T09 · Insecure Skill Coding Practices
Error
- Location
.env:7- Finding
Live-Looking API and Facebook Credentials Distributed in the Project
- Content
View full analysis
- Remediation
View remediation
Security audit
asdsadasd
Security checks for vulnerabilities and agentic risk
Overview
The skill's main purpose is clear, but it ships live-looking credentials and can automatically publish AI-generated content to a Facebook Page without a required approval step.
Review before installing. Remove the bundled .env, rotate every exposed credential, replace it with a placeholder .env.example, pin dependencies, require dry-run or explicit approval before every Facebook publish action, limit Facebook token scopes, and run the crawler in an environment that cannot reach private/internal services.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
agents/fb_token_helper.py:90- Finding
Long-Lived Facebook Tokens Are Printed and Persisted in Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
utils.py:19- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
tuple[bool, str]: """Validate if a string is a proper URL.""" url = url.strip() if not url: return False, "URL is empty" if not url.startswith(("http://", "https://")): url = "https://" + url try: parsed = urlparse(url) if not parsed.netloc: return False, f"Invalid URL: no domain found in '{url}'" return True, url except Exception as e: return False, f"Invalid URL: {e}" ``` The validated URL is then fetched directly: ```python def _scrape_direct( self, url: str, source_type: str ) -> ScrapedContent: """Scrape using requests + BeautifulSoup.""" try: response = requests.get( url, headers=HEADERS, timeout=30 ) response.raise_for_status() response.encoding = response.apparent_encoding or "utf-8" ``` ### Technical Analysis The validation accepts any HTTP or HTTPS destination with a nonempty `netloc`. It does not reject: - Loopback addresses such as `127.0.0.1` or `::1`. - RFC 1918 private networks. - Link-local and multicast ranges. - Hostnames resolving to private addresses. - Cloud instance metadata services. - Alternate numeric representations of restricted IP addresses. - Public URLs that redirect to restricted destinations. The `requests` library follows redirects by default. Consequently, validating only the initial string is insufficient. DNS rebinding may also cause a hostname that initially appears public to resolve to a private address when fetched. If the target returns HTML-like text, the crawler extracts it and can subsequently send it to Gemini thr ...[truncated 1220 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
agents/writer_agent.py:68- Finding
Untrusted Scraped Instructions Can Influence Automatically Published Content
- Content
View full analysis
config.MAX_CAPTION_LENGTH: caption = truncate_text( caption, config.MAX_CAPTION_LENGTH ) hashtags = data.get("hashtags", []) hashtags_str = " ".join( f"#{tag}" if not tag.startswith("#") else tag for tag in hashtags ) result = GeneratedContent( source_url=scraped.url, title=data.get("title", ""), caption=caption + ( f"\n\n{hashtags_str}" if hashtags_str else "" ), hashtags=hashtags, image_prompt=data.get("image_prompt"), original_title=scraped.title, ) ``` The generated content is published without an approval gate in normal mode: ```python post_text = written.caption if schedule_ts: result = publisher.post_scheduled( post_text, schedule_ts ) elif use_image and image_url: result = publisher.post_with_image_url( post_text, image_url ) else: result = publisher.post_text(post_text) results["post"] = result ``` ### Technical Analysis Article text, title, description, and author are untrusted remote data. A malicious page can em ...[truncated 2107 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Open-Ended Dependency Constraints Make Builds Non-Reproducible
- Content
View full analysis
=1.30.0 requests>=2.31.0 apify-client>=1.7.0 python-dotenv>=1.0.0 pillow>=10.0.0 rich>=13.7.0 httpx>=0.27.0 google-genai>=1.0.0 beautifulsoup4>=4.12.0 lxml>=5.0.0 openclaw>=2026.3.0 ``` The documented installation command resolves these unconstrained future versions: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended lower bound and the project provides no lockfile or package hashes. A future version satisfying `>=` can therefore be selected without having been reviewed with the project. This is not evidence that any listed package is currently malicious. The issue is that installation is non-reproducible and implicitly trusts all future releases and transitive dependency resolutions. A compromised upstream account, malicious future release, or breaking behavioral change could affect the Skill without any modification to its source code. Python packages can execute code during installation or when imported. The project imports several packages during normal startup and pipeline execution. ### Attack Path 1. A dependency or one of its transitive dependencies publishes a compromised future release. 2. The release version satisfies the project’s open-ended `>=` constraint. 3. A user follows the documented `pip install -r requirements.txt` command. 4. The resolver installs the compromised or incompatible version. 5. Malicious behavior may execute during installation or import under the user’s privileges. 6. Because the application loads valuable API tokens into its environment, compromised dependency code could access those credentials. ### Impact Assessment Potential impact includes: - Execution of upstream package code with the installing user’s privileges. - Thef ...[truncated 441 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (87)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text FB_CLIENT_TOKEN=5eab434a4237521a17f16967244c0547 # --- Facebook Page --- # TODO: điền sau khi chạy token_helper.py để lấy Page Access Token FB_PAGE_ID=450928874763140 FB_PAGE_ACCESS_TOKEN=EAANKzZCeedAQBQxLjrW3TCBon8vAB42Xeth6DuZBnSgOGLUqUvMKZASZCM91UJNmLsIfCLZBSy4ZCfZBR03r9ZAVRgXmCaFCIGhpir75ZBLkFmSJR1TaVKZChZAYUVoV1BPvPaCfq23KmTQa9jNcKm1SNyXRKKltgSreLGFOwfsPYnX8ideU5xZBZA8OYB7G2Q9kuHAve75EYaTua9OBW9PmKQeZBScxwhM6LE4MMhlX5c2zllYu8ZD
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text .env __pycache__/ *.pyc *.pyo
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The credential-related setup step explicitly directs users to open a .env that allegedly already contains app IDs and API keys. In context, this is not a generic mention of secrets management; it indicates bundled or shared credentials, which materially increases the risk of unauthorized access and credential reuse.
- Content
pip install -r requirements.txt
text ### Bước 2: Điền .env Mở file `.env` — đã có sẵn App ID, API keys. Chỉ cần điền: ```env FB_USER_ACCESS_TOKEN= ← lấy từ bước 3
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 85% confidence
- Finding
The README instructs users to obtain a Page Access Token and copy it into .env for an automated publisher. In this skill context, access tokens grant direct control over posting to a Facebook page, so poor handling or sharing of such tokens can enable account misuse, unauthorized publication, and persistent abuse until rotated.
- Content
bash python agents/fb_token_helper.pyLàm theo hướng dẫn → copy Page Access Token vào
.env.Bước 4: Test kết nối
bash
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README publishes live-looking service credentials and identifiers, including what appears to be an OpenAI key prefix and Apify token, and states that keys already exist in the .env. Even if partially redacted, distributing credential material in documentation encourages secret sharing and may expose real or reusable access, enabling unauthorized API use, account abuse, or further credential harvesting.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Testing app credentials, validating page tokens, and reading page metadata are Facebook account interactions that should be disclosed, especially when the skill is marketed primarily as content crawling and rewriting. Even read-only credential validation expands exposure of sensitive integrations and may normalize collection of powerful secrets without sufficient warning.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ agents/fb_token_helper.py ────────────────────────── Tiện ích lấy và exchange Facebook Access Token. Chạy trực tiếp: python agents/fb_token_helper.py
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ agents/fb_token_helper.py ────────────────────────── Tiện ích lấy và exchange Facebook Access Token. Chạy trực tiếp: python agents/fb_token_helper.py
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ agents/fb_token_helper.py ────────────────────────── Tiện ích lấy và exchange Facebook Access Token. Chạy trực tiếp: python agents/fb_token_helper.py
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ agents/fb_token_helper.py ────────────────────────── Tiện ích lấy và exchange Facebook Access Token. Chạy trực tiếp: python agents/fb_token_helper.py
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ agents/fb_token_helper.py ────────────────────────── Tiện ích lấy và exchange Facebook Access Token. Chạy trực tiếp: python agents/fb_token_helper.py
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ agents/fb_token_helper.py ────────────────────────── Tiện ích lấy và exchange Facebook Access Token. Chạy trực tiếp: python agents/fb_token_helper.py
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_page_tokens(long_lived_user_token: str) -> list[dict]: """ Lấy danh sách Pages + Page Access Tokens từ long-lived user token. """ url = f"{config.FB_BASE_URL}/me/accounts" params = {"access_token": long_lived_user_token}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_page_tokens(long_lived_user_token: str) -> list[dict]: """ Lấy danh sách Pages + Page Access Tokens từ long-lived user token. """ url = f"{config.FB_BASE_URL}/me/accounts" params = {"access_token": long_lived_user_token}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The script prints the long-lived user token and page access tokens directly to the console as .env entries. Console output is often captured in terminal history, logs, screen recordings, remote shells, or shared sessions, which can expose reusable Facebook credentials.
- Content
python ) console.print(table) # Save to .env hint console.print("\n[bold green]✅ XONG! Cập nhật .env:[/bold green]") for page in pages: console.print(f"\nPage: [bold]{page.get('name')}[/bold] (ID: {page.get('id')})")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md """ config.py — Centralized configuration loaded from .env """ import os from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md """ config.py — Centralized configuration loaded from .env """ import os from dotenv import load_dotenv
Static analysis
No suspicious patterns detected.