ClawHub
Back to skill

Security audit

Weaver E10 Api

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Weaver E10 workflow helper, but it handles OAuth secrets and can approve or reject business workflows with weak safeguards.

Review before installing. Use only with a trusted Weaver E10 server over HTTPS, restrict the app permissions, secure the .env file and token cache, avoid shared hosts, and be aware that approve/reject commands can immediately change business workflows.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/weaver-e10.py:99
Finding

OAuth Credentials and Workflow Data May Be Transmitted Over Cleartext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/weaver-e10.py:17
Finding

OAuth Tokens Are Cached Without Enforced Restrictive Filesystem Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · _meta.json (reported line 14)May include surrounding context.

json
"security_notes": [
    "需要配置 WEAVER_API_BASE 等环境变量",
    "Token 缓存在 ~/.weaver-e10/token.json",
    "请勿将 .env 文件提交到版本控制"
  ],
  "acceptLicenseTerms": true
}

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The tool makes outbound HTTP requests to the Weaver API but network capability is not declared. In an agent setting, undeclared network access is security-relevant because it allows data exfiltration and remote side effects while bypassing expected permission review.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The tool makes outbound HTTP requests to the Weaver API but network capability is not declared. In an agent setting, undeclared network access is security-relevant because it allows data exfiltration and remote side effects while bypassing expected permission review.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The tool makes outbound HTTP requests to the Weaver API but network capability is not declared. In an agent setting, undeclared network access is security-relevant because it allows data exfiltration and remote side effects while bypassing expected permission review.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The tool makes outbound HTTP requests to the Weaver API but network capability is not declared. In an agent setting, undeclared network access is security-relevant because it allows data exfiltration and remote side effects while bypassing expected permission review.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The script reads a .env file from a fixed path to obtain app credentials, which is direct credential access from local storage. In an agent-skill environment this is dangerous because it expands the trust boundary to local secret files and may expose sensitive credentials to a skill that did not clearly declare or justify that access.

Content

Scanner excerpt · scripts/weaver-e10.py (reported line 53)May include surrounding context.

python
self._load_token_cache()
    
    def _load_env_file(self):
        """加载 .env 文件"""
        if ENV_FILE.exists():
            with open(ENV_FILE, 'r', encoding='utf-8') as f:
                for line in f:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
1. **凭证保管**：`.env/weaver-e10.env` 文件包含敏感凭证，请：
   - 不要提交到 Git 等版本控制系统
   - 设置文件权限：`chmod 600 .env/weaver-e10.env`
   - 不要通过聊天工具、邮件等方式明文传输

2. **Token 缓存**：Token 缓存在 `~/.weaver-e10/token.json`，请：

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This JSON file hard-codes user-facing content in Chinese, including the request title and form values, with no indication that the skill is region-specific or that users can opt into another language. That creates a natural-language policy concern because the skill appears to enforce a specific locale by default.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/weaver-e10.py (reported line 126)May include surrounding context.

python
'code': code
        }
        
        resp = requests.post(url, json=payload, timeout=10)
        resp.raise_for_status()
        data = resp.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/weaver-e10.py (reported line 152)May include surrounding context.

python
'code': code
        }
        
        resp = requests.post(url, json=payload, timeout=10)
        resp.raise_for_status()
        data = resp.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/weaver-e10.py (reported line 203)May include surrounding context.

python
'code': code
        }
        
        resp = requests.post(url, json=payload, timeout=10)
        resp.raise_for_status()
        data = resp.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/weaver-e10.py (reported line 258)May include surrounding context.

python
'code': code
        }
        
        resp = requests.post(url, json=payload, timeout=10)
        resp.raise_for_status()
        data = resp.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/weaver-e10.py (reported line 287)May include surrounding context.

python
'code': code
        }
        
        resp = requests.post(url, json=payload, timeout=10)
        resp.raise_for_status()
        data = resp.json()

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

At L170-L173, the comment says the code will '尝试刷新' (try to refresh), but the branch only executes when self.refresh_token and not self._is_token_expired(). This sits inside if not self.access_token or self._is_token_expired(), making the refresh path effectively unreachable when the token is expired, so the code falls back to re-authorization instead of refreshing as the comment implies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The CLI executes approve and reject workflow actions immediately with no confirmation or warning, even though they can trigger irreversible business-process changes. In an agent context, this increases the chance of accidental or prompt-driven misuse leading to unauthorized approvals, rejections, or workflow tampering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The auth command prints the access token directly to stdout, which may be captured by terminal logs, agent transcripts, CI logs, or other observers. Exposing bearer tokens this way can enable account or API impersonation until expiry, and possibly longer if refresh flows are accessible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The value "同意" forces a specific language in a user-facing text field. For this file type, natural-language policy review applies, and there is no indication that the skill offers locale choice or that the Chinese-only wording is required for a region-specific workflow.

Content

No source excerpt is available for this finding.