Security audit

Byted Security Llmscanner

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated security-evaluation purpose, but it handles credentials and evaluation data with unsafe transport and local secret practices that require review before installation.

Install only in a controlled environment after reviewing the scripts. Prefer fixing TLS validation before use, avoid putting real API keys on the command line, restrict permissions on config.ts and the data cache directory, and clear cached tokens/results when no longer needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code explicitly sets `rejectUnauthorized: false` on the HTTPS agent, which disables TLS certificate validation for the `CreateModel` API call. This allows a man-in-the-middle attacker or malicious proxy on the network path to intercept or modify the request and response, including the bearer token and `ApiKey` being transmitted in this security-sensitive asset-creation workflow.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: All backend API calls use an HTTPS agent with rejectUnauthorized: false, which disables certificate validation and defeats TLS server authentication. In this tool's context, requests carry a bearer token and fetch sensitive internal resource inventories, so a man-in-the-middle attacker could intercept credentials, read responses, or tamper with returned assets/scenarios.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The script saves complete remote inventory data to local cache files even when the user requested only a filtered subset. This can expose more metadata than necessary on disk and increase local data-retention and least-privilege risk, especially on shared workstations or CI runners.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The code explicitly sets `rejectUnauthorized: false` on the HTTPS agent, disabling TLS certificate validation for the UpdateAgent API call. This makes the connection vulnerable to man-in-the-middle interception and tampering, which is especially dangerous here because the request carries a bearer token and agent asset data that may include sensitive configuration such as API keys in `ChatVars`.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The code creates an HTTPS agent with rejectUnauthorized set to false, which disables TLS certificate validation for outbound API calls. This allows a man-in-the-middle attacker to intercept or modify traffic, including the bearer token and model API key sent by this script; in this asset-management context, that materially increases risk because the script handles sensitive credentials and performs state-changing updates.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README instructs users to store platform credentials directly in a local config.ts file, including username and password material, without any warning about secret management, file permissions, encryption, or exclusion from version control. This creates a realistic risk of credential disclosure through source control, backups, logs, shared workspaces, or accidental copying of the skill directory.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill auto-triggers on broad keywords like '创建资产', '发起测评', and '查询资源' without clear scoping, confirmation, or disambiguation. In an agent environment, this can cause unintended execution of operational scripts, especially because the documented actions create assets, update configurations, and launch evaluation tasks against external systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation instructs users to pass API keys directly on the command line when creating or updating model assets. Command-line secrets are commonly exposed through shell history, process listings, terminal logs, and agent telemetry, making credential leakage a realistic risk in exactly the kind of automated environment this skill targets.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The agent asset examples similarly pass sensitive platform credentials via '--api_key=...' flags, which are vulnerable to disclosure through process inspection and command logging. Because this skill is intended for end-to-end security evaluation workflows, it is likely to run in shared or instrumented environments where such leakage is especially dangerous.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script includes raw question/prompt and answer/response content from task data directly in the generated report. In this skill’s context, those fields can contain sensitive prompts, model outputs, proprietary evaluation corpora, or unsafe/generated content, so echoing them without redaction, consent controls, or warning can lead to unintended disclosure via logs, terminals, screenshots, or copied reports.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The code authenticates with a remote service using a username and password while explicitly disabling TLS certificate validation via `rejectUnauthorized: false`. This permits man-in-the-middle interception or impersonation of the API endpoint, allowing theft of credentials and session tokens and tampering with responses. In a security assessment tool that handles model/agent evaluation workflows, compromised authentication or falsified task data is especially dangerous because users are likely to trust the results.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script prints the full `chatVars` object to stdout, and the example usage shows values like `--api_key=sk-xxx`, indicating these fields may contain secrets such as API keys or tokens. In a security assessment workflow, stdout is often captured by shell history, CI logs, terminal recordings, or centralized log systems, so exposing unmasked credentials can lead to credential leakage and downstream compromise of connected agent platforms.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The code explicitly creates an HTTPS agent with rejectUnauthorized: false, which disables TLS certificate validation for the CreateRedTeamingTaskBatch request. This allows a man-in-the-middle attacker or malicious proxy on the network to intercept or modify authenticated API traffic, including bearer tokens and task creation parameters. In a security assessment tool, this is especially dangerous because it undermines trust in the integrity and confidentiality of evaluation operations.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The repeated request path for ListRedTeamingTaskPage also disables certificate verification with rejectUnauthorized: false. This means task query responses can be spoofed or altered in transit, causing the script to trust attacker-controlled data about created security testing tasks while also exposing the bearer token. Because this tool manages security evaluation workflows, tampered responses could mislead operators about task existence, status, or results.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The code explicitly disables TLS certificate validation via rejectUnauthorized: false, which allows man-in-the-middle interception of HTTPS traffic. Because this request carries a Bearer token and creates security evaluation tasks against a remote service, an attacker on the network path could impersonate the server, steal credentials, or tamper with task creation responses.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The request sends a bearer token over HTTPS while explicitly disabling TLS certificate verification via rejectUnauthorized: false, which permits man-in-the-middle interception by any attacker able to tamper with network traffic. The same flow also caches retrieved data locally, increasing exposure of potentially sensitive inventory metadata if the cache is readable by other local users or processes.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: This authenticated model-list retrieval repeats the same insecure HTTPS configuration with rejectUnauthorized: false, allowing interception of the bearer token and response data by a network attacker. Local caching of the returned asset inventory further broadens the confidentiality risk if endpoint protections or file permissions are weak.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The agent-list API call also disables TLS validation, so authenticated traffic can be spoofed or intercepted despite using HTTPS. Because this tool enumerates internal agent assets for a security-assessment platform, compromised transport or cache contents could expose sensitive environment inventory and enable follow-on targeting.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The OpenClaw retrieval path has the same core issue: bearer-authenticated HTTPS requests are made with certificate validation turned off, enabling man-in-the-middle attacks and tampering with returned data. Caching the fetched results locally can leak asset details to other local actors and compounds the sensitivity because this skill manages security-evaluation resources.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The code sets `rejectUnauthorized: false` for HTTPS requests when querying task status, which disables TLS certificate verification. This allows an active man-in-the-middle attacker to intercept or modify authenticated API traffic, potentially exposing bearer tokens and falsifying task status/results.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The paginated result-download path also disables TLS certificate verification, exposing potentially large volumes of evaluation data and the bearer token to interception or tampering. Because this path retrieves and then persists analysis data locally, a MITM attacker could inject forged results that influence downstream analysis.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script logs `ChatVars` directly to stdout, and the usage example shows sensitive values like `--api_key=sk-xxx`, making credential exposure likely in normal use. Secrets printed to terminal output can be captured by shell history workflows, CI logs, process supervisors, or centralized log collectors, leading to unauthorized access to downstream platforms.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification, suspicious.potential_exfiltration

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:159

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/analyze_rt_task.ts:36

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/common.ts:106

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/create_asset_agent.ts:37

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/create_asset_model.ts:75

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/create_rt_task.ts:29

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/create_task.ts:32

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/fetch_lists.ts:100

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/list_agent_platforms.ts:27

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/list_resources.ts:102

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/list_rt_scenarios.ts:27

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/run_analysis.ts:52

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/update_asset_agent.ts:39

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/src/update_asset_model.ts:31

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/src/common.ts:84