T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:31- Finding
Hardcoded Administrative API Tokens Expose Group Write Access
- Content
View full analysis
- Remediation
View remediation
Security audit
zeelin-claw-swarm
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed external chat integration, but it includes reusable admin posting tokens that could let anyone post or impersonate messages in multiple groups.
Do not use this skill as published unless the tokens have been revoked and replaced with per-user, least-privilege credentials supplied securely at runtime. Treat any message sent through it as going to an external public-facing service, review the destination and content before posting, and avoid enabling the heartbeat loop without strict limits and human approval.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill embeds live admin-level API tokens directly in documentation and code, giving any reader authenticated write access to external chat groups. This is a direct secret exposure and privilege delegation issue that can enable unauthorized posting, impersonation, abuse of trusted channels, and downstream social-engineering against humans or other agents.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill not only exposes privileged tokens but instructs the agent to use them for posting to external groups without clear consent, trust-boundary explanation, or privacy/integrity warning. This creates a high risk of unauthorized external actions and message disclosure, especially in agentic environments where users may not realize content will be transmitted off-platform.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 72% confidence
- Finding
The skill explicitly instructs the use of an HTTP POST request to send message content to an external service. External transmission is expected for a chat integration, but in this context it is security-relevant because the destination is third-party, public-facing, and paired with embedded privileged tokens, increasing the risk of unintended disclosure or unauthorized actions.
- Content
md ## Python Client > **⚠️ CRITICAL — Encoding Rule**: Always use `requests.post(..., json={...})` to send messages. **Never** use `urllib`, manual `json.dumps(...).encode()`, or string concatenation. The `json=` parameter in `requests` automatically handles UTF-8 encoding, which is required for Chinese and other non-ASCII characters. Using any other method will cause garbled text (mojibake) in the chat. ### Core Functions
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The markdown states that UTF-8 handling is required specifically for Chinese and centers usage around Chinese-named groups and Chinese-character correctness, but does not offer any language or locale choice to the user. This creates a language/locale constraint in the skill guidance without clear opt-in or a documented region-specific justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This code performs authenticated transmission of arbitrary sender names and message content to an external endpoint using hard-coded tokens. In combination with the exposed credentials, it provides a ready-to-use mechanism for unauthorized posting and impersonation into external groups, making the transmission path materially dangerous rather than merely functional.
- Content
md IMPORTANT: Use json= parameter (NOT data=) to ensure UTF-8 encoding. This is required for Chinese characters to display correctly. """ resp = requests.post( f"{BASE_URL}/messages", headers={"X-API-Key": TOKENS[group_slug]}, # Do NOT set Content-Type manually json={"senderName": sender_name, "content": content}, # json= handles UTF-8 automatically
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The heartbeat loop continuously reads external public messages and may auto-generate replies, effectively creating an unsupervised bidirectional bridge to an outside system. Without clear warning, user approval, rate/behavior constraints, or content filtering, this can leak context externally, amplify prompt injection from public messages, and create spam or reputational harm.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill documents access to an admin panel capable of creating groups and generating or revoking tokens, which expands the operational scope beyond simple chat participation. While it does not itself expose admin credentials, it normalizes privileged administration paths that are unnecessary for the stated skill purpose and could encourage misuse if an agent has broader ambient access.
- Content
Static analysis
No suspicious patterns detected.