ClawHub
Back to skill

Security audit

authz-code-design

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local credential-broker skill, but it includes runnable code that handles password-vault secrets and exposes a dashboard PIN in a URL, so users should review it carefully before installing or running it.

Install only if you intentionally want a local KeePass credential-broker prototype. Do not run it with real vault secrets until you remove query-string PIN authentication, avoid printing secret-bearing URLs, and understand that the broker can return passwords to any local caller that has the PIN.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared purpose is conceptual and architectural: providing reusable guidance for secure authorization and local credential brokering. The supplied code instead performs a concrete reporting task: it invokes a security-check function, computes overall scores, and emits JSON/SVG output for an 8-dimension security radar chart. While the topic is adjacent to credential broker security, the primary behavior is measurement and visualization, not designing or answering how to issue temporary permissions, keep secrets out of model context, or revoke access. This is a material purpose mismatch.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
| 文档与理论文本 | 本 `SKILL.md`、`README.md`、其中「理论依据」段与一切理论表述 | **不在 MIT 覆盖范围内**：保留所有权利（All rights reserved） |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
| 文档与理论文本 | 本 `SKILL.md`、`README.md`、其中「理论依据」段与一切理论表述 | **不在 MIT 覆盖范围内**：保留所有权利（All rights reserved） |

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/broker-arch.svg (reported line 5)May include surrounding context.

text
<rect width="680" height="360" fill="#ffffff"/>
  <text x="24" y="30" font-size="16" font-weight="700" fill="#185FA5">授权码 / 本地 Broker 架构（零知识 · 秘不进模型上下文）</text>

  <!-- 三栏 -->
  <rect x="24" y="50" width="150" height="250" rx="8" fill="#f5f7fa" stroke="#d6dbe3"/>
  <text x="99" y="72" font-size="12" font-weight="700" fill="#534AB7" text-anchor="middle">AI agent / 本地程序</text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/broker-arch.svg (reported line 27)May include surrounding context.

text
<text x="218" y="143" font-size="9.5" fill="#2E8B57" text-anchor="middle">JWT (HS256)</text>
  <text x="218" y="168" font-size="8.5" fill="#888" text-anchor="middle">exp≤900s · 秘不进</text>

  <!-- 箭头 3 fulfill -->
  <line x1="174" y1="200" x2="263" y2="200" stroke="#534AB7" stroke-width="1.6" marker-end="url(#ar)"/>
  <text x="218" y="193" font-size="9.5" fill="#534AB7" text-anchor="middle">POST /fulfill</text>

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tools/credential_broker.py (reported line 25)May include surrounding context.

python
- 审计内容不含密码，只含 jti(截断)/title/scope/device/bio/时间，且哈希链防篡改。

真实部署建议：
  - VAULT_PASSPHRASE 应由本机 OS 凭证库（DPAPI/Keychain/HUKS）在本地解锁时提供。
  - 审计 key（broker_audit.key）存本机 chmod 600，生产应进 OS 凭证库。
  - 生物解锁（WinHello/HUKS）真实对接需本机 TPM/安全芯片，本原型仅记录 biometric
    标记字段，真实校验在 unlock 调用方（本机 OS）完成。

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The broker prints a dashboard URL containing the authentication PIN in plaintext, directly contradicting the design goal of keeping secrets out of logs and user-visible output. Console output is commonly captured by terminal history, supervisors, CI logs, screenshots, or agent transcripts, so anyone with that output can access the dashboard and sensitive vault metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Embedding the PIN in a query string causes secret exposure beyond the terminal: URLs are often stored in browser history, copied into bug reports, logged by tooling, and leaked via screenshots or clipboard history. In this broker context, the dashboard reveals credential inventory, usernames, URLs, active tokens, and audit history, which materially aids further compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring and runtime messages are entirely in Chinese, which imposes a specific language/locale on operators without any opt-in or explanation that the tool is region-specific. Under the policy, forced language choice is a natural-language violation unless the skill offers alternatives or clearly justifies the locale restriction.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · tools/credential_broker.py (reported line 26)May include surrounding context.

python
真实部署建议：
  - VAULT_PASSPHRASE 应由本机 OS 凭证库（DPAPI/Keychain/HUKS）在本地解锁时提供。
  - 审计 key（broker_audit.key）存本机 chmod 600，生产应进 OS 凭证库。
  - 生物解锁（WinHello/HUKS）真实对接需本机 TPM/安全芯片，本原型仅记录 biometric
    标记字段，真实校验在 unlock 调用方（本机 OS）完成。

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · tools/credential_broker.py (reported line 90)May include surrounding context.

python
真实部署建议：
  - VAULT_PASSPHRASE 应由本机 OS 凭证库（DPAPI/Keychain/HUKS）在本地解锁时提供。
  - 审计 key（broker_audit.key）存本机 chmod 600，生产应进 OS 凭证库。
  - 生物解锁（WinHello/HUKS）真实对接需本机 TPM/安全芯片，本原型仅记录 biometric
    标记字段，真实校验在 unlock 调用方（本机 OS）完成。

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The code reads VAULT_PASSPHRASE from the environment and immediately uses it to unlock the vault, but there is no user-facing warning near execution that a high-value secret is being sourced from process environment state. For code files, access to sensitive credentials should include some visible disclosure unless already clearly warned elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This Python file contains user-facing natural-language documentation and output strings entirely in Chinese, including the title, usage, and result descriptions. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and subsequent user-facing labels and test entry names are written in Chinese, indicating the skill behavior and outputs are localized to a specific language by default. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · tools/credential_broker_test.py (reported line 94)May include surrounding context.

python
# 6 dashboard 只读面板
    try:
        with urllib.request.urlopen(f"http://127.0.0.1:{PORT}/dashboard?pin={PIN}",
                                    timeout=5) as resp:
            html = resp.read().decode()
        check("dashboard 200含分组树", resp.status == 200

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file begins with a Chinese-only scope notice and licensing explanation, while the policy category requires flagging language or locale constraints that are imposed without opt-in or clear justification. Nothing in these lines offers an alternative language choice or explains that the locale restriction is necessary for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This SVG contains user-facing labels entirely in Chinese across the diagram, including the title and all operational annotations. For an all-file-types policy check, this can constitute a language/locale policy violation when the skill content forces a specific language without user opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This SVG contains all user-visible labels in Chinese, including the title, legend, and axis names. For a file type subject to natural-language policy review, forcing a single language without opt-in or stated regional scope can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.