ClawHub
Back to skill

Security audit

Secure Api Toolkit Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible credential-proxy API tool, but it asks users to install and run a broad, persistent, unpinned proxy CLI for sensitive API traffic.

Install only if you trust the secure-proxy service and npm package publisher, are comfortable routing request URLs, headers, and bodies through that service, and can manage the persistent machine key and provider authorizations. Prefer a pinned reviewed package version, use sandbox or least-privilege API accounts, confirm each live request before authorization/replay, and avoid financial, regulated, internal, or production data unless your organization has approved this proxy.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:90
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 90
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash
npm install -g secure-proxy@latest

Technical Analysis

The skill instructs the agent or user to install the mutable latest release of the external secure-proxy npm package globally. Because latest is an npm distribution tag rather than an immutable version, the code installed in the future may differ from the code assessed when this skill was reviewed.

npm installation can execute package lifecycle scripts, including preinstall, install, and postinstall. A malicious package release, compromised publisher account, or compromised upstream distribution channel could therefore execute arbitrary commands during installation. Global installation also makes the resulting commands available system-wide for the current environment and increases the package's influence over later command invocations.

The dependency's source code and package metadata are not included in this project, so its behavior and the documentation's security claims cannot be independently verified from the audited artifact.

Attack Path

  1. An attacker compromises the npm package publisher account or upstream release process for secure-proxy.
  2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
  3. An agent or user follows the instruction in SKILL.md and runs npm install -g secure-proxy@latest.
  4. npm resolves the mutable tag to the malicious release.
  5. Malicious package lifecycle scripts execute during installation with the invoking user's privileges.
  6. The globally installed secure-curl or related commands may subsequently execute attacker-controlled logic while appearing to be legitimate tools.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the ...[truncated 753 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version, for example secure-proxy@X.Y.Z.
  2. Pin and verify the package integrity using a lockfile and registry-provided integrity hashes.
  3. Prefer a project-local installation over npm install -g so the dependency is isolated and reproducible.
  4. Review the package contents and lifecycle scripts before installation, including the resolved tarball and its cryptographic digest.
  5. Disable lifecycle scripts with --ignore-scripts when they are not required. If they are required, document and audit each script before execution.
  6. Use a trusted registry and consider allowlisting the exact package name, version, publisher, and integrity value.
  7. Run installation and the CLI under a least-privileged account or isolated environment without unnecessary credentials.
  8. Document a verified upgrade process instead of allowing automatic resolution to future releases.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation scope is broad enough to match ordinary development, debugging, and deployment tasks, which increases the chance the skill is invoked in situations where users did not intend to route requests through a credential proxy. In context, the skill has exec capability and can influence external API usage, so overbroad triggering raises the risk of unintended data transmission and execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill emphasizes that secrets do not reach the agent, but does not prominently disclose up front that requests and metadata are still sent through a third-party proxy service. Users may wrongly infer end-to-end privacy, when in fact URLs, headers, bodies, and metadata may be processed externally, which is significant for sensitive API traffic.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill states the free edition does not support audit logging, yet its capability descriptions promise returned logs and query/export-style operations. This inconsistency can mislead operators about what activity is recorded or retrievable, creating false assumptions about accountability, incident response, and data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The keyword coverage list contains fragmented and ambiguous terms that can cause accidental activation on loosely related prompts. Because the skill supports exec and external requests, ambiguous matching materially increases the chance of an agent selecting this tool without clear, informed user consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This line demonstrates sending an authenticated request to an external endpoint via secure-curl. While external transmission is the intended feature, it remains security-relevant because the skill encourages outbound network use with authorization placeholders that may trigger real credential injection and data disclosure to third parties.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

使用secure-curl替代curl，在凭据位置使用占位符：

bash
secure-curl https://api.user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This example again shows outbound authenticated API access through the proxy. Repeated examples without nearby warnings can desensitize users to the fact that live third-party services may be contacted and that request content may be exposed outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

bash
# 列出GitHub仓库
secure-curl https://api.user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# ...
# 发送Slack消息

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This example again shows outbound authenticated API access through the proxy. Repeated examples without nearby warnings can desensitize users to the fact that live third-party services may be contacted and that request content may be exposed outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

bash
# 列出GitHub仓库
secure-curl https://api.user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# ...
# 发送Slack消息

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The Stripe example is more sensitive because it targets a financial API and may involve customer data or account operations. Even with placeholder-based secret handling, transmitting such requests through a proxy increases privacy, compliance, and misuse risk if users are not clearly warned and constrained.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

-d '{"channel":"#general","text":"Hello!"}'

...

查询Stripe客户

secure-curl https://api.stripe.com/v1/customers?limit=5
-H "Authorization: Bearer {{STRIPE_SECRET_KEY}}"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The workflow explicitly initiates an external request that may trigger account authorization and provider linkage. That behavior is expected, but it is security-sensitive because it starts a trust flow with an external service and may expose metadata about the attempted API access.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

bash
# 首次调用返回授权链接
secure-curl https://api.user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# ...
# 等待授权完成（最长800秒）

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Polling an approval URL and replaying the request involves additional communication with the proxy service and can operationalize access once approval is granted. Without strong warnings, users may not appreciate that this step finalizes delegated access and can lead to real external actions.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

secure-wait https://secure-proxy.dev/approve/abc123xyz --timeout 800

...

授权后重放请求

secure-curl https://api.user/repos
-H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

text

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document makes a strong security claim that third-party API credentials never need to be exposed to the agent or stored locally, but later instructs users to set an API key via an environment variable. That contradiction can cause users or agents to fall back to direct secret handling, undermining the core security model and potentially exposing credentials through process environments, shell history, logs, or downstream tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The display name, summary, and primary description are presented in Chinese, and the file does not state that users may choose another language. For a general-purpose skill intended for multiple agent platforms, this can be a locale policy issue if it effectively constrains interaction language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.