ClawHub
Back to skill

Security audit

Company Info - 工商信息查询

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised TianAPI company lookup, but its instructions and script can expose the user's API key through command-line use, a plaintext .env file, and URL query parameters.

Review before installing. Prefer providing TIANAPI_COMPANY_KEY through your runtime environment or a secret manager, avoid putting the key in shell commands or scripts/.env, use a dedicated low-privilege TianAPI key if available, and do not query confidential company targets unless sending them to TianAPI is acceptable.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_company-info.py:75
Finding

API Key Exposure Through URL Query Parameters and Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/fetch_company-info.py:75-80, scripts/fetch_company-info.py:105, and SKILL.md:24-30,43
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code

python
params = {
    "key": self.api_key,
    "com": com.strip()
}
query_string = urllib.parse.urlencode(params)
url = f"{API_ENDPOINT}?{query_string}"

The script also accepts the API key through the --key command-line option, and the documentation recommends invoking the script with the secret directly on the command line. It additionally documents storing the key in a plaintext scripts/.env file without requiring restrictive file permissions.

Technical Analysis

The API key is placed directly in the request URL as a query parameter. Although the endpoint uses HTTPS, HTTPS only protects the request while it is in transit. URLs may still be captured by the API provider, reverse proxies, monitoring infrastructure, debugging output, or request logs. Any component that records the complete request target can retain the credential.

Command-line transmission introduces an additional local exposure path. Depending on the operating system and shell configuration, arguments may be retained in shell history or temporarily visible through process-inspection facilities. The documented plaintext .env configuration can also expose the key to other local users or processes if the file is created with permissive permissions.

Sending the company identifier and API key to TianAPI is necessary for the Skill's declared remote company-information lookup. The outbound request is limited to the documented provider and no transmission to an unrelated destination was identified. However, the credential-handling methods exceed the minimum safe exposure needed to perform that request.

Attack Path

  1. A user follows the documentation and supplies the TianAPI key through the --key comm ...[truncated 1146 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the documented recommendation to pass API keys through command-line arguments and consider removing the --key option entirely.
  2. Prefer TIANAPI_COMPANY_KEY supplied through a managed secret store or a narrowly scoped runtime environment.
  3. If .env support remains necessary, document and enforce restrictive file permissions such as 0600. Ensure the file is excluded from source control.
  4. Use an authorization header instead of a query parameter if TianAPI supports that authentication method.
  5. If query-string authentication is required by the provider, ensure URLs are never written to application logs, exception reports, telemetry, or debugging output.
  6. Apply strict redirect handling so credentials cannot be forwarded to an unexpected origin.
  7. Use a dedicated, least-privileged TianAPI key restricted to the company-information API when provider controls permit it.
  8. Rotate the key immediately if it has previously appeared in command history, logs, shared terminal output, or a publicly accessible .env file.
  9. Correct the positional-argument example in SKILL.md:43, which does not match the script's required --key and --com options.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The skill recommends storing the API key in a local scripts/.env file and elsewhere suggests passing the key on the command line. Both patterns materially increase secret exposure risk: .env files are often accidentally committed or read by other tooling, and CLI arguments may be captured in shell history, process listings, or logs.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_COMPANY_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_COMPANY_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This line explicitly instructs users to write the API key into scripts/.env, a plaintext secret storage pattern that is frequently exposed through source control, backups, or local file access. In the context of an agent skill with file-read capability, plaintext local secret storage is more dangerous because adjacent tooling may inadvertently ingest or disclose the file.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export TIANAPI_COMPANY_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_COMPANY_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_company-info.py --key 你的APIKey --com 腾讯

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_company-info.py (reported line 14)May include surrounding context.

python
Env Config:
    export TIANAPI_COMPANY_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_COMPANY_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_company-info.py (reported line 34)May include surrounding context.

python
Env Config:
    export TIANAPI_COMPANY_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_COMPANY_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_company-info.py (reported line 39)May include surrounding context.

python
Env Config:
    export TIANAPI_COMPANY_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_COMPANY_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_company-info.py (reported line 48)May include surrounding context.

python
Env Config:
    export TIANAPI_COMPANY_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_COMPANY_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_company-info.py (reported line 49)May include surrounding context.

python
if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares executable/network-relevant capabilities through metadata and usage instructions, but does not define any explicit tool scope or allowed-tools boundary. This increases the chance that an agent runtime grants broader-than-necessary access to environment variables, local files, or outbound network operations when invoking the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs users to transmit company identifiers and an API key to a third-party external API but provides no warning about data handling, logging, retention, or whether the queried identifiers may be sensitive in the user's environment. In enterprise settings, even seemingly public company queries can reveal investigative intent, customer lists, or compliance-related lookups to the API provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code sends the user-supplied company identifier and API key to a remote third-party API endpoint, which is a network/data-transmission operation covered by the warning requirement for code files. While the module docstring explains usage, it does not explicitly disclose that the query is transmitted to TianAPI or warn about external data sharing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.