ClawHub
Back to skill

Security audit

雪球网信息获取

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Xueqiu data API helper, but it tells users to share billable API secrets in chat and sends those secrets to a remote service without enough safety guidance.

Review this skill carefully before installing. Use only credentials created for this service, avoid pasting real secure_key values into ordinary chat when possible, set spending limits or rotate credentials after testing, and assume search terms, IDs, and API credentials are sent to the remote wxpub.aibana.art service during use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:17
Finding

API Secret Exposure Through Conversational Plaintext

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 17-26; SKILL.md, lines 15-21 and 28-36
Vulnerability Type: Plaintext sensitive credential handling
Risk Level: Medium

Vulnerable Documentation

The relevant section of README.md instructs users to:

markdown
## Prepare Credentials

1. Register an account at https://wxpub.aibana.art
2. Create an `app_id` and `secure_key` on the Skill page
3. Add funds to the account

Tell Claude the credentials, for example:

> My app_id is `ak_xxx`, and my secure_key is `yyy`

The corresponding section of SKILL.md states that authentication requires an app_id and secure_key, and that every request must contain both fields:

markdown
- Authentication: An `app_id` and `secure_key` are required.

All endpoints must contain the following fields:

| Field | Type | Description |
|---|---|---|
| `app_id` | string | Assigned application identifier |
| `secure_key` | string | Corresponding secret key |

Technical Analysis

The documentation explicitly instructs users to disclose a live secure_key in conversational plaintext. This places the credential in the model context and may also expose it through conversation history, agent traces, telemetry, debugging output, application logs, or transcript exports.

Requiring credentials for the advertised API is legitimate and does not by itself indicate malicious exfiltration. The vulnerability is the credential-handling design: the language model receives the raw secret rather than having a trusted integration layer inject it into outbound requests. Because every API request contains the same secret, repeated use also increases the number of systems and records in which it may appear.

No hardcoded production credential was found in the repository; the documented values are placeholders. The risk arises when a user follows the instructions with real credentials.

Attack Path

  1. A ...[truncated 1068 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove instructions telling users to paste secure_key values into a conversation.
  2. Store credentials in a platform secret manager, protected credential store, or environment variable unavailable to the language model.
  3. Configure the HTTP integration to inject authentication fields immediately before transmission.
  4. Redact secure_key values from application logs, model traces, error messages, telemetry, and request previews.
  5. Use short-lived, narrowly scoped tokens where the service supports them.
  6. Provide credential rotation and immediate revocation mechanisms.
  7. Prevent secrets from being echoed in assistant responses or tool output.
  8. Add automated secret-detection controls to conversational input and logging pipelines.
  9. Document that credentials must never be entered directly into chat and provide secure setup instructions instead.
  10. Apply rate limits, spending limits, and anomaly alerts per credential to reduce the impact of compromise.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README explicitly instructs users to paste app_id and secure_key directly into chat, which encourages disclosure of live credentials in a conversational channel that may be logged, retained, or exposed to other tools. In a skill that performs billable API calls, leaked credentials can enable unauthorized usage, account abuse, and indirect access to investment-related data under the victim's account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to send app_id, secure_key, and query data to a remote service but does not clearly warn that these credentials and request contents leave the local environment and are transmitted to an external endpoint. This can mislead users into sharing sensitive credentials or query content without informed consent, especially since both localhost and an internet-accessible production URL are documented.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The curl examples demonstrate direct POST requests to https://wxpub.aibana.art containing authentication material and user query data, confirming external transmission to a remote service. In context this appears to be the intended functionality rather than covert exfiltration, but it still creates a real data exposure surface because credentials and user inputs are sent outside the host environment.

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

curl 调用示例

bash
# 搜索帖子

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The README presents the skill entirely in Chinese and tells users to interact via natural-language queries using only Chinese examples, but it does not state that the skill is intentionally China/Chinese-specific or offer a language choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.