API Key Guardian

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:19 PM UTC
• Version: 1.0.0

Overview

This secret-scanning skill mostly does what it claims, but its optional AI analysis sends scan metadata through a local HTTP endpoint using a hardcoded API key that is not adequately disclosed.

Review before installing. The local scanning behavior is coherent, but avoid using --ai unless you trust the local OpenClaw proxy on port 18790 and accept that finding metadata may be sent for analysis. The publisher should remove and rotate the embedded API key, document exactly what --ai sends and where, and add an explicit consent gate or local-only default.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: guardian.py:109
• Finding: Hardcoded API Credential Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `guardian.py`, lines 109–114 **Vulnerability Type**: Hardcoded secret and plaintext credential transmission **Risk Level**: High ### Vulnerable Code ```python url = "http://127.0.0.1:18790/anthropic/v1/messages" headers = { "Content-Type": "application/json", "x-api-key": "sk-RPBUoe2SH7KigJ0SZn6IPDirZtJ2fUaWSukEx1FwxjhWFx0G", "anthropic-version": "2023-06-01" } ``` ### Technical Analysis A plaintext API credential is embedded directly in the distributed source code. Anyone able to read the project package can recover and attempt to reuse this credential. Source-control history, package mirrors, backups, logs, and copied installations may retain the exposed value even after it is removed from the current version. When AI analysis is enabled, the credential is also placed in an HTTP request header and sent to a loopback endpoint without transport encryption. The loopback restriction reduces remote network exposure, but another local process could bind to or impersonate the expected service at port `18790` and receive the credential when the feature is invoked. Local traffic inspection may create additional exposure depending on the host environment. The AI request includes finding types, severities, source paths, and line numbers. The matched secret values themselves are not included in the prompt. ### Attack Path 1. An attacker obtains read access to the Skill package, a repository copy, an archive, a backup, or retained version history. 2. The attacker extracts the hardcoded `x-api-key` value from `guardian.py`. 3. The attacker attempts to replay the credential against a compatible API or proxy, subject to the credential's actual validity and server-side restrictions. 4. Alternatively, a malicious local process listens on or impersonates `127.0.0.1:18790`. 5. A user runs the scanner with `--ai` while findings exist. 6. The scanner sends the embedded credential in an unencrypted HTTP header to the m ...[truncated 644 chars]
• Remediation: ## Remediation Suggestions 1. Revoke the exposed credential immediately and issue a replacement because deletion from the current source does not invalidate copies in repository history or distributed packages. 2. Remove all credentials from source code and load them from a protected environment variable or runtime secret manager. 3. Fail safely with a clear error when the credential is unavailable; do not ship a fallback credential. 4. Apply least privilege, usage quotas, expiration, and endpoint restrictions to the replacement credential. 5. Replace plaintext HTTP with authenticated HTTPS where supported. For a local-only service, consider a protected Unix-domain socket or another authenticated local IPC mechanism with restrictive permissions. 6. Authenticate the local proxy independently rather than assuming that loopback binding establishes trust. 7. Add automated secret scanning to pre-commit and CI workflows, and inspect repository history and release artifacts for the exposed value. 8. Avoid logging request headers or secret-bearing exception details, and document that only finding metadata—not matched credential values—is submitted for AI analysis.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared behavior says the skill scans for secrets, but the finding indicates additional undeclared network communication, hardcoded API key presence, and AI analysis that may transmit scan results externally. This is especially dangerous because a secret-scanning tool will handle exactly the most sensitive data in a repository, so undisclosed exfiltration or embedded credentials creates a high-risk trust violation.

Credential Access

High

• Category: Privilege Escalation

Content

用法:
  python3 guardian.py                        # 扫描当前目录
  python3 guardian.py --path /some/dir       # 扫描指定目录
  python3 guardian.py --file /path/to/.env   # 扫描单个文件
  python3 guardian.py --git-history          # 扫描 git 提交历史
  python3 guardian.py --ai                   # 启用 AI 风险分析
"""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

用法:
  python3 guardian.py                        # 扫描当前目录
  python3 guardian.py --path /some/dir       # 扫描指定目录
  python3 guardian.py --file /path/to/.env   # 扫描单个文件
  python3 guardian.py --git-history          # 扫描 git 提交历史
  python3 guardian.py --ai                   # 启用 AI 风险分析
"""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The tool sends scan-derived findings to an HTTP endpoint without a clear user-facing disclosure at the moment of use, which can cause unintended exfiltration of sensitive repository information. In the context of a secret scanner, users may reasonably expect findings to remain local unless explicitly warned otherwise, so this mismatch increases the severity.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code contains a hard-coded API key in source, which is itself a credential exposure and creates immediate reuse/abuse risk if the repository is shared. Embedding a live credential inside a secret-scanning tool is especially dangerous because it normalizes insecure handling of secrets and may grant unauthorized access to the backing AI service.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares executable capabilities involving file access, shell use, and likely networked AI analysis, but does not define any explicit tool scope or permissions boundaries. In a security-scanning skill that may read repositories and sensitive files, missing scope declarations increases the risk of over-broad access and unintended data exposure.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest description and all user-facing instructions are written in Chinese, with no indication that other languages are supported or that the locale restriction is intentional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def scan_git_history(repo_path: Path, max_commits: int = 100) -> list:
    findings = []
    try:
        result = subprocess.run(
            ["git", "log", f"--max-count={max_commits}", "--pretty=format:%H %s", "--name-only"],
            cwd=repo_path, capture_output=True, text=True, timeout=30
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

["git", "log", f"--max-count={max_commits}", "--pretty=format:%H %s", "--name-only"],
            cwd=repo_path, capture_output=True, text=True, timeout=30
        )
        commits_raw = subprocess.run(
            ["git", "log", f"--max-count={max_commits}", "--pretty=format:%H", "-p"],
            cwd=repo_path, capture_output=True, text=True, timeout=60
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The AI analysis feature transmits scan-derived findings to a local HTTP service, which breaks the expectation of a purely local secret scanner and can expose sensitive metadata or secret fragments outside the scanning process. Even though only a summary is sent, the summary includes file paths, finding types, and line numbers, which may leak confidential project structure and security posture; the code also talks to an unencrypted HTTP endpoint.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The prompt explicitly instructs the model to respond in Chinese (`请用中文简洁说明`), creating a fixed language policy in the skill's behavior. There is no opt-in, user language selection, or documented justification that this tool is intended only for a Chinese-language context.

Static analysis

No suspicious patterns detected.