ClawHub
Back to skill

Security audit

Mingdao

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Mingdao APaaS guide, but its examples encourage sensitive identity-data transmission and destructive API actions without enough safeguards.

Install only if you want Mingdao APaaS guidance and treat its API examples as unsafe drafts. Before adapting them, use vetted HTTPS endpoints, least-privilege managed secrets, explicit privacy/legal approval for identity data, request timeouts and error handling, and confirmation/audit/recovery controls for update or delete operations.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:232
Finding

API Credentials May Be Disclosed to an Untrusted Configurable Endpoint

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 232–243
Vulnerability Type: Unrestricted credential transmission
Risk Level: Medium

Vulnerable Code

python
def __init__(self, base_url: str, app_key: str, sign: str):
    self.base_url = base_url.rstrip('/')
    self.app_key = app_key
    self.sign = sign

def _request(self, endpoint: str, payload: dict = None) -> dict:
    url = f"{self.base_url}/api/v2/open{endpoint}"
    data = {"appKey": self.app_key, "sign": self.sign}
    if payload:
        data.update(payload)
    resp = requests.post(url, json=data)
    return resp.json()

Technical Analysis

The example accepts an unrestricted base_url and transmits app_key and sign to that URL on every request. It does not enforce HTTPS, validate the destination hostname against an allowlist, or control redirects. If an attacker can influence configuration, deployment variables, or caller input used to initialize the client, the credentials can be sent to an attacker-operated endpoint.

The request also lacks a timeout and HTTP status validation. An unavailable endpoint can therefore hold the connection open, while non-successful or malformed responses are processed without first calling raise_for_status().

Although this is documentation example code rather than an automatically executed component, copying it directly into a production integration would create an exploitable credential-disclosure condition.

Attack Path

  1. An application adopts the documented MingDaoAPI client.
  2. An attacker influences base_url through configuration manipulation, an exposed environment setting, or untrusted caller input.
  3. The application initializes the client with valid API credentials and the attacker-controlled URL.
  4. A worksheet operation invokes _request().
  5. The client sends appKey and sign in the JSON body to the attacker-controlled server.
  6. The attacker ca ...[truncated 813 chars]
Remediation
View remediation

Remediation Suggestions

  • Require an https:// scheme and reject plaintext HTTP.
  • Parse the URL and compare the normalized hostname and port against an explicit allowlist of approved Mingdao API endpoints.
  • Prevent callers from supplying arbitrary API base URLs unless such configurability is strictly required.
  • Disable redirects for credential-bearing requests or validate every redirect destination before following it.
  • Add bounded connection and read timeouts, for example timeout=(5, 30).
  • Call resp.raise_for_status() before parsing the response body.
  • Validate that the response is expected JSON and handle decoding and network exceptions safely.
  • Store app_key and sign in a managed secret store rather than source code or broadly readable configuration.
  • Use a dedicated API identity with the minimum worksheet and operation permissions required.
  • Avoid logging request bodies, headers, or exception objects that may contain credentials.
  • Update the documentation example to state that base_url must never come from untrusted input.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:148
Finding

External API Example Transmits High-Sensitivity Identity Data Without Required Safeguards

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 148–155
Vulnerability Type: Unsafe transmission of personally identifiable information
Risk Level: Medium

Vulnerable Code

javascript
var response = await fetch('https://api.example.com/verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
        name: input.姓名,
        idcard: input.身份证号
    })
});

Technical Analysis

The workflow example transmits a person's name and identity-card number to an external verification service. It does not demonstrate authentication, endpoint approval, explicit consent, data minimization, tokenization, timeout handling, or controls preventing sensitive request data from being logged.

The example.com hostname indicates that the endpoint is illustrative rather than evidence of an active exfiltration destination. Nevertheless, the example establishes an unsafe implementation pattern for highly sensitive identity data. An implementer could replace the placeholder with an inadequately vetted service or allow the endpoint to become configurable without adding necessary privacy and security controls.

TLS alone does not establish that the recipient is authorized to process the data. Destination governance, certificate validation, processor approval, retention restrictions, and legal authorization remain necessary.

Attack Path

  1. An implementer copies the documented workflow code into a code node.
  2. The placeholder URL is replaced with an unapproved, compromised, or attacker-controlled verification endpoint.
  3. A user submits a record containing a name and identity-card number.
  4. The workflow serializes both fields into a JSON request.
  5. The external endpoint receives and stores or forwards the identity data.
  6. The recipient can misuse the information for identity fraud, profiling, phishing, or unauthorized correlation with other data ...[truncated 651 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the generic example with an explicitly approved endpoint placeholder and prominently warn that identity data must not be sent to an unvetted service.
  • Require a documented business purpose, user authorization or consent where applicable, and an approved data-processing agreement.
  • Minimize transmitted data; use a token, one-way verification mechanism, or partial identifier where the service supports it.
  • Authenticate outbound requests using short-lived, narrowly scoped credentials.
  • Enforce HTTPS and allowlist the normalized destination hostname and port.
  • Add connection and response timeouts, response-status checks, schema validation, and safe exception handling.
  • Ensure request bodies and workflow inputs are excluded from application, proxy, and diagnostic logs.
  • Encrypt sensitive data at rest and define strict retention and deletion periods at both the workflow platform and external processor.
  • Restrict workflow configuration and code-node editing to trusted administrators.
  • Maintain audit logs recording access and verification events without recording the complete identity-card number.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes an example that sends highly sensitive identity data (name and ID card number) to an external API, but it provides no privacy warning, consent requirement, data minimization guidance, or verification of the third party's trustworthiness. In a skill that guides users on workflow/API integrations, this can normalize unsafe handling of PII and lead users to deploy real data exfiltration patterns into production.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The hardcoded external example URL reinforces sending business data to an external service without any trust-boundary discussion, environment segregation, or allowlist guidance. In a low-code automation skill, this lowers the barrier for users to wire production data to arbitrary endpoints, increasing leakage and compliance risk.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

javascript
// 代码节点：调用外部 API
var response = await fetch('https://api.example.com/verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The hardcoded external example URL reinforces sending business data to an external service without any trust-boundary discussion, environment segregation, or allowlist guidance. In a low-code automation skill, this lowers the barrier for users to wire production data to arbitrary endpoints, increasing leakage and compliance risk.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

javascript
// 代码节点：调用外部 API
var response = await fetch('https://api.example.com/verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md
data = {"appKey": self.app_key, "sign": self.sign}
        if payload:
            data.update(payload)
        resp = requests.post(url, json=data)
        return resp.json()

    def get_worksheet_rows(self, worksheet_id: str, page: int = 1,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documented API client exposes a delete_row capability with no surrounding warning about confirmation, authorization checks, soft-delete, backup, or audit requirements. In an operational automation skill, presenting destructive actions as routine examples can contribute to accidental or over-broad deletion of business data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill defines the assistant role entirely in Chinese and does not indicate that users may choose another language. That can amount to a language-policy issue when a skill effectively forces a locale or language without explicit opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.