XUNBEE Message Inbox

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:22 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent read-only XUNBEE inbox helper, but it can send the user's sensitive message-reading API key to any configured HTTPS base URL instead of technically limiting it to the official service.

Install only if you trust the publisher and will use the default XUNBEE API host or a XUNBEE server you personally control. Do not set XUNBEE_BASE_URL from prompts, webpages, copied commands, or untrusted configuration, and revoke the XUNBEE key if it may have been sent to the wrong host.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xunbee_inbox.py:21

Finding

API Key Disclosure Through an Unrestricted HTTPS Base URL

Content

View full analysis

Vulnerability Details

File Location: scripts/xunbee_inbox.py, lines 21–30, 54–65, and 138–142
Vulnerability Type: Credential disclosure through insufficient destination validation
Risk Level: High

Vulnerable Code

python

def _base_url(value: str) -> str:
    parsed = urlsplit(value.strip())
    if parsed.scheme != "https" or not parsed.netloc:
        raise InboxClientError("XUNBEE base URL must be an absolute HTTPS URL")
    if parsed.username or parsed.password or parsed.query or parsed.fragment:
        raise InboxClientError(
            "XUNBEE base URL must not contain credentials, query, or fragment"
        )
    return urlunsplit((parsed.scheme, parsed.netloc, parsed.path.rstrip("/"), "", ""))

python

url = f"{_base_url(args.base_url)}{MESSAGES_PATH}?{urlencode(query)}"
request = Request(
    url,
    headers={
        "Accept": "application/json",
        "Authorization": f"Bearer {_api_key()}",
    },
    method="GET",
)
try:
    with urlopen(request, timeout=args.timeout) as response:
        payload = json.load(response)

python

parser.add_argument(
    "--base-url",
    default=os.environ.get("XUNBEE_BASE_URL", DEFAULT_BASE_URL),
)

Technical Analysis

The client reads the sensitive XUNBEE_API_KEY environment variable and sends it in an HTTP Authorization header. Sending this credential to the official XUNBEE API is necessary for the declared inbox-reading functionality.

However, _base_url() validates only that the supplied destination uses HTTPS and has a network location. It does not restrict the destination to the official cc.akuwan.cn origin or another pre-approved set of XUNBEE instances. Any syntactically valid HTTPS host is accepted, and the API key is then attached to the request unconditionally.

The destination can be selected through either the --base-url command-line option or the XUNBEE_BASE_URL envi ...[truncated 2269 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind the API key to the official origin by default. Permit credential-bearing requests only to the exact normalized origin https://cc.akuwan.cn.

2. Use an explicit allowlist for private deployments. If custom XUNBEE instances are required, configure approved origins through trusted administrator-controlled configuration rather than ordinary agent-generated command arguments.

3. Separate credentials by origin. Do not send XUNBEE_API_KEY to a custom origin. Require a separately configured credential associated with that exact origin.

4. Disable or tightly control redirects. Reject cross-origin redirects for authenticated requests. If redirects are supported, compare the scheme, hostname, and effective port of every redirect target with the original approved origin and strip Authorization whenever the origin changes.

5. Validate the final response origin. Ensure the effective response URL remains on the approved origin before parsing or trusting returned data.

6. Restrict URL components further. Normalize hostnames and ports, reject unexpected ports, and avoid allowing arbitrary base paths unless private-instance compatibility explicitly requires them.

7. Reduce agent influence over security configuration. The Skill instructions should prohibit deriving or changing --base-url from user-provided message content, remote pages, or untrusted prompts. Prefer omitting the command-line option in normal agent invocation.

8. Add security tests. Verify that attacker-controlled hosts, alternate ports, user-info URLs, malformed hosts, and cross-origin redirects cannot receive the Bearer token.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .clawhubignore (reported line 5)May include surrounding context.

text

*.py[cod]
.pytest_cache/
.venv/
.env
.env.*
.clawhub/
*.zip

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires environment access for XUNBEE_API_KEY and makes outbound HTTPS requests, but it does not explicitly declare tool permissions or allowed tools. That weakens policy enforcement and reviewability: a host may grant broader capabilities than intended, increasing the chance of secret exposure or unintended network use if the skill is modified or misinterpreted.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

- The user's API key with the `messages:read` scope
- Optional `channel`, `source_ref`, and `keyword` filters

Keep the key in `XUNBEE_API_KEY`; do not ask the user to paste it into chat or
place it in URLs, screenshots, command arguments, logs, or shared output. The
client sends HTTPS requests to `https://cc.akuwan.cn` by default.
`XUNBEE_BASE_URL` may override that destination only when the user explicitly

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file is primarily written in Simplified Chinese and presents Chinese as the default interaction mode, with only a separate English link rather than an explicit user choice in the skill behavior itself. Under the stated policy, forcing a specific language without user opt-in can be a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file is explicitly the English version of the skill documentation and presents its content in English, with only a language switch link at the top. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy concern, and this file does not ask the user to choose a language before presenting instructions.

Content

No source excerpt is available for this finding.