ClawHub
Back to skill

Security audit

社媒营销视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill largely does what it claims, but its setup tells users to put an API key on the command line, which can expose the key.

Review before installing. Use preview first, only upload media you intend to send to AI Hive, prefer AI_HIVE_API_KEY or a protected config/secret file over --api-key, rotate any key previously entered on the command line, and install dependencies in a virtual environment with pinned versions where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/social_matrix.py:529
Finding

API Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/social_matrix.py:529-533
Additional Location: SKILL.md:142
Vulnerability Type: API credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

python
save = commands.add_parser("auth", help="保存 AI Hive API Key")
save.add_argument("--api-key", required=True)
save.set_defaults(handler=auth)

The documented invocation explicitly places the credential in a command-line argument:

bash
python3 "$SKILL_PATH/scripts/social_matrix.py" auth --api-key sk-api-你的密钥

Technical Analysis

The authentication command requires users to provide the complete AI Hive API key through --api-key. Command-line arguments are not an appropriate secret-entry mechanism because they may be exposed through:

  • Shell history files.
  • Process inspection utilities while the command is running.
  • Terminal session recording.
  • Endpoint monitoring and command telemetry.
  • Wrapper scripts or job logs that capture complete command lines.

Although the program subsequently writes the key to a file with mode 0600, that protection does not prevent exposure before or during command execution. The issue affects the documented first-use workflow and the implemented auth parser.

Attack Path

  1. A user follows the documented setup command and supplies a valid API key using --api-key.
  2. The shell records the complete command in its history, or a local monitoring mechanism captures the process arguments.
  3. An attacker with access to the same account, shell-history backup, process telemetry, or applicable local process information retrieves the key.
  4. The attacker submits requests to AI Hive using the stolen bearer credential.
  5. The requests consume the victim's API quota and access any API capabilities authorized for that key.

Impact Assessment

Successful exploitation exposes the AI Hive API credential. The attacker obtains the same API-level privileges gra ...[truncated 326 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace command-line secret entry with an interactive hidden prompt using getpass.getpass():
python
from getpass import getpass

save = commands.add_parser("auth", help="Save the AI Hive API key")
save.set_defaults(handler=auth)

def auth(args):
    api_key = getpass("AI Hive API key: ")
    # Validate and store api_key securely.
  1. If non-interactive automation is required, accept the key through standard input or a protected secret file rather than a command-line argument.
  2. Continue enforcing file permissions of 0600 and create the configuration file atomically with restrictive permissions from the outset.
  3. Remove the literal --api-key workflow from SKILL.md and document the hidden-input method.
  4. Advise existing users to remove affected commands from shell history and rotate any key previously entered on the command line.
  5. Avoid printing, logging, or including the credential in exception messages and diagnostic telemetry.

T08 · Insecure Dependencies

Note
Location
scripts/social_matrix.py:12
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: scripts/social_matrix.py:12-16
Additional Location: SKILL.md:141
Vulnerability Type: Unpinned dependency and mutable supply-chain resolution
Risk Level: Low

Vulnerable Code

python
try:
    import requests
except ImportError:
    raise SystemExit("缺少 requests，请运行 pip3 install requests")

The installation instruction does not constrain or verify the package version:

bash
pip3 install requests

Technical Analysis

The project directs users to install requests from the configured Python package index without a pinned version, lockfile, or integrity hash. Consequently, installation resolves whatever package and transitive dependency versions are current at installation time.

The package name is legitimate and there is no evidence that the project intentionally references a malicious dependency. The security concern is that the installed dependency set is mutable and is not the same fixed dependency set reviewed during this audit. A compromised future release, compromised package-index account, maliciously configured package mirror, or unsafe transitive dependency could introduce attacker-controlled code.

Python packages and their installation mechanisms can execute code in the user's environment during installation or when imported. Thus, dependency integrity forms part of the skill's execution boundary.

Attack Path

  1. A user follows the documented first-use instruction and runs pip3 install requests.
  2. pip resolves the package and its transitive dependencies from the user's configured package index or mirror.
  3. The index supplies a compromised or malicious release, or a compromised dependency required by the selected release.
  4. Attacker-controlled package code executes during installation or when social_matrix.py imports the package.
  5. The malicious code runs with the privileges of the user performing the installation or launching the skill.

This path depends ...[truncated 694 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a reviewed dependency manifest with an explicit version constraint, such as a locked requirements.txt.
  2. Generate and verify cryptographic hashes for the approved package artifacts. Installation should use hash enforcement, for example:
bash
python3 -m pip install --require-hashes -r requirements.txt
  1. Lock transitive dependencies in addition to the direct requests dependency.
  2. Install dependencies inside a dedicated virtual environment rather than the global Python environment.
  3. Review and update locked versions through a controlled dependency-update process with security scanning and tests.
  4. Update SKILL.md and the import error message to reference the locked installation command instead of unconstrained pip3 install requests.
  5. Use a trusted package index and prevent untrusted configuration from redirecting installation to an unauthorized mirror.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill demonstrates shell execution, network access, environment-variable use, and filesystem access, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, that increases the chance the skill will be invoked with broader capabilities than intended, enabling accidental secret exposure, unintended file access, or arbitrary external requests if the script or inputs are abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and heading are written in Chinese and present the skill as operating in that language, with no indication that users may choose another language or locale. This can violate a language/locale policy when the skill is distributed to a broader audience without explicit opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file’s docstring and all user-facing CLI descriptions, prompts, errors, and status messages are written in Chinese, which effectively forces a specific language for interaction. There is no option to select another language and no indication that this is a region-specific or compliance-justified tool, so this appears to violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The placeholder value for the API key includes Chinese text ('请替换为你的APIKey'), which imposes a specific language in a user-facing example. This can violate language/locale policy when no opt-in or alternative locale is offered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.