ClawHub
Back to skill

Security audit

Agnes Ai

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to generate images and videos through Agnes AI, but it uses unsafe API-key setup and local credential storage patterns users should review before installing.

Install only if you are comfortable giving this skill access to your Agnes AI account key and sending prompts and selected images to Agnes AI. Prefer setting AGNES_API_KEY through a secure secret manager or protected environment variable, avoid pasting real keys into chat, restrict permissions on any key file, and avoid using sensitive local images unless you intend to upload them to the service.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:46
Finding

API Key Persisted in an Unprotected Plaintext File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:46-55
Additional Location: README.md:72-78
Vulnerability Type: Plaintext credential storage and insecure secret provisioning
Risk Level: Medium

The Skill instructs the Agent to receive an Agnes API key through the conversation and persist it as a plaintext file without explicitly restricting the file or directory permissions.

bash
mkdir -p ~/.agnes-ai
echo -n "sk-your-key-here" > ~/.agnes-ai/api_key
export AGNES_API_KEY="sk-your-key-here"

The README provides equivalent plaintext configuration instructions:

bash
mkdir -p ~/.agnes-ai
echo "你的API密钥" > ~/.agnes-ai/api_key

Technical Analysis

The security of ~/.agnes-ai/api_key depends entirely on the user's current umask. The instructions do not create ~/.agnes-ai with mode 0700 or the key file with mode 0600. In environments with permissive defaults, another local account or process may be able to read the credential.

The secret is also embedded directly in a shell command and is expected to be supplied through an Agent conversation. Depending on the execution environment, this can expose the credential through:

  • Agent conversation histories or telemetry.
  • Shell history.
  • Process execution logs or command auditing.
  • Backups of the plaintext configuration file.
  • Access by other local users when filesystem permissions are permissive.

The script at scripts/generate.py:30-57 subsequently reads this plaintext key and uses it as a bearer credential. Anyone obtaining the key can authenticate as the user to the Agnes API.

Attack Path

  1. The user supplies an Agnes API key in an Agent conversation as instructed.
  2. The Agent interpolates the literal key into an echo or export shell command.
  3. The key is retained in conversation logs, command audit records, shell history, or an insufficiently protected ~/.agnes-ai/api_key file.
  4. A local attac ...[truncated 703 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not request API keys through ordinary Agent conversations.
  • Direct users to configure secrets through a platform secret manager, protected environment configuration, or interactive terminal input.
  • If file-based storage is required, create the directory and file with explicit restrictive permissions:
bash
install -d -m 0700 "$HOME/.agnes-ai"
umask 077
printf '%s' "$AGNES_API_KEY_INPUT" > "$HOME/.agnes-ai/api_key"
chmod 0600 "$HOME/.agnes-ai/api_key"
  • Avoid placing the literal secret in command-line arguments or shell history. Read it silently with an interactive secret prompt where possible.
  • Do not store a second copy in scripts/api_key, because a project or installation directory may be shared, archived, or committed accidentally.
  • Validate that the key file is a regular file owned by the current user and is not group- or world-readable before loading it.
  • Document key rotation and revocation procedures.
  • Ensure logs and error messages never contain authorization headers or key values.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.py:89
Finding

Unvalidated Server-Provided URLs Are Downloaded from the Agent's Network Context

Content
View full analysis

Vulnerability Details

File Location: scripts/generate.py:89-93
Additional Locations: scripts/generate.py:167-169, scripts/generate.py:211-220
Vulnerability Type: Server-side request forgery and unrestricted file retrieval
Risk Level: Medium

The download helper accepts an arbitrary URL and passes it directly to urllib.request.urlretrieve:

python
def download_file(url, output_path):
    """Download a file from URL to local path."""
    print("Downloading to " + output_path + " ...")
    urllib.request.urlretrieve(url, output_path)
    print("Saved: " + output_path)

Image generation passes the API-controlled response URL to that helper without validation:

python
if item.get("url"):
    download_file(item["url"], output_path)
    return output_path

Video generation does the same with several API-controlled fields:

python
url = data.get("result_url")
if not url:
    inner_data = data.get("data", {})
    url = inner_data.get("remixed_from_video_id") or inner_data.get("url")
if url:
    download_file(url, output_path)
    return output_path
else:
    print("ERROR: Completed but no video URL", file=sys.stderr)
    print("Full response: " + json.dumps(status_resp, indent=2), file=sys.stderr)
    sys.exit(1)

Technical Analysis

The code does not validate the URL scheme, destination hostname, resolved IP address, port, redirect targets, response content type, or response size. It therefore trusts the Agnes API response to select a resource that the local Agent will retrieve.

If the API service, an upstream component, or the user's API account is compromised, a crafted response can make the Agent issue requests from its own network context. Potential destinations include loopback services, private network addresses, link-local metadata services, or resources reachable only from the Agent host. Non-HTTP schemes supported by the URL library may a ...[truncated 2111 chars]

Remediation
View remediation

Remediation Suggestions

  • Accept only https URLs.
  • Maintain an explicit allowlist of trusted Agnes CDN hostnames.
  • Reject URLs containing user information, unexpected ports, or malformed hostnames.
  • Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6.
  • Disable automatic redirects or validate every redirect destination using the same policy.
  • Stream downloads in bounded chunks instead of using urlretrieve.
  • Configure connection and read timeouts.
  • Enforce a maximum response size appropriate for generated images and videos.
  • Check the response Content-Type against an allowlist such as approved image or video media types.
  • Validate file signatures before treating downloaded content as generated media.
  • Download to a securely created temporary file and atomically move it to the output path only after validation succeeds.
  • Avoid interpreting unrelated response fields such as remixed_from_video_id as URLs unless the API contract explicitly guarantees that they contain download URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Directing users to disclose secrets in agent conversation is unsafe because chat content is commonly persisted, inspected, or reused by the agent system. An exposed API key can be copied and abused to make unauthorized API calls, incur charges, and access the user’s service account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly tells users to send their API key to the agent in natural language chat. In many agent platforms, prompts, chat history, telemetry, and debugging logs may be stored or exposed to operators, plugins, or future sessions, so this guidance can lead to credential disclosure beyond the user’s intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

This finding is the same plaintext local-secret persistence issue: the skill instructs users to write the API key directly to ~/.agnes-ai/api_key. Storing long-lived credentials unencrypted on disk can enable theft through local access, insecure backups, or accidental disclosure.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

将 Key 写入本地文件：

bash
mkdir -p ~/.agnes-ai
echo "你的API密钥" > ~/.agnes-ai/api_key

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

This finding is the same plaintext local-secret persistence issue: the skill instructs users to write the API key directly to ~/.agnes-ai/api_key. Storing long-lived credentials unencrypted on disk can enable theft through local access, insecure backups, or accidental disclosure.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

将 Key 写入本地文件:

bash
mkdir -p ~/.agnes-ai
echo "你的API密钥" > ~/.agnes-ai/api_key

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill hard-codes the API key prompt in Chinese without checking the user's language or obtaining opt-in. This can confuse users during a sensitive credential-collection step, increasing the chance they misunderstand what is being requested or where the secret will be stored. In a security-sensitive flow, unclear communication raises phishing-like risk and weakens informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The skill instructs storing the Agnes API key in plaintext at ~/.agnes-ai/api_key and exporting it into the session environment. Plaintext local secret storage increases the chance of credential exposure through filesystem access, backups, shell history mistakes, or other local compromise. Because this is a reusable API credential, theft could enable unauthorized API use and billing abuse.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Then set the environment variable for the current session:

bash
mkdir -p ~/.agnes-ai
echo -n "sk-your-key-here" > ~/.agnes-ai/api_key
export AGNES_API_KEY="sk-your-key-here"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

bash
# Text-to-image (agnes-image-2.1-flash)
curl -s -X POST "https://apihub.agnes-ai.com/v1/images/generations" \
  -H "Authorization: Bearer $AGNES_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

Or call the API directly with curl:

bash
curl -s -X POST "https://apihub.agnes-ai.com/v1/video/generations" \
  -H "Authorization: Bearer $AGNES_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/generate.py (reported line 57)May include surrounding context.

python
return f.read().strip()

    print("ERROR: AGNES_API_KEY not set.", file=sys.stderr)
    print("Set the environment variable or write it to one of:", file=sys.stderr)
    print("  ~/.agnes-ai/api_key", file=sys.stderr)
    print("  " + local_key, file=sys.stderr)
    sys.exit(1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

When a user supplies a local image path, the script silently reads the file, base64-encodes it, and sends its contents to a remote API as a data URL. In a CLI that accepts both URLs and local paths, this can cause unintended disclosure of sensitive local images because the upload behavior is not clearly surfaced at the point of use beyond generic help text.

Content

No source excerpt is available for this finding.