ClawHub
Back to skill

Security audit

Lajifenlei - 垃圾分类

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward TianAPI waste-classification lookup skill, with credential-handling caveats users should understand before use.

Use a dedicated, low-privilege TianAPI key if possible. Prefer the documented environment variable over passing the key on the command line, avoid committing scripts/.env, and do not submit sensitive or personal text as item names because queries are sent to TianAPI.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis
``` The implementation accepts the credential through a command-line option: ```python parser.add_argument("--key", help="API Key (optional, environment variable preferred)") ``` ### Technical Analysis The Skill explicitly recommends passing the TianAPI key as a command-line argument. Command-line secrets may be retained in interactive shell history and may be visible in process inspection interfaces while the process is running. Depending on operating-system configuration, other local users, monitoring agents, diagnostic tools, or process supervisors may be able to record these arguments. Passing a credential in this manner is not necessary for the Skill's waste-classification functionality. The implementation already supports the dedicated `TIANAPI_LAJIFENLEI_KEY` environment variable and a local `.env` file. Therefore, documenting and supporting routine command-line credential entry exceeds the minimum secret exposure required for the declared operation. The documentation also uses positional arguments, while the implementation expects `--key` and `--word`. This mismatch is primarily a correctness defect, but it may encourage repeated commands containing the secret while users troubleshoot execution. ### Attack Path 1. A user follows the documented command and enters the TianAPI key directly in a terminal. 2. The shell records the command, including the key, in its history file, or a local process-monitoring ...[truncated 1020 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_lajifenlei.py:100
Finding

API Key Transmitted in an HTTP URL Query String

Content
View full analysis
&word= ``` Authentication with TianAPI is necessary for the declared waste-classification functionality, and the request is sent over HTTPS to the documented provider. No hidden endpoint or unrelated data recipient was identified. HTTPS protects the URL from ordinary passive network observers while it is in transit. However, HTTPS does not prevent the complete request URL from being recorded after TLS termination. Query strings are commonly retained by application servers, API gateways, reverse proxies, observability platforms, tracing systems, error reports, and debugging tools. Consequently, placing a reusable credential in the URL increases its exposure relative to an authorization header or, where supported by the API protocol, a request body. The queried item name is also transmitted to TianAPI. That transmission is expected a ...[truncated 1541 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The skill instructs users to place an API key in an environment variable, a local .env file, or directly on the command line. While storing a secret in an environment variable can be acceptable, recommending command-line passing and writing secrets into a project-local file increases the chance of credential disclosure through shell history, process listings, accidental commits, or workspace leakage.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_LAJIFENLEI_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_LAJIFENLEI_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The documentation explicitly advises creating scripts/.env containing the API key, which places credentials in the workspace near executable code. This is dangerous because such files are commonly read by tools, copied into artifacts, or accidentally committed, enabling unauthorized use of the API key and possible pivoting if users reuse secrets or store additional credentials similarly.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export TIANAPI_LAJIFENLEI_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_LAJIFENLEI_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_lajifenlei.py 你的APIKey

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lajifenlei.py (reported line 23)May include surrounding context.

python
Env Config:
    export TIANAPI_LAJIFENLEI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_LAJIFENLEI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lajifenlei.py (reported line 51)May include surrounding context.

python
Env Config:
    export TIANAPI_LAJIFENLEI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_LAJIFENLEI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lajifenlei.py (reported line 56)May include surrounding context.

python
Env Config:
    export TIANAPI_LAJIFENLEI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_LAJIFENLEI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lajifenlei.py (reported line 65)May include surrounding context.

python
Env Config:
    export TIANAPI_LAJIFENLEI_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_LAJIFENLEI_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lajifenlei.py (reported line 66)May include surrounding context.

python
if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents use of network access, environment variables, and local file interaction but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may execute the skill with broader capabilities than intended, reducing auditability and increasing the blast radius if the skill or downstream script is modified or abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script transmits both the queried item name and the API key to a third-party service, but does not explicitly warn users that their input leaves the local environment. In an agent/automation context, this can cause unintended data disclosure if sensitive terms are passed as queries or if users assume the tool is purely local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains natural-language instructions, help text, and user-facing messaging exclusively in Chinese, but it does not indicate that the skill is intended only for Chinese-speaking users or provide any opt-in for language selection. Under the policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring documents a '--json' usage mode for agent-friendly output, but the argument parser only defines --key, --word, --num, --mode, and --page. Later, the code accesses 'args.json', which means the documented mode does not actually exist and the implementation contradicts the stated interface.

Content

No source excerpt is available for this finding.