ClawHub
Back to skill

Security audit

shejian

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent store-management assistant, but it asks agents to put bearer tokens and user-derived fields directly into shell curl commands for sensitive business actions.

Review this before installing in a real store environment. It should only be used with a least-privilege, revocable token, and preferably after replacing shell-based curl construction with a structured HTTP client or secret-aware tool that redacts Authorization headers and safely serializes JSON fields. Do not let untrusted users provide product names, notes, or other free-text fields until the command-injection issue is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:228
Finding

Shell Command Injection Through User-Controlled API Fields

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 228–237
Vulnerability Type: Shell command injection caused by unsafe command construction
Risk Level: High

The following English-normalized code excerpt preserves the vulnerable command structure documented in the source:

bash
curl -s -X POST 'https://s.xingke888.com/api/sales/supplement' -H 'Authorization: Bearer ACTUAL_TOKEN' -H 'Content-Type: application/json' -d '{"product_name":"Tomato","type":"sold_out"}'

The accompanying instructions require all arguments to use single quotes and require the complete command to be executed as one line.

Technical Analysis

The skill directs the agent to interpolate API request data into a shell command. Fields such as product_name and notes can originate directly from natural-language user input. These values are inserted into JSON contained within a single-quoted shell argument.

If an input contains a single quote, it can terminate the shell argument. An attacker can then append shell syntax and arbitrary commands. JSON encoding alone does not make a value safe for interpolation into a shell command because JSON escaping and shell escaping are separate security boundaries.

The requirement that commands be single-line and that arguments use single quotes does not prevent quote termination. It can instead encourage the agent to build exactly the vulnerable command form.

Attack Path

  1. An attacker submits a product name, note, or another API field containing a single quote followed by shell syntax.
  2. The agent recognizes the request as a supported write operation and asks for confirmation.
  3. After confirmation, the agent inserts the attacker-controlled value into the JSON passed through curl -d.
  4. The injected quote terminates the original single-quoted argument.
  5. Appended shell commands execute through the exec tool with the agent process's privileges.
  6. The attacker can use the in ...[truncated 724 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace shell-based curl construction with a structured HTTP tool or language SDK that accepts the URL, headers, and JSON body as separate typed parameters.
  2. Never concatenate or interpolate natural-language input into a shell command.
  3. Serialize request bodies with a trusted JSON serializer rather than manually constructing JSON text.
  4. If shell execution is unavoidable, invoke processes without a shell and supply each argument through an argument array.
  5. Apply strict schema validation to every field, including product names, quantities, dates, prices, identifiers, and notes.
  6. Reject unexpected control characters and enforce reasonable field-length limits as defense in depth.
  7. Keep write-operation confirmation, but do not treat confirmation as a substitute for safe command construction.
  8. Add adversarial tests covering single quotes, command separators, substitutions, newlines, and malformed JSON values.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:35
Finding

Bearer Token Exposed Through Plaintext Shell Command Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–52
Vulnerability Type: Plaintext credential exposure in process arguments and execution records
Risk Level: Medium

The following English-normalized excerpt preserves the credential-handling procedure documented in the source:

text
The execution allowlist rejects commands containing variable references.
First obtain the token's actual value, then insert it directly into a single-quoted command.
bash
curl -s 'https://s.xingke888.com/api/inventory' -H 'Authorization: Bearer ACTUAL_TOKEN'

The documented procedure also instructs the agent to read the token from a workspace configuration file or injected metadata before inserting the resolved secret into the command.

Technical Analysis

The skill explicitly requires the agent to resolve the bearer token and place its plaintext value directly into the curl command line. This bypasses the protection that would otherwise avoid direct secret interpolation.

Command-line secrets may be exposed through:

  • Process listings available to other processes or users
  • Execution-tool request records and telemetry
  • Shell history or diagnostic output
  • Error reports and debugging logs
  • Agent transcripts or command traces
  • Command injection vulnerabilities in the same execution path

Single-quoting the token only changes shell parsing behavior. It does not prevent the resolved token from appearing in the process argument vector or execution logs.

Attack Path

  1. The agent reads the bearer token from workspace configuration or injected metadata.
  2. The agent constructs a plaintext command containing the complete authorization header.
  3. The command is submitted to the execution tool and launched as a process.
  4. The secret becomes visible to any command logging, telemetry, process inspection, or error-reporting mechanism that records arguments.
  5. An attacker with access to t ...[truncated 824 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use a secret-aware HTTP client or platform API that can attach authorization headers without placing them in shell command text.
  2. Prevent authorization headers and token values from being included in tool logs, transcripts, telemetry, and error messages.
  3. Do not work around execution restrictions by resolving a protected variable and embedding its plaintext value into a command.
  4. Restrict token retrieval to a single approved secret provider rather than general workspace-file reads.
  5. Apply least-privilege scopes to the API token and separate read-only credentials from credentials capable of modifying inventory or sales data.
  6. Rotate the token after any suspected exposure and implement short expiration periods where supported.
  7. Add server-side authorization checks and audit logging for every state-changing endpoint.
  8. Redact Authorization headers centrally before recording HTTP requests or execution metadata.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation scope is very broad—any Chinese message related to store operations may trigger the skill. That increases the chance of unintended execution of sensitive actions such as inventory adjustment, sales supplementation, purchase entry, or weather/store queries on loosely related user input, especially in mixed-context conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The output rules explicitly require Chinese-formatted replies for store clerks and provide no opt-in or alternative language handling. This can violate language/locale policy when users may prefer or require another language and the file does not present a user choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill is explicitly designed to transmit store operational data to an external service (https://s.xingke888.com) using bearer-token authenticated API requests. Because the skill handles inventory, sales, logs, purchases, account info, and weather queries, it can exfiltrate sensitive business data off-platform and perform authenticated state changes; the risk is elevated by instructions to inline the real token into command text, which increases exposure through logs, traces, and debugging surfaces.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
**严禁输出任何中间过程。** 用户是门店店员，不是开发者。你的回复中：

- ❌ 禁止出现："让我先读取…"、"我来查询…"、"现在调用 API…"、"根据技能文件…"、"读取配置…" 等描述内部操作步骤的文字
- ❌ 禁止暴露工具调用细节、文件路径、环境变量名、curl 命令内容
- ❌ 禁止在结果之前输出任何"思考过程"或"正在处理"的叙述
- ✅ 直接输出最终结果：确认摘要、查询结果、或向用户提问补充信息
- ✅ 如果需要多步操作（如先查商品 ID 再补录），静默完成所有步骤，只输出最终结果

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

L011 明确声明 API Token 从各 agent workspace 的 SHEJIAN.md 中读取，但 L031 又将配置方式描述为环境变量 SHEJIAN_API_TOKEN_<agentId>，L051 进一步说可读取 SHEJIAN.md 或从注入 metadata 获取。这不是单纯信息不全，而是对同一凭证来源给出了互相冲突的操作意图，可能导致调用方采用错误的认证方式。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

L021-L025 要求禁止提及读取配置、文件路径、环境变量名等内部操作，但 L035-L053 与 L226-L238 又详细指导代理去读取 SHEJIAN.md/环境配置并将实际 token 直接拼入 curl 命令。虽然前者针对用户可见输出、后者针对内部执行，但文档没有清晰区分“对外不可说”和“内部可做”，形成可误解的意图冲突。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.