ClawHub
Back to skill

Security audit

Connector Hub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed connector toolkit, but it includes scripts that handle credentials and can mutate external services, with a concrete Baidu token-leak risk that users should review before installing.

Install only if you trust the publisher and will provide narrowly scoped credentials. Avoid running the Baidu Netdisk scripts until token redaction or safer auth handling is added, and review each mutating script before allowing an agent to post messages, upload files, create repos/MRs/issues, tickets, surveys, CRM leads, or email attachments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/L2-auth-storage-C17-baidu-list-files.py:27
Finding

Baidu Netdisk access token disclosed through request URLs and error output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/L2-auth-storage-C17-baidu-upload.py:40
Finding

Baidu Netdisk upload token may leak from multiple credential-bearing request URLs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (238)

Tainted flow: 'headers' from os.environ.get (line 31, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-docs-kb-C05-tencent-docs-create-doc.py (reported line 43)May include surrounding context.

python
"type": doc_type  # doc, sheet, slide
    }
    
    resp = requests.post(f"{API_BASE}/files", headers=headers, data=data)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-docs-kb-C06-kdocs-create-doc.py (reported line 37)May include surrounding context.

python
"type": doc_type
    }
    
    resp = requests.post(f"{API_BASE}/documents", headers=headers, json=payload)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-docs-kb-C07-notion-create-page.py (reported line 63)May include surrounding context.

python
"properties": properties
    }
    
    resp = requests.post(f"{API_BASE}/pages", headers=headers, json=payload)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-docs-kb-C07-notion-query-database.py (reported line 41)May include surrounding context.

python
if sorts:
        payload["sorts"] = sorts
    
    resp = requests.post(f"{API_BASE}/databases/{database_id}/query", headers=headers, json=payload)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 26, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-docs-kb-C08-lexiang-search-docs.py (reported line 38)May include surrounding context.

python
if kb_id:
        params["kb_id"] = kb_id
    
    resp = requests.get(f"{API_BASE}/search", headers=headers, params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 25, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-docs-kb-C09-iwiki-search.py (reported line 34)May include surrounding context.

python
"keyword": keyword
    }
    
    resp = requests.get(f"{API_BASE}/search", headers=headers, params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 25, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-docs-kb-C10-km-search.py (reported line 34)May include surrounding context.

python
"keyword": keyword
    }
    
    resp = requests.get(f"{API_BASE}/search", headers=headers, params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 25, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-docs-kb-C11-ima-search.py (reported line 34)May include surrounding context.

python
"keyword": keyword
    }
    
    resp = requests.get(f"{API_BASE}/search", headers=headers, params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'WEBHOOK_URL' from os.environ.get (line 13, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C12-feishu-send-card.py (reported line 63)May include surrounding context.

python
payload["timestamp"] = timestamp
        payload["sign"] = sign
    
    resp = requests.post(WEBHOOK_URL, json=payload)
    resp.raise_for_status()
    return resp.json()

Tainted flow: 'WEBHOOK_URL' from os.environ.get (line 13, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C12-feishu-send-post.py (reported line 59)May include surrounding context.

python
payload["timestamp"] = timestamp
        payload["sign"] = sign
    
    resp = requests.post(WEBHOOK_URL, json=payload)
    resp.raise_for_status()
    return resp.json()

Tainted flow: 'WEBHOOK_URL' from os.environ.get (line 13, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C12-feishu-send-text.py (reported line 62)May include surrounding context.

python
payload["timestamp"] = timestamp
        payload["sign"] = sign
    
    resp = requests.post(WEBHOOK_URL, json=payload)
    resp.raise_for_status()
    return resp.json()

Tainted flow: 'url' from os.environ.get (line 53, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C13-dingtalk-send-action-card.py (reported line 66)May include surrounding context.

python
}
    }
    
    resp = requests.post(url, json=payload)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'url' from os.environ.get (line 53, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C13-dingtalk-send-markdown.py (reported line 70)May include surrounding context.

python
}
    }
    
    resp = requests.post(url, json=payload)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'url' from os.environ.get (line 56, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C13-dingtalk-send-text.py (reported line 72)May include surrounding context.

python
if at_mobiles:
        payload["at"]["atMobiles"] = at_mobiles
    
    resp = requests.post(url, json=payload)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'WEBHOOK_URL' from os.environ.get (line 10, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C14-wecom-send-markdown.py (reported line 31)May include surrounding context.

python
}
    }
    
    resp = requests.post(WEBHOOK_URL, json=payload)
    resp.raise_for_status()
    return resp.json()

Tainted flow: 'WEBHOOK_URL' from os.environ.get (line 10, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C14-wecom-send-news.py (reported line 31)May include surrounding context.

python
}
    }
    
    resp = requests.post(WEBHOOK_URL, json=payload)
    resp.raise_for_status()
    return resp.json()

Tainted flow: 'WEBHOOK_URL' from os.environ.get (line 10, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-messaging-C14-wecom-send-text.py (reported line 38)May include surrounding context.

python
}
    }
    
    resp = requests.post(WEBHOOK_URL, json=payload)
    resp.raise_for_status()
    return resp.json()

Tainted flow: 'params' from os.environ.get (line 28, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-storage-C17-baidu-list-files.py (reported line 37)May include surrounding context.

python
"web": 1
    }
    
    resp = requests.get(API_BASE, params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'params' from os.environ.get (line 82, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-storage-C17-baidu-upload.py (reported line 47)May include surrounding context.

python
"rtype": rtype  # 1-重命名 2-覆盖 3-覆盖
    }
    
    resp = requests.post(f"{API_BASE}/precreate", params=params)
    resp.raise_for_status()
    pre_data = resp.json()

Tainted flow: 'params' from os.environ.get (line 64, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-storage-C17-baidu-upload.py (reported line 73)May include surrounding context.

python
"partseq": i
            }
            
            resp = requests.post(
                UPLOAD_API,
                params=params,
                files={"file": ("chunk", chunk)}

Tainted flow: 'params' from os.environ.get (line 82, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-storage-C17-baidu-upload.py (reported line 93)May include surrounding context.

python
"block_list": json.dumps(uploaded_blocks)
    }
    
    resp = requests.post(f"{API_BASE}/create", params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 26, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L2-auth-storage-C18-tencent-weiyun-list-files.py (reported line 35)May include surrounding context.

python
"path": path
    }
    
    resp = requests.get(f"{API_BASE}/files", headers=headers, params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 28, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L3-api-biz-services-C29-ctrip-search-flights.py (reported line 42)May include surrounding context.

python
if return_date:
        params["return_date"] = return_date
    
    resp = requests.get(f"{API_BASE}/flights/search", headers=headers, params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 28, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L3-api-biz-services-C29-ctrip-search-hotels.py (reported line 42)May include surrounding context.

python
if star:
        params["star"] = star
    
    resp = requests.get(f"{API_BASE}/hotels/search", headers=headers, params=params)
    resp.raise_for_status()
    
    return resp.json()

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/L3-api-biz-services-C30-qidian-cs-create-session.py (reported line 37)May include surrounding context.

python
"channel": channel
    }
    
    resp = requests.post(f"{API_BASE}/sessions", headers=headers, json=payload)
    resp.raise_for_status()
    
    return resp.json()