ClawHub
Back to skill

Security audit

Weibo Hot - 微博热搜榜

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow Weibo hot-search fetcher, but users should handle the TianAPI key carefully and note that the bundled script appears broken as written.

Install only if you are comfortable using a TianAPI key with this skill. Prefer setting TIANAPI_WEIBO_HOT_KEY in your environment, avoid passing the key on the command line, do not commit scripts/.env, and be aware that query-string API keys can appear in logs. The current script also needs fixes before it will reliably run.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_weibo_hot.py:82
Finding

API Key Exposure Through URL Query Parameters, Command-Line Arguments, and Plaintext Storage

Content
View full analysis
str: if cli_key: return cli_key.strip() # 1. Environment variable env_val = os.environ.get(ENV_KEY_NAME, "").strip() if env_val: return env_val # 2. .env file env_file = Path(__file__).parent / ".env" if env_file.exists(): try: content = env_file.read_text(encoding="utf-8") for line in content.splitlines(): line = line.strip() if line.startswith(f"{ENV_KEY_NAME}="): return line.split("=", 1)[1].strip().strip('"\'') except Exception: pass return "" ``` From `scripts/fetch_weibo_hot.py:82-84`: ```python params = {"key": self.api_key} query_string = urllib.parse.urlencode(params) url = f"{API_ENDPOINT}?{query_string}" ``` Related instructions from `SKILL.md:26-29, 43`: ```bash # Method 2: .env file created in the scripts directory echo "TIANAPI_WEIBO_HOT_KEY=YOUR_API_KEY" > scripts/.env # Method 3: pass it on the command line python3 scripts/fetch_weibo_hot.py YOUR_API_KEY ``` ```bash python3 scripts/fetch_weibo_hot.py ``` The direct API example at `SKILL.md:65` also places the credential in the URL: ```text GET https://apis.tianapi.com/weibohot/index?key=YOUR_API_KEY ``` ### Technical Analysis The Skill legitimately needs to authenticate to the declared TianAPI endpoint to retrieve Weibo hot-search data. Transmitting the API key to `https://apis.tianapi.com/weibohot/index` is therefore necessary for the declared functionality and does not indicate transmission to an unrelated party. However, the key is placed in the URL query string. Although HTTPS encrypts the reque ...[truncated 2270 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明的核心目的是获取微博实时热搜榜，这与代码的总体意图基本一致，代码也确实会访问 TianAPI 的微博热搜接口。不过从实际行为看，存在实质性不一致：main() 中调用了不存在的方法 client.fetch_hot()，应为 fetch_hot_search()；同时代码判断 args.json，但未添加 --json 参数，运行会报错。因此该代码块按现状不能实现声明功能。其次，声明明确提到返回‘热搜词、热度及话题链接’，但渲染器仅输出 hotword、hotwordnum 和可选 hottag，没有专门处理或输出链接；JSON 返回虽可能包含原始字段，但代码未保证或标准化链接字段。因此描述与实际实现存在材料性偏差，应判定为 mismatch。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The documentation recommends writing the API key into scripts/.env, which places a live credential in a local file that may be accidentally committed, copied, or exposed through file reads by other tools. Storing secrets in project directories materially increases the risk of credential leakage in multi-tool or shared-workspace environments.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_WEIBO_HOT_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_WEIBO_HOT_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill also recommends passing the API key directly as a command-line argument, which can expose the secret through shell history, process listings, logs, and telemetry. In many environments this is a well-known credential exposure path and is more dangerous than using environment variables.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export TIANAPI_WEIBO_HOT_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_WEIBO_HOT_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_weibo_hot.py 你的APIKey

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_weibo_hot.py (reported line 17)May include surrounding context.

python
Env Config:
    export TIANAPI_WEIBO_HOT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_WEIBO_HOT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_weibo_hot.py (reported line 37)May include surrounding context.

python
Env Config:
    export TIANAPI_WEIBO_HOT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_WEIBO_HOT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_weibo_hot.py (reported line 42)May include surrounding context.

python
Env Config:
    export TIANAPI_WEIBO_HOT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_WEIBO_HOT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_weibo_hot.py (reported line 51)May include surrounding context.

python
Env Config:
    export TIANAPI_WEIBO_HOT_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_WEIBO_HOT_KEY=your_api_key
"""

import os

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_weibo_hot.py (reported line 52)May include surrounding context.

python
if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares executable behavior that uses environment variables, file access, and outbound network requests, but it does not define an explicit tool scope or permission boundary. In an agent setting, this weakens least-privilege controls and can allow the skill to be invoked with broader capabilities than users or the platform may expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs use of an external API but does not clearly warn that the user's API key will be sent to TianAPI during requests. Lack of transparency around credential transmission and third-party data sharing is a security and privacy concern, especially in agent workflows where users may not realize external calls are occurring.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation guidance is broad enough that an agent may trigger the skill for loosely related prompts about trends or current topics without clear user consent or boundary checks. In an agent environment, overbroad triggers can cause unnecessary external API calls and unintended transmission of credentials or query context to third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code reads a credential from CLI, environment, or .env and transmits it to a third-party API as a query parameter. Although the script docstring explains how to configure the key, it does not clearly warn the user that the key will be sent over the network to an external service, and there is no confirmation prompt or runtime disclosure near the request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.