ClawHub
Back to skill

Security audit

Star Horoscope - 星座运势

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: query TianAPI for horoscope data, though users should avoid the less secure API-key examples.

Use a dedicated low-privilege TianAPI key, prefer the TIANAPI_STAR_KEY environment variable, avoid passing the key on the command line, do not commit scripts/.env, and assume horoscope requests are sent to TianAPI over the network.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_star.py:76
Finding

API Key Exposed in URL Query Parameters

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_star.py:108
Finding

API Key Accepted and Documented as a Command-Line Argument

Content
View full analysis
python3 scripts/fetch_star.py ``` The positional syntax in the documentation is inconsistent with the script's actual flag-based interface, but both designs place the secret in command-line arguments. ### Technical Analysis Command-line arguments may be saved in shell history and can be exposed through process inspection, audit logs, terminal recording, job schedulers, or command telemetry. Supporting environment-variable and `.env` loading is safer, but the available `--key` option and documented command examples encourage the insecure method. The script does not enumerate unrelated environment variables or transmit the key to undeclared destinations. The exposure is limited to how the required TianAPI credential is supplied. ### Attack Path 1. A user follows the documentation or invokes the script with `--key`. 2. The complete API key becomes part of the command line. 3. The shell records the command in its history, or a local process-monitoring or audit facility captures the arguments. 4. Another local user or an individual with access to those records retrieves the key. 5. The recovered key is used to make unautho ...[truncated 530 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill instructs users to write the API key into scripts/.env inside the project tree. Storing secrets in a repository-adjacent file increases the chance of accidental inclusion in version control, backups, archives, or unintended file reads by other tooling.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export TIANAPI_STAR_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_STAR_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_star.py 你的APIKey 狮子座

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
Env Config:
    export TIANAPI_STAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_STAR_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_star.py (reported line 14)May include surrounding context.

python
Env Config:
    export TIANAPI_STAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_STAR_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_star.py (reported line 34)May include surrounding context.

python
Env Config:
    export TIANAPI_STAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_STAR_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_star.py (reported line 39)May include surrounding context.

python
Env Config:
    export TIANAPI_STAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_STAR_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_star.py (reported line 50)May include surrounding context.

python
Env Config:
    export TIANAPI_STAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_STAR_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_star.py (reported line 51)May include surrounding context.

python
return env_val

        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents use of environment variables, local files, and outbound network access, but it does not declare any explicit tool scope or permissions boundary. That increases the risk of over-broad execution in hosts that rely on manifest-declared permissions, making review, sandboxing, and least-privilege enforcement harder.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill shows the API key being supplied directly as a command-line argument and embedded in a raw GET URL. Secrets passed this way can be exposed through shell history, process listings, logs, browser history, proxies, and server access logs, leading to credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits both user-supplied input and the API key to a third-party network service, but it does not clearly warn the user that their query and credential will leave the local environment. In an agent skill context, this matters because users may assume a local utility while the skill silently performs external data exfiltration of prompts/parameters and secrets to the remote API provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The usage guidance tells the operator to send user-provided astrology and date inputs to an external TianAPI service without clearly disclosing that this is third-party network transmission. This is a privacy and transparency issue, especially in environments where users may expect local-only processing.

Content

No source excerpt is available for this finding.