Uniprofit Trade Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:38 AM UTC
• Version: 1.0.6

Overview

The skill is coherent, but it should be reviewed because its helper scripts can send the API key and search queries to a non-HTTPS or misconfigured API base URL.

Install only if you trust the UniProfit API base URL configuration and can ensure it is HTTPS. Prefer a fixed, trusted UniProfit host, rotate the API key if it may have been used with HTTP, and treat searches as paid or commercially sensitive because the key and query filters are sent to the UniProfit service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/check_credential.py:23

Finding

Credential Validation Transmits API Keys Without Enforcing HTTPS

Content

View full analysis

Vulnerability Details

File Location: scripts/check_credential.py:23-32
Vulnerability Type: API credential exposure over an unencrypted connection
Risk Level: High

Vulnerable Code

python

base_url = _require_env("UNIPROFIT_API_BASE_URL").rstrip("/")
api_key = _require_env(KEY_ENV)

req = urllib.request.Request(
    f"{base_url}/openclaw/credential/me",
    headers={"X-UniProfit-Key": api_key},
    method="GET",
)
try:
    with urllib.request.urlopen(req, timeout=20) as resp:

Technical Analysis

The script accepts UNIPROFIT_API_BASE_URL as an arbitrary string and does not parse its scheme or require HTTPS before placing UNIPROFIT_TRADE_SEARCH_KEY in the X-UniProfit-Key request header.

If the configured URL uses http://, the credential is transmitted in plaintext. A network-positioned attacker could inspect the request and recover the API key. Documentation provides an HTTPS example, but an example does not provide runtime enforcement.

Attack Path

1. A deployment, user, or configuration-management error sets UNIPROFIT_API_BASE_URL to an http:// endpoint.
2. The credential-check script is executed.
3. The script places the UniProfit API key in the X-UniProfit-Key header.
4. urllib.request.urlopen sends the request over an unencrypted connection.
5. An attacker able to observe network traffic captures the header value.
6. The attacker reuses the stolen credential against the UniProfit API.

Impact Assessment

Exploitation does not grant local operating-system privileges, but it can compromise the authority represented by the API key. An attacker may validate or reuse the credential, access trade-search functionality available to that key, consume paid quota, and impersonate the authorized caller within the key's API scope.

Remediation

View remediation

Remediation Suggestions

• Parse the configured URL using urllib.parse.urlparse.
• Reject every scheme other than https.
• Reject malformed URLs and URLs containing embedded user information.
• Consider allowlisting the official UniProfit API hostname to reduce credential exfiltration through configuration manipulation.
• If local development requires cleartext HTTP, permit it only through an explicit development-only option and only for loopback addresses such as 127.0.0.1 or localhost.
• Document HTTPS as mandatory rather than providing it only as an example.
• Add automated tests confirming that http:// and malformed base URLs are rejected before any request is made.

Example hardening:

python

from urllib.parse import urlparse

def _require_https_base_url(value: str) -> str:
    value = value.rstrip("/")
    parsed = urlparse(value)
    if parsed.scheme != "https" or not parsed.hostname:
        raise SystemExit("UNIPROFIT_API_BASE_URL must be a valid HTTPS URL")
    if parsed.username or parsed.password:
        raise SystemExit("Embedded URL credentials are not allowed")
    return value

base_url = _require_https_base_url(
    _require_env("UNIPROFIT_API_BASE_URL")
)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search_trade.py:30

Finding

Trade Search Transmits API Keys and Sensitive Query Data Without Enforcing HTTPS

Content

View full analysis

Vulnerability Details

File Location: scripts/search_trade.py:30-54
Vulnerability Type: API credential and trade-query exposure over an unencrypted connection
Risk Level: High

Vulnerable Code

python

base_url = _require_env("UNIPROFIT_API_BASE_URL").rstrip("/")
api_key = _require_env("UNIPROFIT_TRADE_SEARCH_KEY")

body = json.dumps(
    {
        "source": args.source,
        "filters": filters,
        "page": args.page,
        "page_size": args.page_size,
    },
    ensure_ascii=False,
).encode("utf-8")

req = urllib.request.Request(
    f"{base_url}/openclaw/search/query",
    data=body,
    headers={
        "Content-Type": "application/json",
        "X-UniProfit-Key": api_key,
    },
    method="POST",
)

try:
    with urllib.request.urlopen(req, timeout=30) as resp:

Technical Analysis

The search client directly uses the environment-provided base URL without validating its scheme. It then sends both the API key and the complete search body to that destination.

When UNIPROFIT_API_BASE_URL uses http://, the API key and structured search filters are transmitted without encryption or endpoint authentication. This exposes both authentication material and potentially sensitive business-intelligence queries. An active network attacker could also modify requests or responses in transit.

Because the destination is configuration-controlled, unauthorized modification of the environment variable could additionally direct the key and query body to an attacker-controlled endpoint. Host allowlisting would reduce that risk where the legitimate service has a stable hostname.

Attack Path

1. UNIPROFIT_API_BASE_URL is configured with an HTTP URL, whether through error or configuration tampering.
2. A user initiates an importer, exhibition, or procurement-requirement search.
3. The script serializes the selected source and filters into the POST body.
4. T ...[truncated 881 chars]

Remediation

View remediation

Remediation Suggestions

• Validate UNIPROFIT_API_BASE_URL before reading or transmitting the API key.
• Require the https scheme and a valid hostname.
• Reject URLs containing embedded credentials, fragments, or unexpected components.
• Allowlist the official UniProfit hostname when deployment requirements permit it.
• Keep standard TLS certificate and hostname verification enabled.
• Do not automatically downgrade from HTTPS to HTTP.
• Restrict any development-only HTTP exception to explicit opt-in and loopback destinations.
• Add tests demonstrating that no request containing X-UniProfit-Key can be sent to an HTTP URL.
• Rotate the API key if it may previously have been used with a cleartext endpoint.

Example hardening:

python

from urllib.parse import urlparse

def _require_https_base_url(value: str) -> str:
    value = value.rstrip("/")
    parsed = urlparse(value)
    if parsed.scheme != "https" or not parsed.hostname:
        raise SystemExit("UNIPROFIT_API_BASE_URL must be a valid HTTPS URL")
    if parsed.username or parsed.password:
        raise SystemExit("Embedded URL credentials are not allowed")
    return value

base_url = _require_https_base_url(
    _require_env("UNIPROFIT_API_BASE_URL")
)
api_key = _require_env("UNIPROFIT_TRADE_SEARCH_KEY")

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requires environment variables and instructs the runtime to make authenticated network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where a host agent may grant broader-than-intended capabilities, increasing the risk of secret misuse or unintended outbound requests if the skill is invoked in a permissive environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.