ClawHub
Back to skill

Security audit

Ima Skills 1.0.4

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent IMA notes integration, but it needs Review because it can read and permanently modify private notes using persistent API credentials with broad activation rules and no explicit confirmation requirement for writes.

Install only if you are comfortable giving the agent authenticated access to search, read, create, and append your IMA notes. Prefer injecting the API key only when needed or using a secret manager rather than storing it in shell startup files, and manually confirm the target note/folder and content before any create or append operation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:27
Finding

Plaintext API Credential Storage in Shell Startup Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–31
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable code:

bash
export IMA_OPENAPI_CLIENTID="your_client_id"
export IMA_OPENAPI_APIKEY="your_api_key"

The adjacent setup instruction recommends placing these export statements directly in ~/.zshrc or ~/.bashrc so that the credentials persist across terminal sessions.

Technical Analysis

The API key grants access to operations involving private IMA notes. Persisting it as plaintext in a shell startup file unnecessarily increases its exposure period and the number of mechanisms through which it may be disclosed.

Shell profiles may be accessible to malware running under the same user account, local users with sufficient file permissions, compromised development tools, backup systems, diagnostic archives, or accidental configuration-file sharing. Environment variables exported from these files may also propagate to child processes, increasing the number of processes that can potentially access the secret.

Although the displayed values are placeholders rather than hardcoded live credentials, the documented setup procedure directs users to replace them with real credentials and store those credentials persistently in plaintext.

Attack Path

  1. A user follows the setup instructions and writes a valid client ID and API key into ~/.zshrc or ~/.bashrc.
  2. An attacker gains the ability to read files owned by that user, such as through same-account malware, a compromised editor extension, an exposed backup, or overly permissive file permissions.
  3. The attacker reads the shell startup file and extracts IMA_OPENAPI_CLIENTID and IMA_OPENAPI_APIKEY.
  4. The attacker submits authenticated requests to the documented IMA endpoint at https://ima.qq.com/openapi/note/v1.
  5. Subject to the permissions associated with the stolen credentials, the attacke ...[truncated 793 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not recommend storing API credentials directly in ~/.zshrc, ~/.bashrc, or other routinely accessed configuration files.
  2. Store credentials in an operating-system credential manager, such as macOS Keychain, Windows Credential Manager, or a Linux secret service.
  3. For automated environments, use the platform's dedicated secret-management facility and inject credentials only into the process that needs them.
  4. If a secret file is unavoidable, keep it outside the project directory, restrict it to the owning user with permissions equivalent to 0600, and load it only when required.
  5. Avoid passing secrets through command-line arguments or logging them in command output, debugging traces, or error messages.
  6. Document credential revocation and rotation procedures, including immediate rotation following suspected local compromise.
  7. Prefer short-lived or narrowly scoped credentials if the IMA service supports them.
  8. Retain the existing credential-presence check, but supplement it with guidance that environment variables are an injection mechanism rather than a secure long-term storage mechanism.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are overly broad, activating on vague phrases like '帮我记一下', prior writings, or saving text, and even for general personal document access. This can cause the skill to capture unrelated conversations or route ordinary requests into note read/write flows, increasing the chance of unauthorized persistence, retrieval, or disclosure of private information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documents creation and append operations against persistent user notes without requiring a clear warning or confirmation that data will be modified and stored remotely. This raises the risk of accidental writes, unintended long-term retention, and user surprise when conversational content is committed to personal notes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

bash
ima_api() {
  local endpoint="$1" body="$2"
  curl -s -X POST "https://ima.qq.com/openapi/note/v1/$endpoint" \
    -H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
    -H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
    -H "Content-Type: application/json" \

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to read arbitrary local files such as 'tmpfile' and invoke external runtimes/tools (python3, node, iconv, PowerShell) to transform content before upload. In a note-management skill, this expands scope beyond justified API use and can enable unintended local file access or exfiltration of sensitive host/user data into the remote note service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill exposes write operations that create new notes and append content to existing notes, but it does not explicitly require a confirmation step or clearly warn that these are persistent, state-changing actions. In an agent setting, ambiguous user prompts like '记一下' or '保存下来' could cause unintended writes to a personal knowledge base, creating privacy, integrity, and user-trust risks even if the API itself is authenticated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.