T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth-bootstrap.sh:55- Finding
Authentication tokens are stored without explicit restrictive file permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawTune 抓音 是一款可以给你带来 AI 音乐的技能，包括听歌和创作。
Security checks for vulnerabilities and agentic risk
Overview
The skill’s music workflow is coherent, but it silently stores and uses local credentials, sends personal creative content to an external service, and includes unsafe credential-handling patterns that users should review before installing.
Install only if you are comfortable with this skill making authenticated calls to ClawTune, storing local auth/session files, and sending playlist prompts, draft details, order identifiers, and related creative content to the service. Before use, restrict permissions on ~/.openclaw/clawtune, avoid running the auth print command, do not set CLAWTUNE_BASE_URL to untrusted hosts, and avoid putting sensitive personal stories or secrets into prompts unless you intend to share them with ClawTune.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/api-request.sh:5- Finding
Unvalidated API base URL can redirect credentials and private content to an arbitrary server
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` 2. If development endpoints are necessary, implement an explicit allowlist of exact HTTPS origins rather than accepting arbitrary URLs. 3. Parse and validate the URL before use: - Require `https`. - Require an approved hostname. - Reject embedded credentials. - Reject unexpected ports. - Reject fragments and ambiguous path forms. 4. Separate development credentials from production credentials. Never send production access or refresh tokens to development endpoints. 5. Disable redirect following for authentication requests, or validate every redirect destination before retransmitting sensitive request data. 6. Prevent untrusted user input from setting `CLAWTUNE_BASE_URL` or other security-sensitive environment variables. 7. Log only the approved origin and never log authorization headers, refresh payloads, or token values. 8. Add automated tests confirming that HTTP URLs, unapproved hosts, and malformed origins are rejected. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth-bootstrap.sh:193- Finding
Diagnostic print mode exposes complete access and refresh tokens through standard output
- Content
View full analysis
/dev/null cat "$AUTH_FILE" ;; ``` ### Technical Analysis The `print` mode emits the entire authentication file to standard output. That file contains the installation identifier, access token, access-token expiration time, refresh token, refresh-token expiration time, channel, and user reference. Standard output is frequently captured by agent transcripts, orchestration systems, CI logs, terminal recorders, debugging tools, and support bundles. Unlike displaying a non-sensitive status value, printing the complete refresh token creates a direct credential-disclosure channel. The command must be invoked intentionally or through an automated workflow. No evidence shows that the normal application flow invokes `print`; nevertheless, its presence makes accidental disclosure straightforward. ### Attack Path 1. A user, support operator, agent, or automated diagnostic workflow invokes: ```bash bash scripts/auth-bootstrap.sh print ``` 2. The script ensures that a valid credential file exists, potentially refreshing or creating credentials first. 3. The script outputs the complete contents of `auth.json`. 4. An agent transcript, CI system, shell recorder, support tool, or log collector retains the output. 5. A party with access to those records extracts the access or refresh token. 6. The exposed token is reused to access the ClawTune API within its authorization scope. ### Impact Assessment Exposure may allow an attacker to: - Authenticate as the affected ClawTune installation. - Refresh access if a valid refresh token was captured. - Access or modify API data permitted by the compromised token. - Correlate an installation with its user reference and channel. The impact is limited by token expiry, revocation, scope, ...[truncated 93 chars]- Remediation
View remediation
/dev/null python3 - "$AUTH_FILE" <<'PY' import json, sys with open(sys.argv[1], encoding="utf-8") as f: data = json.load(f) print({ "installation_id": data.get("installation_id"), "access_token_expires_at": data.get("access_token_expires_at"), "refresh_token_expires_at": data.get("refresh_token_expires_at"), "channel": data.get("channel"), "user_ref": data.get("user_ref"), }) PY ;; ``` 3. Never emit access tokens or refresh tokens to standard output or standard error. 4. If raw secret access is unavoidable for emergency administration: - Require an explicit privileged option. - Verify that output is attached to an interactive terminal. - Display a warning and request confirmation. - Avoid execution in agent and CI environments. - Prefer access through a protected credential manager. 5. Configure log redaction for bearer-token and refresh-token patterns as a defense-in-depth measure. 6. Revoke and rotate any token that may already have been captured in logs or transcripts. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding correctly highlights undeclared local session-state file read/write capability. Even if the advertised music features are merely overstated, hidden persistent local storage is security-relevant because it can retain user/order context, identifiers, tokens, or recovery data outside the user's awareness.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation criteria are extremely broad—ordinary mentions of emotions, gifts, stories, memorials, background music, ordering, or checking results can trigger the skill. Overbroad invocation is dangerous because it can inappropriately route unrelated conversations into a skill that performs backend auth, state recovery, draft/order management, and external requests, increasing privacy and action-execution risk without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README instructs operators to bootstrap local credentials and make authenticated API calls, but it provides no guidance on protecting auth artifacts such as tokens, auth.json, or refresh material. In a skill that automates production API interactions, this omission increases the chance that secrets are stored insecurely, committed to repos, or exposed through logs and shared temp directories.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The evidence/logging section states that responses, payloads, and session snapshots are persisted, but it does not warn that these artifacts may contain sensitive user data, identifiers, order details, or authentication/session material. Because this skill handles playlist, draft, order, and recovery flows, verbose evidence capture can easily become a secondary data leak path if stored in shared temp locations or retained without controls.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly contemplates shell execution, file read/write, state persistence, and HTTP/auth flows, but it does not declare any corresponding tool scope or permission boundary. That creates a least-privilege failure: a host may expose broader capabilities than reviewers or operators expect, increasing the chance of unintended file access, token handling, or script execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction '中文对话默认用自然中文' sets a default language policy for user interactions. The file does not indicate that the user can choose another language or that the Chinese-only default is required for a documented region-specific reason.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document states in Chinese that the checklist is for testing the current ClawTune skill behavior, and all prompts/expected behaviors are written exclusively in Chinese with no indication that language choice is optional. This creates a natural-language policy concern because the skill appears to assume or require a specific language/locale rather than offering user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON file contains natural-language requirements that the generated song experience be specifically in Chinese (e.g. "中文的") and constrains response style accordingly. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation, and no justification or user choice is documented here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all user-facing example dialogue exclusively in Chinese and explicitly includes a '中文' requirement in an example, but nowhere indicates that language is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The playbook explicitly instructs the agent to read local credential files and persist session identifiers to local disk, but provides no requirement to obtain user consent or disclose that local files will be accessed and modified. In an agent setting, silent access to
~/.openclaw/...and silent writes tosession.jsoncan expose secrets, overwrite another user's state, or create cross-session confusion on shared systems.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file directs the agent to make authenticated requests, generate playlists, create drafts, and create orders against a remote service without any explicit notice that user content, session identifiers, and possibly personal creative data will be transmitted off-platform. This creates a transparency and consent problem, especially because order creation and draft submission may send sensitive user intent or personal stories to an external domain.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Lines L185-L187 instruct the agent to use Chinese by default and avoid English terms in Chinese conversations. This is a natural-language locale policy constraint that does not offer the user a language choice or opt-in, so it can violate language/locale policy requirements.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The file is an explicit set of curl templates for transmitting data to an external API, including authorization tokens and user-derived content. External transmission is expected for this skill, but it is still security-relevant because the examples encourage sending bearer tokens and personal/creative data without nearby warnings about consent, token protection, or safe execution/logging practices.
- Content
ClawTune curl templates: core API calls
bash export CLAWTUNE_BASE_URL="https://clawtune.aqifun.com/api/v1"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The examples transmit potentially sensitive free-form user content and stable identifiers such as user_ref, skill_session_id, lyrics_input, proposal_summary, and playlist context IDs to a remote service without any notice, minimization guidance, or consent boundary. In this skill context, those fields can contain intimate emotional narratives, gift/anniversary details, and creative material, so undocumented transmission increases privacy, compliance, and data-handling risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # ClawTune curl templates: auth 默认基址：
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This is a markdown file, so SQP-2 applies to omissions in the skill description. The file instructs users to export
CLAWTUNE_ACCESS_TOKENand send it in anAuthorizationheader, but does not warn that the token is sensitive, should be protected, and will be transmitted to the remote service.- Content
Static analysis
No suspicious patterns detected.