ClawHub
Back to skill

Security audit

Tianapi Vehiclelimit - 城市车辆限行查询

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward TianAPI vehicle-restriction lookup tool, with credential-handling caveats but no evidence of hidden or unrelated behavior.

Install only if you are comfortable giving the skill a TianAPI key for vehicle-limit lookups. Prefer setting TIANAPI_VEHICLELIMIT_KEY in a protected environment or secret manager, avoid passing real keys on the command line, keep any scripts/.env file private, and use a dedicated TianAPI key with usage limits if possible.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_vehiclelimit.py:78
Finding

API Credential Transmitted in URL Query String

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:29
Finding

Documentation Encourages API Key Exposure Through Command Arguments and Unprotected Files

Content
View full analysis
scripts/.env # Method 3: Command-line argument python3 scripts/fetch_vehiclelimit.py --key your_api_key --city Beijing ``` ```bash # Query by city name python3 scripts/fetch_vehiclelimit.py --city Beijing # Query by city code python3 scripts/fetch_vehiclelimit.py --code 110100 ``` ### Technical Analysis The documentation recommends supplying the API key through a command-line argument. Command-line secrets can be exposed through: - Shell history - Process listings available to other local users or monitoring agents - Terminal session recording - Automation and CI/CD command logs - Diagnostic reports that capture process arguments The suggested `.env` creation command also relies on the user's current `umask` and does not explicitly create the file with restrictive permissions. On a shared system, an overly permissive configuration could allow another user or process to read the credential. Additionally, the later positional `` examples do not match the implementation, which accepts the key only through `--key`. This inconsistency may lead users to repeat or modify commands containing the secret during troubleshooting, increasing the chance that the credential is retained in command histories or logs. ### Attack Path #### Command-Line Exposure 1. A user follows the documentation and invokes the script with `--key SECRET`. 2. The shell records the command in its history, or a local process-monitoring facility captures the process arguments. 3. Another user, administrator, support operator, monitoring integration, or compromised local process reads the retain ...[truncated 892 chars]
Remediation
View remediation
scripts/.env ``` 4. Ensure `scripts/.env` is excluded from version control and packaging. 5. Warn users not to place real credentials in shell history, screenshots, issue reports, or CI logs. 6. Correct the usage examples so that they match the implemented interface. Prefer: ```bash export TIANAPI_VEHICLELIMIT_KEY='your_api_key' python3 scripts/fetch_vehiclelimit.py --city Beijing python3 scripts/fetch_vehiclelimit.py --code 110100 ``` 7. Advise users to rotate any key previously exposed through process arguments, logs, or permissively readable files. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
Env Config:
    export TIANAPI_VEHICLELIMIT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_VEHICLELIMIT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
Env Config:
    export TIANAPI_VEHICLELIMIT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_VEHICLELIMIT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_vehiclelimit.py (reported line 17)May include surrounding context.

python
Env Config:
    export TIANAPI_VEHICLELIMIT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_VEHICLELIMIT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_vehiclelimit.py (reported line 37)May include surrounding context.

python
Env Config:
    export TIANAPI_VEHICLELIMIT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_VEHICLELIMIT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_vehiclelimit.py (reported line 42)May include surrounding context.

python
Env Config:
    export TIANAPI_VEHICLELIMIT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_VEHICLELIMIT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_vehiclelimit.py (reported line 51)May include surrounding context.

python
Env Config:
    export TIANAPI_VEHICLELIMIT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_VEHICLELIMIT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_vehiclelimit.py (reported line 52)May include surrounding context.

python
if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents and implies use of environment variables, local files (.env), and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may invoke capabilities broader than users or platform policy expect, increasing the risk of unintended secret access and network use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation shows the API key embedded directly in URL query strings and command-line arguments without any warning about exposure. Secrets passed this way can leak via shell history, process listings, logs, browser history, proxy logs, or telemetry, making credential compromise much more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.