ClawHub
Back to skill

Security audit

glm-web-search

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its setup handles a paid API key and a runtime dependency in ways users should review before installing.

Install only if you are comfortable using GLM/BigModel for web search and supplying an API key. Prefer a version-pinned, reviewed `mcporter` install, store the key in a protected secret store or a file with owner-only permissions, avoid putting the key in a URL, and rotate any key previously configured this way.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:18
Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content
View full analysis
Remediation
View remediation
`. - Use a lockfile and package-manager integrity metadata where practical. - Install dependencies during a controlled setup phase rather than downloading and executing them during ordinary Skill invocation. - Remove `-y` so unexpected installation does not proceed silently. - Verify the package publisher, provenance, registry, and cryptographic integrity before execution. - Run the dependency in a restricted environment with only the filesystem and network access required for the search operation. - Establish an update-review process so dependency upgrades are assessed before the pinned version changes. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:30
Finding

GLM API Key Is Stored in Plaintext and Embedded in a URL

Content
View full analysis
/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('api_key', ''))" ``` It then instructs the agent to create that file without assigning restrictive permissions: ```bash mkdir -p ~/.openclaw/config cat > ~/.openclaw/config/glm.json << EOF { "api_key": "API密钥" } EOF ``` Finally, it embeds the API key in an MCP endpoint URL: ```bash mcporter config add glm-search \ --type sse \ --url "https://open.bigmodel.cn/api/mcp/web_search_prime/sse?Authorization=your-key" ``` ### Technical Analysis The API key is stored as plaintext in `~/.openclaw/config/glm.json`. The setup creates the directory and file without explicitly applying owner-only permissions such as `0700` for the directory and `0600` for the file. The resulting permissions therefore depend on the user's current `umask`. In an environment with permissive defaults or shared access, another local account or process may be able to read the credential. The key is also placed in the query string of an endpoint URL. Credentials in URLs may be copied into tool configuration, command history, process diagnostics, proxy logs, server access logs, crash reports, telemetry, or troubleshooting output. TLS protects the URL while it is in transit but does not prevent disclosure through endpoint, client, intermediary, or diagnostic logging. Although the final section of the Skill states that authentication uses an `Authorization` header, the executable configuration example instead places `Authorization` in the URL query string. This mismatch encourages an insecure authentication method. ### Attack Path #### Local plaintext-file exposure 1. A user gives the agent a valid GLM API key ...[truncated 1441 chars]
Remediation
View remediation
~/.openclaw/config/glm.json <<'EOF' { "api_key": "REPLACE_SECURELY" } EOF chmod 600 ~/.openclaw/config/glm.json ``` - Do not place credentials in URL paths or query strings. - Configure authentication through an `Authorization: Bearer ` header, consistently with the authentication method documented later in the Skill. - Avoid passing secrets directly through command-line arguments when the tool supports protected environment variables, standard input, secret references, or credential providers. - Ensure `mcporter` configuration, logs, diagnostics, and telemetry redact authorization values. - Prevent the secret file from entering backups, support bundles, source control, or broadly readable synchronization systems unless it is encrypted and access-controlled. - Rotate any API key that has previously been configured through the documented URL method. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger conditions are very broad, covering ordinary requests for information or current events. This can cause the skill to activate in many routine situations, increasing the chance that users are steered into unnecessary external searches and credential setup when a local answer may have sufficed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs use of npx -y mcporter without pinning a specific version, which means the latest package version will be fetched and executed at runtime. This creates a supply-chain risk: a compromised or malicious upstream package update could run arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill reads and stores an API key from ~/.openclaw/config/glm.json without an explicit warning about credential sensitivity, storage persistence, or local exposure. Users may unknowingly place secrets in plaintext configuration files, which can be accessed by other local processes, backups, or accidental disclosures.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

The skill persists the API key under ~/.openclaw/config/glm.json, creating session persistence of a sensitive credential on disk. Persistent plaintext secrets increase exposure to other local users, malware, backups, and future unintended reuse beyond the current task.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

3.3 保存 API Key

bash
mkdir -p ~/.openclaw/config
cat > ~/.openclaw/config/glm.json << EOF
{
  "api_key": "API密钥"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instructions place the API key directly into the MCP server URL query string (?Authorization=your-key). Secrets embedded in URLs are especially risky because they may be logged by shells, tooling, proxies, browser history, process listings, or remote infrastructure, leading to credential leakage during transmission or diagnostics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The file presents the skill description and operational instructions exclusively in Chinese and does not indicate that another language is available on request. This can be a language policy issue when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.