ClawHub
Back to skill

Security audit

tripclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent TripClaw import helper, but it exposes a sensitive API key through documented command-line usage and includes broader account-changing API documentation than its import-only purpose needs.

Install only if you are comfortable sending detailed itinerary data to TripClaw. Prefer setting TRIPCLAW_API_KEY in the environment and avoid using --api-key on the command line; review the broader API reference before letting an agent perform anything beyond importing a trip.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/import_trip.py:166
Finding

TripClaw API Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/import_trip.py:166-170, with insecure usage documented at SKILL.md:116
Vulnerability Type: Command-line credential exposure
Risk Level: Medium

Vulnerable Code

scripts/import_trip.py:166-170:

python
parser.add_argument(
    "--api-key", "-k",
    type=str,
    help="TripClaw API Key（未指定则从 TRIPCLAW_API_KEY 环境变量读取）"
)

The resulting argument is selected as the authentication credential at scripts/import_trip.py:181-182:

python
# 获取 API Key
api_key = args.api_key or get_api_key()

SKILL.md:116 explicitly recommends passing the credential through this option:

bash
python3 scripts/import_trip.py --api-key "$TRIPCLAW_API_KEY" --data '<trip-json-data>'

Technical Analysis

Command-line arguments are commonly observable through local process-inspection interfaces, administrative monitoring systems, endpoint telemetry, audit records, diagnostic tools, and process launch logs. When the shell expands $TRIPCLAW_API_KEY, the plaintext bearer token becomes part of the process argument vector.

This exposure is unnecessary because the script already supports retrieving the credential directly from the TRIPCLAW_API_KEY environment variable. Supporting and documenting --api-key therefore increases credential exposure beyond the minimum required for the declared trip synchronization functionality.

The affected credential is transmitted to the documented TripClaw endpoint as a bearer token. The network transmission itself is necessary for the declared functionality and uses HTTPS; the vulnerability concerns how the credential is supplied locally, not its intended transmission to TripClaw.

Attack Path

  1. A user follows the documented example and invokes the script with --api-key "$TRIPCLAW_API_KEY".
  2. The shell expands the environment variable and places the plaintext API key in the Python process argume ...[truncated 1265 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key and -k command-line options from scripts/import_trip.py.

  2. Retrieve the credential exclusively from TRIPCLAW_API_KEY or an operating-system secret manager.

  3. If interactive credential entry is required, use Python's getpass.getpass() so the token is not echoed or placed in the process argument vector.

  4. Replace the documented command with one that does not include the credential:

    bash
    export TRIPCLAW_API_KEY="your-api-key-here"
python3 scripts/import_trip.py --data '<trip-json-data>'

  5. Retrieve the API key only after the --validate-only branch. Offline validation does not require authentication, so reading a secret in that execution path exceeds minimum privilege.

  6. Avoid printing, logging, or including the credential in exceptions and diagnostic output.

  7. Advise users who previously supplied the key through command-line arguments to review relevant process telemetry or shell tooling and rotate the key if exposure is suspected.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tainted flow: 'req' from os.environ.get (line 91, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/import_trip.py (reported line 99)May include surrounding context.

python
)
    
    try:
        with urllib.request.urlopen(req, timeout=timeout) as response:
            response_data = response.read().decode("utf-8")
            return json.loads(response_data)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs use of environment variables, file input, and outbound API calls, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity: an agent may invoke capabilities broader than the user or platform expects, increasing the risk of unintended secret access or network exfiltration when handling itinerary data and API keys.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and the entire skill documentation are written as if the skill operates in Chinese only, with no indication that users can opt into another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file documents a DELETE endpoint that removes a trip, but it provides no warning about the data-loss impact, reversibility, or need for confirmation before use. Under the markdown-specific warning criterion, destructive behavior affecting user data should be disclosed clearly in the skill description or documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains its docstring, CLI description, help text, and runtime messages entirely in Chinese, which imposes a specific language on users. The file does not offer any language/locale option or explain that the tool is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This JSON content uses Chinese-only names, descriptions, addresses, and activity text throughout, which can amount to a language/locale policy issue when no opt-in or justification is provided. The rule for natural-language policy violations applies to all file types and specifically covers forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest says this skill is for importing/syncing OpenClaw-generated road-trip itineraries into TripClaw, which implies a focused write/import flow. This file documents additional list, detail, update, delete, and webhook capabilities that go beyond a simple import/sync scope and suggest a broader trip-management surface.

Content

No source excerpt is available for this finding.