ClawHub
Back to skill

Security audit

Saylove Get - 土味情话

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple TianAPI quote fetcher with some credential-handling cautions but no evidence of hidden, destructive, or unrelated behavior.

Install only if you are comfortable sending a TianAPI API key to TianAPI to fetch this content. Prefer TIANAPI_SAYLOVE_KEY from a secure environment or secret manager, avoid passing keys on the command line, and do not commit scripts/.env if you use it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/fetch_saylove.py:74
Finding

API Key Exposure Through URL Query Strings and Command-Line Arguments

Content
View full analysis
``` The script supports a command-line key through the `--key` argument. ### Technical Analysis The API key is embedded in the query component of an HTTPS URL. TLS protects the request from passive network interception, but it does not prevent the complete URL from being recorded by the destination service, reverse proxies, observability systems, debugging tools, exception telemetry, or other infrastructure with access to request metadata. Supplying an API key through a command-line argument also creates local exposure risks. Depending on the operating system and shell configuration, command arguments may be visible through process-inspection interfaces while the script is running and may remain in shell history after execution. The network request itself is necessary for the Skill's declared API-backed functionality and is restricted to the declared TianAPI HTTPS endpoint. The audit found no transmission of unrelated files, environment variables, or user data. The issue is therefore the credential transport mechanism rather than unauthorized network access. There is also a documentation inconsistency: the examples show a positional API key, while the implementation accepts `--key`. Although the documented positional form will normally fail argument parsing, users may adapt it to `--key`, which retains the command-line disclosure risk. ### Attack Path 1. A user follows the Skill ...[truncated 1216 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill documentation tells users to place the API key in a local scripts/.env file. Storing credentials in a workspace file increases the chance of accidental disclosure through source control, logs, debugging output, or other tools/skills that can read local files.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_SAYLOVE_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_SAYLOVE_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill also suggests passing the API key directly as a command-line argument. Command-line secrets are commonly exposed via shell history, process listings, telemetry, and logs, so other local users or systems may recover the key.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export TIANAPI_SAYLOVE_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_SAYLOVE_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_saylove.py 你的APIKey

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_saylove.py (reported line 13)May include surrounding context.

python
Env Config:
    export TIANAPI_SAYLOVE_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_SAYLOVE_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_saylove.py (reported line 33)May include surrounding context.

python
Env Config:
    export TIANAPI_SAYLOVE_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_SAYLOVE_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_saylove.py (reported line 38)May include surrounding context.

python
Env Config:
    export TIANAPI_SAYLOVE_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_SAYLOVE_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_saylove.py (reported line 49)May include surrounding context.

python
Env Config:
    export TIANAPI_SAYLOVE_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_SAYLOVE_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_saylove.py (reported line 50)May include surrounding context.

python
return env_val

        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs use of Python, environment variables, local file access (.env), and outbound network calls, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization gap: an agent/runtime may grant broader capabilities than users expect, making secret access and external data exfiltration harder to govern or audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file's user-facing description and help text are written in Chinese only, including operational guidance and error/help messaging. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or choice is offered.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code file performs an outbound HTTP request and includes the user's API key as a query parameter, which transmits credential material to an external service. Although the module docstring explains configuration, there is no runtime confirmation, user-facing notice, or explicit warning that the key will be sent over the network.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code documentation says the --key argument is optional and that environment variables are preferred, but Config._resolve_key actually gives CLI input highest priority, then environment variables, then .env. This is an active contradiction between inline help text and implemented behavior, even though the underlying capability is otherwise aligned with the skill's purpose.

Content

No source excerpt is available for this finding.