ClawHub
Back to skill

Security audit

马仙儿术数推演

Security checks for vulnerabilities and agentic risk

Overview

This divination skill is coherent, but it sends personal birth and dream details to a remote service over plaintext HTTP with an embedded shared bearer token and little user-facing disclosure.

Install only if you are comfortable sending birth details, names, questions, dream descriptions, and generated reports to the publisher's remote service. Prefer a version that uses HTTPS, removes the shared embedded token, validates the API host, and clearly asks for consent before transmitting personal data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/maxianer-call.mjs:13
Finding

Plaintext Transmission of Sensitive Personal Data and API Credentials

Content
View full analysis

Vulnerability Details

File Location: scripts/maxianer-call.mjs:13-14, 48-55
Vulnerability Type: Sensitive data and bearer-token transmission over plaintext HTTP
Risk Level: High

Vulnerable Code

js
const API_URL = (process.env.MAXIANER_API_URL || 'http://34.84.114.113:3333').replace(/\/$/, '');
const API_KEY = process.env.MAXIANER_API_KEY || 'mx-2026-openclaw-shared';

const headers = { 'Content-Type': 'application/json' };
if (API_KEY) headers['Authorization'] = `Bearer ${API_KEY}`;

const opts = { method: ep.method, headers };
if (body && ep.method === 'POST') opts.body = JSON.stringify(body);

try {
  const res = await fetch(`${API_URL}${ep.path}`, opts);
  const text = await res.text();

SKILL.md:27-34 demonstrates that the transmitted request may include a name, birth date, birth time, gender, and birthplace:

bash
node {baseDir}/scripts/maxianer-call.mjs fate '{"birthDate":"1980-05-14","birthHour":"子","birthMinute":30,"gender":"male","birthPlace":"荣县","name":"钟波"}'

Technical Analysis

The default API URL uses unencrypted HTTP. Consequently, request bodies, the bearer credential in the Authorization header, and API responses are not protected by TLS while in transit.

Requests can contain identifying and sensitive personal information, including names, precise birth details, birthplaces, dream descriptions, and personal divination questions. The report endpoint may additionally receive generated interpretation content. A network-positioned attacker can inspect this material or modify requests and responses.

The script also accepts MAXIANER_API_URL without validating its scheme. This permits plaintext or otherwise unintended destinations to be configured without a transport-security check.

Attack Path

  1. A user provides personal information requested by the Skill.
  2. The agent invokes maxianer-call.mjs with that information in the JSON body.
  3. Unl ...[truncated 983 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the default endpoint with an HTTPS URL on a trusted, controlled domain.
  • Configure a valid TLS certificate and retain standard certificate and hostname verification.
  • Reject endpoints whose parsed URL protocol is not https:.
  • Consider restricting overrides to an allowlist of approved hosts rather than accepting an arbitrary environment-provided destination.
  • Clearly disclose remote processing and obtain appropriate consent before transmitting personal information.
  • Minimize submitted data and avoid sending names or exact locations unless strictly necessary.
  • Rotate the exposed bearer token and implement the per-user credential controls described in the separate credential finding.
  • Apply server-side authentication, rate limiting, request logging, and narrowly scoped authorization.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/maxianer-call.mjs:14
Finding

Hard-Coded Shared Bearer Credential

Content
View full analysis

Vulnerability Details

File Location: scripts/maxianer-call.mjs:14
Vulnerability Type: Embedded reusable API secret
Risk Level: High

Vulnerable Code

js
const API_KEY = process.env.MAXIANER_API_KEY || 'mx-2026-openclaw-shared';

The credential is subsequently attached to API requests at scripts/maxianer-call.mjs:48-49:

js
const headers = { 'Content-Type': 'application/json' };
if (API_KEY) headers['Authorization'] = `Bearer ${API_KEY}`;

Technical Analysis

The script contains a bearer credential as a fallback value. Any person who can obtain the Skill package can extract the token without executing the script. Because the value is explicitly described as shared, activity cannot be reliably attributed to individual users or installations.

Bearer credentials grant access based on possession. There is no additional proof-of-possession mechanism in the reviewed client. The credential is therefore directly replayable outside the Skill, subject only to whatever controls the remote service may independently enforce.

The plaintext HTTP issue further increases exposure, but the hard-coded secret remains independently vulnerable even if transport encryption is added.

Attack Path

  1. An attacker downloads or inspects the publicly distributed Skill package.
  2. The attacker reads scripts/maxianer-call.mjs and copies the fallback API key.
  3. The attacker constructs requests to the configured API and supplies Authorization: Bearer mx-2026-openclaw-shared.
  4. If the service continues to accept the token, the attacker invokes endpoints or consumes resources available to that credential.
  5. Because legitimate installations use the same identity, attribution, selective revocation, and abuse containment are impaired.

Impact Assessment

This issue does not provide direct local-system privileges. It may grant unauthorized access to every remote API capability assigned to the sha ...[truncated 454 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the hard-coded fallback credential from source code and distributed artifacts.
  • Rotate and revoke mx-2026-openclaw-shared, as it must be treated as exposed.
  • Require credentials to be supplied through protected runtime configuration or a secret manager.
  • Issue unique credentials per user, installation, or workload instead of sharing one bearer token.
  • Scope each credential to only the required endpoints and operations.
  • Apply short expiration periods, rotation, revocation, rate limits, and per-credential audit logging.
  • Fail securely with a clear configuration error when no credential is provided.
  • Add automated secret scanning to the development and release pipelines to prevent recurrence.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs the agent to invoke a local Node.js script and static analysis detected env/network capabilities, but the manifest does not declare any tool scope restrictions. That creates an authority mismatch: a benign-seeming fortune-telling skill can access broader runtime capabilities than users or reviewers can infer, increasing the chance of unintended outbound requests or secret exposure through the script path.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list includes broad conversational phrases such as '帮我算算', '看看运势', and '什么命/命理', which can match ordinary chat and cause unintended activation. In this skill, accidental activation is more sensitive because it then solicits and processes personal birth data and may call external/networked code, expanding privacy and consent risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill metadata and instructions are entirely Chinese-centric, including Chinese-only trigger phrases and inputs such as requiring a Chinese birthplace name, but the file does not state that the locale restriction is optional or limited to a region-specific use case. This can violate language/locale policy when a skill effectively mandates one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language strings in the header comments and CLI output are written exclusively in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the policy, forcing a language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script allows its remote target to be changed via an environment variable and also ships with a hard-coded bearer token fallback. This creates an unnecessary generic exfiltration-capable network client for a fortune-telling skill, and if the endpoint is redirected or the token is reused elsewhere, sensitive user data and credentials can be sent to an attacker-controlled service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This script is designed to transmit highly sensitive personal data such as birth date, birth hour, birthplace, gender, questions, and dream descriptions to a remote API, but there is no consent prompt, warning, minimization, or privacy notice in the code path. In the context of a divination skill, these fields are intrinsic to the feature but still represent personal and potentially sensitive data that could be exposed, logged, or retained by a third party.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/maxianer-call.mjs:13