ClawHub
Back to skill

Security audit

AI新闻资讯

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent TianAPI AI-news fetcher, but users should handle the required API key carefully because the docs and script use inconsistent variable names and include less-safe credential examples.

Install only if you are comfortable giving this skill a TianAPI API key. Prefer a protected environment variable, avoid passing the key on the command line, do not commit scripts/.env, and verify the correct variable name because the docs use TIANAPI_AI_NEWS_KEY while the script reads TIANAPI_AI_KEY.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_ai_news.py:87
Finding

API Credential Exposure Through URL Query Parameters and Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/fetch_ai_news.py:87-96; related usage guidance in SKILL.md:32-46 and SKILL.md:73
Vulnerability Type: Sensitive credential exposure through URL and process metadata
Risk Level: Medium

Vulnerable Code

python
params = {
    "key": self.api_key,
    "num": min(max(1, num), MAX_NEWS_LIMIT),
    "page": max(1, page),
}
if word:
    params["word"] = word.strip()

query_string = urllib.parse.urlencode(params)
url = f"{API_ENDPOINT}?{query_string}"

try:
    req = urllib.request.Request(url, headers={"User-Agent": "OpenClaw-Skill/1.0"})
    with urllib.request.urlopen(req, timeout=DEFAULT_TIMEOUT) as resp:

The documentation also recommends supplying credentials directly through the command line:

bash
python3 scripts/fetch_ai_news.py <API_KEY>
python3 scripts/fetch_ai_news.py <API_KEY> [num] [word] [page]

It additionally demonstrates embedding the key in a request URL:

bash
GET https://apis.tianapi.com/ai/index?key=YOUR_API_KEY&amp;word=大模型&amp;num=10&amp;page=1

Technical Analysis

The Skill legitimately requires a TianAPI credential to retrieve AI news, and the credential is sent only to the declared HTTPS endpoint, apis.tianapi.com. The outbound request is therefore necessary for the advertised functionality and is not evidence of malicious exfiltration.

However, the credential is included in the URL query string. HTTPS protects the request in transit, but query strings can still be recorded by destination-server access logs, reverse proxies, monitoring products, exception reports, debugging tools, and local request instrumentation. Anyone with access to such records may recover the API key.

Supplying the key as a command-line argument creates an additional exposure channel. Command arguments may be retained in shell history or exposed to local process-inspection mechanisms while the process is running. T ...[truncated 1462 chars]

Remediation
View remediation

Remediation Suggestions

  1. If TianAPI supports header-based authentication, transmit the key in an authorization header rather than in the query string.

  2. If the service requires query-string authentication, avoid logging the constructed URL and configure clients, proxies, observability systems, and server logs to redact the key parameter.

  3. Remove examples that encourage users to place credentials directly in command arguments. Prefer the environment variable or a protected credential store.

  4. Align the documented environment variable with the implementation. The metadata and documentation use TIANAPI_AI_NEWS_KEY, while the script reads TIANAPI_AI_KEY.

  5. When supporting .env, require restrictive permissions, such as:

    bash
    install -m 600 /dev/null scripts/.env
printf '%s\n' 'TIANAPI_AI_KEY=REPLACE_WITH_KEY' &gt; scripts/.env
chmod 600 scripts/.env

  6. Ensure .env is excluded from version control and packaging.

  7. Redact credentials from exceptions, debug output, telemetry, and future request tracing.

  8. Advise affected users to rotate any key that may already have appeared in shell history, process logs, proxy logs, or monitoring records.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose presents a simple news-fetching skill, but the behavior includes undeclared external network access and credential handling through CLI, environment variables, and .env files without matching permission declarations. This mismatch can mislead users and automated agents about data flow and trust boundaries, increasing the risk of unintended credential exposure or unauthorized external communication.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The documentation instructs users to write the API key into scripts/.env, which creates a plaintext credential file in the project tree that may be accidentally committed, copied, or read by broader tooling than intended. In the context of a skill that already reads local files and uses undeclared capabilities, this increases the chance of credential exposure.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export TIANAPI_AI_NEWS_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_AI_NEWS_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_ai_news.py 你的APIKey 10 大模型 1

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
Env Config:
    export TIANAPI_AI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_AI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ai_news.py (reported line 20)May include surrounding context.

python
Env Config:
    export TIANAPI_AI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_AI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ai_news.py (reported line 40)May include surrounding context.

python
Env Config:
    export TIANAPI_AI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_AI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ai_news.py (reported line 45)May include surrounding context.

python
Env Config:
    export TIANAPI_AI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_AI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ai_news.py (reported line 54)May include surrounding context.

python
Env Config:
    export TIANAPI_AI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_AI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_ai_news.py (reported line 55)May include surrounding context.

python
if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares executable behavior that uses environment variables, reads local files such as scripts/.env, and performs outbound network requests, but it does not declare a corresponding tool/permission scope. This weakens least-privilege enforcement and can cause an agent platform or reviewer to underestimate what the skill is able to access at runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation tells users to pass the API key directly as a command-line argument, which commonly exposes secrets through shell history, process listings, logs, and telemetry. In agent or shared-host environments this can leak the credential to other local users or monitoring systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The natural-language instructions and usage guidance are presented primarily in Chinese, which imposes a specific language on users without offering an alternative or opt-in. This can violate language/locale policy when a skill does not explicitly provide user choice or justify the locale restriction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The module docstring says users can run the script with '--json' for agent-friendly JSON output, but argparse never adds a '--json' option. The implementation later checks 'args.json', so the documentation and code actively diverge and the advertised mode cannot work as written.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest describes an AI news aggregation/search skill, but does not mention credential discovery from process environment or local files. While network access is expected for fetching news, secret-loading from environment and .env files is an additional capability that is not justified by the stated user-facing purpose alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code performs an HTTP request that includes the user's API key as a query parameter, which transmits credential material to an external service. Although the script's purpose is to fetch news, there is no explicit user-facing disclosure at the point of use, log message, or warning comment indicating that the key will be sent over the network.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.