T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:34- Finding
API Credentials Exposed Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentWeb.live — Global Business Directory
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches a business-directory integration, but it under-discloses write actions and handles API keys in a risky way.
Review this skill before installing. Use it for lookups only unless you intentionally want the agent to submit business contributions or reports to AgentWeb. Prefer supplying AGENTWEB_API_KEY through a secret or environment variable and using header authentication, not api_key in URLs. Do not use the email registration option unless you are comfortable creating an AgentWeb account through the agent.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest presents the skill as a read-only business lookup tool, but the instructions also authorize account registration and remote data modification. This mismatch can cause the skill to be invoked in contexts where users and orchestrators expect only retrieval, leading to unexpected disclosure of user data and unintended state-changing actions on a third-party service.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to send the user's email address to AgentWeb to create an API account, even though the skill is described primarily as a business lookup integration. Transmitting user contact data to a third party for account provisioning introduces privacy and consent risk, and may create persistent external accounts the user did not fully understand or intend.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The registration curl example explicitly transmits user email to AgentWeb, which is a meaningful external data flow with privacy implications. In this context, the transmission is more dangerous because it also provisions a new account and returns a reusable API key, expanding the consequences of mishandling.
- Content
If they choose option 2, register via curl:
bash curl -s -X POST https://api.agentweb.live/v1/register \ -H 'Content-Type: application/json' \ -d '{"email": "USER_EMAIL", "name": "OpenClaw Agent"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The registration curl example explicitly transmits user email to AgentWeb, which is a meaningful external data flow with privacy implications. In this context, the transmission is more dangerous because it also provisions a new account and returns a reusable API key, expanding the consequences of mishandling.
- Content
If they choose option 2, register via curl:
bash curl -s -X POST https://api.agentweb.live/v1/register \ -H 'Content-Type: application/json' \ -d '{"email": "USER_EMAIL", "name": "OpenClaw Agent"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instruction to save and reuse the returned API key treats a credential as ordinary session data without any handling safeguards. If the key is logged, echoed, stored insecurely, or reused across contexts, it could allow unauthorized access to the user's AgentWeb account and quota.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow includes contributing businesses and reporting problems, which are state-changing operations beyond the stated lookup purpose. Hidden write actions increase the risk of unauthorized or accidental modification of third-party data, especially if the skill is auto-selected for generic business-information tasks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The contribute endpoint transmits business data to a third-party service and performs a state-changing write operation. Even though the text says to ask for approval, this is riskier than ordinary lookup because it can create or alter public directory entries and may send inaccurate, copyrighted, or sensitive information if safeguards fail.
- Content
Contribute a business
bash curl -s -X POST "https://api.agentweb.live/v1/contribute?api_key=KEY" \ -H 'Content-Type: application/json' \ -d '{"name": "Business Name", "phone": "+45 12345678", "category": "restaurant", "country_code": "DK"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The report endpoint sends data externally and changes the status of third-party directory records, which is a state-changing action with potential reputational and operational impact on listed businesses. If triggered incorrectly or without clear authorization, it could submit false reports or cause abuse of the external service.
- Content
Report a problem
bash curl -s -X POST "https://api.agentweb.live/v1/report?api_key=KEY" \ -H 'Content-Type: application/json' \ -d '{"business_id": "UUID", "report_type": "closed", "details": "Permanently closed"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # AgentWeb API Reference Base URL: `https://api.agentweb.live/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # AgentWeb API Reference Base URL: `https://api.agentweb.live/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # AgentWeb API Reference Base URL: `https://api.agentweb.live/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # AgentWeb API Reference Base URL: `https://api.agentweb.live/v1` ## Authentication
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Allowing API keys in query parameters is unsafe because URLs are commonly logged by servers, proxies, browser history, analytics systems, and error trackers. That increases the chance of credential leakage and unauthorized reuse of the API key, especially in agent systems that may surface request URLs in logs or telemetry.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is described as search and retrieval only, but the API docs expose mutation endpoints for contributing and reporting data. This expands the capability surface beyond the declared purpose, creating risk that an agent or integrator could perform unauthorized external writes, data poisoning, or reputation-impacting actions against third-party records.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest description says to use the skill whenever a user needs to find a business or obtain common business details like phone numbers, addresses, emails, or websites. This is broad natural-language routing guidance and does not define exclusions or narrower trigger conditions, which may cause unintended invocation for generic lookup requests that are not clearly intended for AgentWeb.live.
- Content