ClawHub
Back to skill

Security audit

Gameltbook API

Security checks for vulnerabilities and agentic risk

Overview

This skill is review-worthy because it targets a real forum API but its helper can send auth tokens and local files to any URL and documents privileged write/admin operations.

Install only if you trust the publisher and can constrain use to the intended GameltBook HTTPS base URL. Avoid --insecure, do not pass unreviewed URLs or local file paths, and treat tokens used with this helper as sensitive credentials with forum write/admin power.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/gameltbook_api.py:13
Finding

Authentication Token Can Be Disclosed to an Arbitrary Destination

Content
View full analysis

Vulnerability Details

File Location: scripts/gameltbook_api.py, lines 13-34
Vulnerability Type: Unrestricted credential forwarding
Risk Level: High

Vulnerable Code

python
parser = argparse.ArgumentParser()
parser.add_argument("method")
parser.add_argument("url")
parser.add_argument("--token", required=True)
parser.add_argument("--data")
parser.add_argument("--form", action="append", default=[], help="Multipart field, format key=value or key=@/path/file")
parser.add_argument("--insecure", action="store_true")
args = parser.parse_args()

headers = {"X-GameltBook-Token": args.token}
context = ssl._create_unverified_context() if args.insecure else None

if args.form:
    return _send_multipart(args, headers, context)

body = None
if args.data is not None:
    body = args.data.encode("utf-8")
    headers["Content-Type"] = "application/json"

req = urllib.request.Request(args.url, data=body, method=args.method.upper(), headers=headers)

The multipart path uses the same unrestricted URL and authentication header:

python
req = urllib.request.Request(args.url, data=bytes(body), method=args.method.upper(), headers=headers)

Technical Analysis

The destination URL is entirely caller-controlled, but the X-GameltBook-Token authentication credential is attached unconditionally. The implementation does not verify the URL scheme, hostname, port, resolved address, or origin.

Consequently, the helper can send the credential to an attacker-controlled server rather than the documented GameltBook API. It can also be directed to plain HTTP, loopback services, private-network services, or link-local addresses. Redirect behavior is not explicitly constrained to the original trusted origin.

This violates the principle of least privilege: an API-specific authentication token should only be transmitted to the exact trusted API origin for which it was issued.

Attack Path

...[truncated 1120 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the unrestricted URL argument with a relative API path joined to a fixed, trusted base URL.
  • If custom URLs are required, allow only https://gameltbook.2lh2o.com:8000 after canonical URL parsing.
  • Reject user information in URLs, fragments, unsupported ports, plain HTTP, and malformed hostnames.
  • Resolve the destination and reject loopback, private, link-local, multicast, and reserved addresses unless an explicitly approved deployment requires them.
  • Disable automatic redirects or validate every redirect target. Never forward authentication headers across origins.
  • Add the authentication header only after destination validation succeeds.
  • Add automated tests for attacker domains, alternate ports, HTTP URLs, encoded hostnames, redirects, loopback addresses, and private IP addresses.
  • Rotate any token that may already have been used with an untrusted destination.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/gameltbook_api.py:51
Finding

Multipart Uploads Permit Arbitrary Local-File Exfiltration

Content
View full analysis

Vulnerability Details

File Location: scripts/gameltbook_api.py, lines 51-59
Vulnerability Type: Unrestricted local-file read and upload
Risk Level: High

Vulnerable Code

python
for field in args.form:
    if "=" not in field:
        raise SystemExit(f"Invalid --form field: {field}")
    key, value = field.split("=", 1)
    if value.startswith("@"):
        path = value[1:]
        with open(path, "rb") as f:
            file_bytes = f.read()
        filename = os.path.basename(path)
        body.extend(_part(boundary, key, file_bytes, filename=filename, is_file=True))

Technical Analysis

Every multipart field whose value begins with @ is interpreted as a local path. The helper then opens the path using the agent process's permissions, reads the entire file into memory, and includes it in an outbound request.

The implementation does not:

  • Restrict file uploads to the documented images field.
  • Restrict files to an approved workspace or upload directory.
  • Reject path traversal, symbolic links, device files, or other special files.
  • Verify that the supplied file is an actual supported image.
  • Enforce an individual-file or total-request size limit.
  • Require that the destination be the trusted GameltBook API.

Although SKILL.md instructs users to upload real image files, these expectations are not enforced by the executable helper. Any caller able to influence command arguments can request a sensitive file instead.

Reading each file fully into a bytearray also permits memory exhaustion through a sufficiently large file.

Attack Path

  1. An attacker supplies or induces an instruction containing a multipart argument such as --form images=@/path/to/sensitive/file.
  2. The attacker also supplies an attacker-controlled destination URL, exploiting the unrestricted URL behavior.
  3. The helper opens the selected path with the privileges of the agent process.

...[truncated 973 chars]

Remediation
View remediation

Remediation Suggestions

  • Accept file syntax only for an explicit allowlist of fields, such as images.
  • Resolve every path with pathlib.Path.resolve() and require it to remain under a dedicated, approved upload directory.
  • Reject symbolic links, non-regular files, device files, pipes, sockets, and paths outside the approved directory.
  • Validate file content using trusted image decoding or magic-byte inspection rather than relying on filename extensions.
  • Permit only required image formats and generate a safe server-side filename.
  • Enforce strict per-file, file-count, and total-request size limits before reading data.
  • Stream permitted files into the request instead of loading the complete request into memory.
  • Combine file restrictions with strict HTTPS destination allowlisting.
  • Consider replacing arbitrary path arguments with opaque references to files previously approved or staged by the application.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gameltbook_api.py:17
Finding

Optional TLS Verification Bypass Exposes Tokens and Write Requests

Content
View full analysis

Vulnerability Details

File Location: scripts/gameltbook_api.py, lines 17-21
Additional Locations: SKILL.md, lines 22 and 49; references/api.md, lines 83 and 91
Vulnerability Type: Disabled TLS certificate and hostname verification
Risk Level: Medium

Vulnerable Code

python
parser.add_argument("--form", action="append", default=[], help="Multipart field, format key=value or key=@/path/file")
parser.add_argument("--insecure", action="store_true")
args = parser.parse_args()

headers = {"X-GameltBook-Token": args.token}
context = ssl._create_unverified_context() if args.insecure else None

The resulting unverified context is used for authenticated requests:

python
with urllib.request.urlopen(req, context=context) as resp:

The API reference also presents write operations using certificate verification bypass:

bash
curl -k --request POST --url "$BASE/posts" \
  --header "X-GameltBook-Token: $TOKEN" \
  -F 'content=...'
bash
curl -k --request POST --url "$BASE/posts" \
  --header "X-GameltBook-Token: $TOKEN" \
  -F 'content=<post.txt' \
  -F 'images=@/absolute/path/to/image.jpg'

Technical Analysis

ssl._create_unverified_context() disables certificate-chain validation and hostname verification. When --insecure is enabled, the client can no longer establish that it is communicating with the authentic GameltBook server.

While SKILL.md says the option should only be used after failure and user approval, this policy is not enforced by the code. The API reference also uses curl -k in post-creation examples, which can normalize verification bypass for authenticated write requests.

An active network attacker, compromised proxy, malicious access point, or poisoned DNS path can present any certificate and impersonate the API while this mode is active.

Attack Path

  1. TLS verification fails, or an attacker persuades the operat ...[truncated 1086 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the --insecure option from authenticated production workflows.
  • Remove every curl -k example and ensure all examples use normal certificate validation.
  • Repair the server certificate chain and hostname configuration rather than bypassing validation.
  • If a private certificate authority is required, support an explicit trusted CA bundle through a controlled configuration option.
  • If insecure mode must remain for diagnostics, prohibit authentication headers, file uploads, and all write methods while it is active.
  • Display a prominent warning and require an explicit interactive confirmation that cannot be supplied through untrusted content.
  • Add tests confirming that invalid, expired, self-signed, and hostname-mismatched certificates are rejected.
  • Rotate tokens after any use over an unverified TLS connection.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 15)May include surrounding context.

md
- Prefer HTTPS with certificate validation enabled.
- Only use a direct IP fallback if hostname resolution clearly fails in the target runtime.
- If TLS verification fails because the server certificate chain is broken, confirm the failure first, then use `curl -k` only when the user explicitly wants work to continue despite the TLS issue.
- For write actions, show the exact request body before sending if the content was not already approved by the user.
- Capture response status and JSON body whenever possible.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill enables network access and authenticated API operations but does not declare an explicit tool scope such as allowed-tools or permissions. That makes the capability boundary ambiguous and increases the chance an agent can invoke networked actions, including authenticated writes, without a clear policy constraint or user-visible guardrail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says the skill accesses the forum API with a local auth token and can create or update content, but it does not clearly warn users that using the skill may perform authenticated HTTP actions on their behalf. In context, this is more dangerous because the skill is not just informational: it can publish or modify forum content, so inadequate disclosure raises the risk of unintended privileged actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 15)May include surrounding context.

md
- Prefer HTTPS with certificate validation enabled.
- Only use a direct IP fallback if hostname resolution clearly fails in the target runtime.
- If TLS verification fails because the server certificate chain is broken, confirm the failure first, then use `curl -k` only when the user explicitly wants work to continue despite the TLS issue.
- For write actions, show the exact request body before sending if the content was not already approved by the user.
- Capture response status and JSON body whenever possible.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The write examples use curl -k in the actual command snippets, which normalizes disabling TLS certificate verification during authenticated POST requests. Because the same skill uses a local auth token, this can expose credentials and content to interception or redirection by an active network attacker.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is described as a forum-content API helper, but the reference exposes login, signup, and admin promotion endpoints that go beyond that stated purpose. Including privileged account-management capabilities in a broadly usable skill increases the chance an agent will invoke sensitive actions with the local bot token, enabling privilege escalation or unauthorized account changes if misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script allows callers to disable TLS certificate verification via the --insecure flag by creating an unverified SSL context. This enables man-in-the-middle interception or response tampering if the tool is used over HTTPS on an untrusted network, and the risk is amplified because the script sends an authentication token in a custom header.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The notes say to prefer HTTPS with certificate validation enabled and to use curl -k only after confirming TLS failure and only when the user explicitly wants to continue. However, the create-post examples and the 'Verified working flow' present curl -k as the default demonstrated command without those conditions, which contradicts the stated intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.