ClawHub
Back to skill

Security audit

SEO 博客写作基础版

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible SEO writing helper, but it asks for broad command execution and includes unsafe, conflicting handling of credentials and external API use.

Review this skill before installing. Use it only for explicit SEO blog-writing tasks, avoid running the broad environment-variable check, prefer environment variables or a proper secret store for API keys, and assume external APIs may receive task content unless the publisher documents exact data flows.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:151
Finding

Overbroad Enumeration of Credential-Related Environment Variables

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 151–153
Vulnerability Type: Credential exposure through unnecessary environment-variable enumeration
Risk Level: Medium

bash
# 验证环境变量是否设置
echo "配置检查:"
env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/"  # Linux/macOS
# 或 PowerShell
# Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-Table

Technical Analysis

The setup-validation instructions enumerate every environment variable whose name contains credential-related terms such as API, KEY, TOKEN, or SECRET. This is unnecessary for the Skill's stated SEO writing purpose and violates least-privilege principles.

The Unix pipeline masks values before displaying them, but it still discloses the names of potentially sensitive variables. The PowerShell alternative does not apply equivalent redaction: environment-variable objects formatted as a table may display both variable names and their values. Consequently, API keys or tokens could be exposed in terminal output, Agent context, command transcripts, or retained logs.

There is no evidence that the Skill transmits this output to an external destination. Therefore, this finding establishes unnecessary credential access and potential local disclosure, but not confirmed network exfiltration.

Attack Path

  1. A user or Agent follows the documented configuration-validation procedure.
  2. The shell enumerates all environment variables matching broad credential-related patterns.
  3. On Unix-like systems, sensitive variable names are displayed even though their values are masked.
  4. Under the documented PowerShell alternative, matching variable values may also be displayed because no redaction is applied.
  5. The resulting output may enter the Agent's context, terminal history, execution logs, screenshots, or other records accessible to additional parties.

Impact Assessment

The instruction can reveal the existence and naming of credentials acros ...[truncated 532 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove broad enumeration based on generic patterns such as API, KEY, TOKEN, and SECRET.
  2. Validate only the exact environment variable required for the explicitly selected provider.
  3. Return only a presence/absence result and never print the variable's name or value. For example, use a provider-specific boolean check that emits only configured or not configured.
  4. Apply equivalent non-disclosure behavior on every supported operating system; do not use Format-Table on environment-variable objects containing secret values.
  5. Prevent command output containing credentials from entering Agent prompts, logs, telemetry, shell history, or error reports.
  6. Remove the declared exec capability if it is not essential to text generation. If execution remains necessary, restrict it to a narrow allowlist of fixed commands without user-controlled interpolation.
  7. Document the exact credential required by each optional integration rather than scanning the entire process environment.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description is overly broad and overlaps with ordinary writing, marketing, and content-creation requests. In agent environments, vague routing criteria can cause this skill to trigger for generic prompts, unnecessarily granting access to higher-risk tools like exec for tasks that do not need command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example activation phrase ('请帮我个人博客快速产出') is too vague to uniquely identify this skill and could match many benign writing requests. In combination with allowed exec/read tools, ambiguous activation increases the risk of unintended skill invocation and unnecessary exposure of local environment or command execution capabilities.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill makes contradictory security and privacy claims: it says FREE version data is 'all stored locally' and 'not uploaded to the cloud,' while elsewhere stating some features require network access to external APIs. This can mislead users into providing sensitive content under a false assumption of locality, causing unintended disclosure to third-party services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document gives conflicting guidance on secret handling: it warns not to hardcode API keys or store them in config files, yet also states that API keys can be stored via configuration files. Mixed instructions increase the chance that users will persist secrets insecurely, exposing credentials through repos, backups, logs, or shared project files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.