed_search.py (reported line 19)May include surrounding context.

python
import xml.etree.ElementTree as ET
import time

# PubMed API 配置（从环境变量或 .env 文件读取，避免硬编码）
import os

# 尝试加载 .env 文件（方式3）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/pubmed_search.py (reported line 22)May include surrounding context.

python
# 尝试加载 .env 文件（方式3）
SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
SKILL_DIR = os.path.dirname(SCRIPT_DIR)
ENV_FILE = os.path.join(SKILL_DIR, '.env')

if os.path.exists(ENV_FILE):
    with open(ENV_FILE, 'r') as f:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description states that each paper will include a Chinese highlight and that the daily report summary is automatically generated, implying a fixed output language. This is a natural-language policy concern because the file does not offer users a language choice or document that Chinese-only output is an intentional, opt-in regional constraint.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill advertises commands and script execution that imply access to environment variables, filesystem, network, and shell, but it does not declare any explicit tool scope or permission boundaries. This creates an over-privileged and opaque execution model where reviewers and users cannot easily determine or constrain what the skill may access at runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description and feature list repeatedly state that the report includes Chinese highlights, presenting Chinese as the required output language rather than an option. This is a natural-language locale policy concern because the skill mandates a specific language without offering user selection or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The package description states that the skill generates a report '包含中文亮点介绍', which specifies Chinese-language output as a default requirement. This is a natural-language locale constraint, and the manifest does not mention any user option to select another language or opt in to Chinese output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill metadata repeats that the generated daily report includes '中文亮点介绍', implying a fixed Chinese-language output. Because no alternative language choice or explicit opt-in is described in the manifest, this appears to violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The header comment says '生成日报并创建飞书文档', which asserts an active document-creation side effect. In practice, the script writes files under /tmp and merely prints instructions telling the operator to use a separate feishu_doc tool later, so the comment contradicts the implemented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script's comments and all user-visible status/error messages are in Chinese, such as the banner, error text, and next-step instructions. This imposes a specific language/locale without any opt-in, fallback, or explanation that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a daily report generator that can automatically send the report to Feishu, and the file header also says it will '创建飞书文档'. However, this script only generates local text/Markdown files and then instructs the user to manually use a feishu_doc tool; no Feishu API call or document creation occurs here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description states it will generate a Chinese highlights summary, which imposes a specific language on users. The file contains no natural-language indication that users can choose another language or opt in to Chinese output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Using an external subprocess for core search functionality expands the attack surface beyond the reviewed code and bypasses tighter control available through in-process libraries or direct API calls. In an agent skill, this is more dangerous because the binary's behavior, network access, update path, and logging are not visible here, making abuse or unexpected data handling harder to assess.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill metadata promises PubMed/Nature Index retrieval, but the implementation performs a generic web search through an external CLI instead. This mismatch is security-relevant because users may trust the skill to access only expected scholarly sources, while it actually sends data to a broader, less predictable search path and may return unvetted content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

The script launches an external CLI subprocess to perform searches, which creates a trust boundary outside the Python code and sends query data to another executable/service. While it avoids shell injection by using an argument list, it still introduces supply-chain and data-exfiltration risk because the behavior of the openclaw binary is not validated or constrained here.

Content

Scanner excerpt · scripts/search_bioinfo.py (reported line 18)May include surrounding context.

python
"""搜索特定主题的最新研究"""
    try:
        # 使用 web_search 工具搜索
        result = subprocess.run(
            ['openclaw', 'web_search', f'{topic} 最新研究'],
            capture_output=True,
            text=True,

Static analysis

No suspicious patterns detected.