ClawHub
Back to skill

Security audit

Doubao Assistant Free

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent Doubao API guide, but it asks for broad read/write/exec authority and sends prompt content to placeholder external endpoints without clear safeguards.

Review before installing. Use this only as a Doubao API reference, replace placeholder URLs with verified official endpoints, avoid sending secrets or private files in prompts, and do not grant write or broad shell/file permissions unless you specifically need and approve them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:152
Finding

User Content Is Sent to an Unverified Placeholder API Endpoint

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:152-163
Vulnerability Type: Unverified external transmission of user-provided content
Risk Level: Medium

Code Snippet

javascript
const sessionId = process.env.DOUBAO_SESSIONID;
// ...
async function chat(message) {
  const resp = await fetch('https://api.example.com/v1/chat/completions', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      model: 'doubao-pro',
      messages: [{ role: 'user', content: message }]
    })
  });

Technical Analysis

The template serializes the caller-supplied message and transmits it to https://api.example.com/v1/chat/completions. The declared functionality requires network communication with a language-model service, but the destination is a generic placeholder rather than a documented and verified official Doubao API endpoint.

Users may reasonably expect prompts to be handled by Doubao based on the Skill's name and description. Following this template could instead disclose conversation content to an unintended destination or encourage users to substitute an endpoint without validating its ownership, transport security, privacy policy, or data-retention behavior.

The environment variable DOUBAO_SESSIONID is read but is not attached to the displayed request. Therefore, the reviewed content does not establish credential exfiltration. The confirmed exposure is the transmission of user-provided prompt content.

Attack Path

  1. A user invokes the Skill for a chat, summarization, or personal-knowledge task.
  2. The Agent follows the provided JavaScript or equivalent curl template.
  3. Potentially sensitive user content is placed in the messages request field.
  4. The content is transmitted to the hardcoded placeholder hostname.
  5. If the destination is operational, redirected, proxied, or replaced without proper validation, ...[truncated 462 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the placeholder hostname with the documented official Doubao API endpoint.
  • Allow outbound requests only to an explicit HTTPS hostname allowlist.
  • Verify endpoint ownership, certificate validation, request authentication, privacy terms, and data-retention behavior.
  • Clearly disclose that prompt content and any included conversation history leave the local environment.
  • Require explicit confirmation before transmitting files, personal information, credentials, or other sensitive content.
  • Apply data minimization by sending only the messages required for the current request.
  • Do not permit arbitrary endpoint overrides unless they are validated against a trusted allowlist.
  • Add an actual authentication header only according to official API documentation, and never log or return the credential.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:16
Finding

Declared Tool Permissions Exceed the Skill's Minimum Functional Requirements

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-23
Vulnerability Type: Excessive and ambiguous tool permissions
Risk Level: Medium

Code Snippet

yaml
tools:
- - read
- exec
homepage: https://skillhub.cn
pricing_tier: L3
pricing_model: per_use
suggested_price: 29.9
tools: ["read", "write", "exec"]

Technical Analysis

The metadata contains two inconsistent tools declarations and ultimately requests read, write, and exec. The documented core workflow only needs to submit HTTP requests to a language-model API. Although exec can run the illustrated curl command, unrestricted filesystem writing is not necessary for that workflow. General filesystem reading is also unnecessary unless the user explicitly chooses a local file as input.

Duplicate declarations create additional ambiguity because YAML parsers may reject duplicate keys, preserve the first value, or retain the last value. A platform using the final declaration could grant all three permissions.

Broad shell execution and filesystem access expand the consequences of malicious prompt content, instruction confusion, or future changes to the Skill. A constrained HTTP capability would satisfy the declared network functionality with substantially less privilege.

Attack Path

  1. The Skill is installed or loaded by an Agent platform.
  2. The platform parses the final tools declaration and grants read, write, and exec.
  3. The Skill processes user-controlled conversation content while these capabilities are available.
  4. Adversarial input, a compromised external response, or unsafe future instructions influence the Agent to invoke an unnecessary tool.
  5. The Agent may read unrelated local files, modify files, or execute shell commands beyond the chat API task.

The reviewed file does not itself instruct the Agent to perform those harmful operations, so this is an excessive-privilege exposure rather than evidenc ...[truncated 523 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the duplicate tools declarations and define one unambiguous permission list.
  • Remove write, because the documented chat workflow does not require filesystem modification.
  • Do not grant general read; request access only to a user-selected file when file-based input is explicitly needed.
  • Replace unrestricted exec with a constrained HTTP-request tool that permits only the official API hostname, required HTTP method, and expected content type.
  • If shell execution cannot be avoided, use fixed command templates, prohibit user-controlled command interpolation, apply command allowlisting, and run in a restricted sandbox.
  • Require per-operation user approval for access to local files or shell execution.
  • Document the exact purpose and scope of every requested permission.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The summary explicitly presents the skill as a Chinese dialogue assistant, which imposes a language preference in the skill's natural-language behavior. The file does not offer user choice for language or explain a justified locale restriction such as region-specific compliance requirements.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text is broad (AI model calling, Agent orchestration, LLM applications) and lacks narrow trigger conditions or exclusions. In practice, this makes accidental invocation more likely and increases the chance that the skill is used outside its safe intended scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest grants write and exec to a skill whose stated purpose is mainly documentation and API calling guidance. Excess permissions increase the blast radius if the agent misinterprets prompts or if a downstream prompt-injection causes unintended file modification or command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown instructs users to send prompts and potentially callback URLs to an external API but does not clearly warn that user content and metadata will leave the local environment. In agent settings, this can result in unintentional transmission of sensitive prompts, conversation history, or internal URLs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The curl example instructs making an external POST request containing user content to a remote API. Although this is core to the skill's purpose, it still creates a data-exfiltration path if agents use it automatically or with sensitive input.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

bash
# 对话补全请求
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "model": "doubao-pro",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

{"role": "user", "content": "今天北京天气怎么样？"} ] }'
"https://api.example.com/v1/chat/completions"

text

**输入**: 用户提供能力一：对话补全接口所需的指令和必要参数。

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

{"role": "user", "content": "今天北京天气怎么样？"} ] }'
"https://api.example.com/v1/chat/completions"

text

**输入**: 用户提供能力一：对话补全接口所需的指令和必要参数。

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill is presented as a conversational/API integration guide, but it documents generic input_params handling with create/query/export operations that are not scoped to the stated chat-completion purpose. In an agent context with exec and write available, this ambiguity can cause the model to overgeneralize and perform broader actions than the user intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example system message says '你是一个友好的中文助手', which directs the assistant to operate specifically in Chinese. This is a language policy constraint embedded in the skill content without any visible opt-in or alternative locale handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The multi-turn dialogue section again claims support for generic create/query/export operations, which exceeds normal conversation-history management. This creates scope creep that can mislead an agent into treating the skill as a general-purpose operator rather than a bounded API usage guide.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This quick-start curl command encourages immediate external transmission without emphasizing privacy or approval requirements. In agent environments, convenience examples can be executed reflexively, causing unintended disclosure of user data to remote services.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

第二步：发送首次对话

bash
# 使用 curl 快速测试
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The sample code performs an external HTTP request using user-supplied message content and environment-based credentials. In this skill context, outbound transmission is expected, but it remains security-relevant because prompts, conversation data, and possibly sensitive context may be sent to a third-party endpoint if invoked without explicit consent and endpoint validation.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
const sessionId = process.env.DOUBAO_SESSIONID;
// ...
async function chat(message) {
  const resp = await fetch('https://api.example.com/v1/chat/completions', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The sample code performs an external HTTP request using user-supplied message content and environment-based credentials. In this skill context, outbound transmission is expected, but it remains security-relevant because prompts, conversation data, and possibly sensitive context may be sent to a third-party endpoint if invoked without explicit consent and endpoint validation.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
const sessionId = process.env.DOUBAO_SESSIONID;
// ...
async function chat(message) {
  const resp = await fetch('https://api.example.com/v1/chat/completions', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The prompt example defines the assistant as '一个专业的中文助手', again fixing the language to Chinese instead of allowing user-selected language. This creates a natural-language locale restriction without opt-in or a clearly justified regional limitation.

Content

No source excerpt is available for this finding.