ClawHub
Back to skill

Security audit

Tafu BaZi

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it sends sensitive birth data and an API key to a configurable external endpoint without enough guardrails.

Review before installing. Use it only if you trust Tafu with the submitted birth data and the paid API key. Do not configure TAFU_API_BASE_URL unless it is a trusted HTTPS endpoint you control, and avoid the documented fixed /tmp file examples for real personal data unless they are changed to use private temporary files with cleanup.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tafu_api.sh:17
Finding

Unrestricted API base URL override can disclose credentials and personal data

Content
View full analysis

Vulnerability Details

File Location: scripts/tafu_api.sh, lines 17-53
Vulnerability Type: Unvalidated destination used for authenticated requests
Risk Level: Medium

Vulnerable Code

sh
BASE_URL="${TAFU_API_BASE_URL:-https://api.tafu.me/api/v1}"

case "$PATH_INPUT" in
  /*) PATH_SUFFIX="$PATH_INPUT" ;;
  *) PATH_SUFFIX="/$PATH_INPUT" ;;
esac

BASE_URL="$(printf '%s' "$BASE_URL" | sed 's:/*$::')"
URL="${BASE_URL}${PATH_SUFFIX}"

if [ "$BODY_INPUT" = "" ]; then
  exec curl -sS --fail-with-body \
    -X "$METHOD" \
    -H "Authorization: Bearer $TAFU_API_KEY" \
    "$URL"
fi

case "$BODY_INPUT" in
  @*)
    BODY_FILE="${BODY_INPUT#@}"
    exec curl -sS --fail-with-body \
      -X "$METHOD" \
      -H "Authorization: Bearer $TAFU_API_KEY" \
      -H "Content-Type: application/json" \
      --data-binary "@${BODY_FILE}" \
      "$URL"
    ;;
  *)
    exec curl -sS --fail-with-body \
      -X "$METHOD" \
      -H "Authorization: Bearer $TAFU_API_KEY" \
      -H "Content-Type: application/json" \
      --data-binary "$BODY_INPUT" \
      "$URL"
    ;;
esac

Technical Analysis

The script allows TAFU_API_BASE_URL to determine the destination of every API request without validating its scheme, hostname, port, or URL structure. The script subsequently attaches the TAFU_API_KEY bearer token to that destination.

Consequently, anyone capable of modifying the skill's environment configuration can redirect authenticated requests to an attacker-controlled server. The override also permits cleartext http:// destinations, which could expose the bearer token and request data to network interception.

Request bodies can contain birth dates, birth times, gender, location, and compatibility information for multiple people. The issue therefore affects both credentials and personal data.

Attack Path

  1. An attacker gains the ability to alter the skill envi ...[truncated 1113 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove TAFU_API_BASE_URL support if endpoint customization is unnecessary.
  • If an override is required, parse it and enforce an explicit allowlist of trusted hostnames.
  • Require the https scheme and reject cleartext HTTP, URL user information, fragments, unexpected ports, malformed URLs, and hostname suffix tricks.
  • Construct the authorization header only after destination validation succeeds.
  • Consider maintaining separate allowlists for production and approved development endpoints.
  • Fail closed with a clear error when validation fails.
  • Rotate TAFU_API_KEY immediately if requests may already have been redirected.
  • Apply least-privilege and spending limits to API keys where supported.

T09 · Insecure Skill Coding Practices

Warning
Location
references/examples.md:27
Finding

Predictable temporary files retain sensitive birth data and permit symlink clobbering

Content
View full analysis

Vulnerability Details

File Location: references/examples.md, lines 27-39
Vulnerability Type: Unsafe predictable temporary file handling
Risk Level: Medium

Vulnerable Code

sh
cat >/tmp/tafu-bazi.json <<'EOF'
{
  "gender": "male",
  "calendarType": "solar",
  "birthYear": 1990,
  "birthMonth": 6,
  "birthDay": 15,
  "birthHour": 14,
  "birthMinute": 30,
  "location": "北京"
}
EOF
{baseDir}/scripts/tafu_api.sh POST /bazi/calculate @/tmp/tafu-bazi.json

Technical Analysis

The documented workflow writes personal data to a fixed path in the globally shared /tmp directory. It does not set a restrictive umask, create the file atomically, verify that the destination is a regular file owned by the current user, or remove the file after use.

A predictable filename introduces two related risks:

  1. Depending on the process umask and platform configuration, another local user may be able to read birth and location information from the file.
  2. Shell redirection follows symbolic links. A local attacker can pre-create /tmp/tafu-bazi.json as a symbolic link to another file writable by the skill process. The subsequent redirection truncates and replaces that target with JSON.

The file remains on disk after the API request, increasing the period during which sensitive data can be recovered. The same unsafe pattern is also used for the thematic-reading example with another predictable /tmp filename.

Attack Path

  1. A local attacker predicts the documented path /tmp/tafu-bazi.json.
  2. Before the skill workflow runs, the attacker creates that path as a symbolic link to a file writable by the victim account, or monitors the path for creation.
  3. The workflow executes cat >/tmp/tafu-bazi.json.
  4. If a symbolic link was planted, the shell follows it and truncates or overwrites the linked target. Otherwise, the sensitive JSON is created under a known name and may be e ...[truncated 659 chars]
Remediation
View remediation

Remediation Suggestions

  • Set umask 077 before creating files that contain personal data.
  • Use mktemp to create an unpredictable file atomically, and verify that creation succeeds.
  • Register a cleanup trap so the file is removed on normal exit, interruption, or error.
  • Keep temporary files in a private runtime directory where available.
  • Do not reuse fixed filenames across requests.
  • Prefer sending JSON through standard input so no temporary file is required, after adding safe standard-input support to the wrapper.
  • A hardened pattern would be:
sh
umask 077
body_file="$(mktemp "${TMPDIR:-/tmp}/tafu-bazi.XXXXXX.json")" || exit 1
trap 'rm -f -- "$body_file"' EXIT HUP INT TERM

cat >"$body_file" <<'EOF'
{
  "gender": "male",
  "calendarType": "solar",
  "birthYear": 1990,
  "birthMonth": 6,
  "birthDay": 15,
  "birthHour": 14,
  "birthMinute": 30,
  "location": "北京"
}
EOF

{baseDir}/scripts/tafu_api.sh POST /bazi/calculate "@$body_file"

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md
3. Poll up to 12 times, or stop earlier if status becomes `completed` or `failed`
4. If it is still pending after the polling window, tell the user the task is still running and include the `taskId`

## Output Rules

- Preserve the API result as the factual source.
- You may add a short top summary, but do not discard or rewrite away important structured output.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill requires shell execution via sh and curl but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime may permit broader command execution than intended, increasing the risk of shell abuse or unexpected lateral actions if the skill is invoked with adversarial input.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

The skill sends user-supplied birth data, including sensitive personal information such as date/time of birth and location, to an external third-party API. Even if this is expected functionality, it is still a data exfiltration boundary involving highly sensitive personal data and an API key, so misuse, overcollection, or inadequate disclosure could expose private information.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
- `TAFU_API_KEY`
- `TAFU_API_BASE_URL` if present
- otherwise defaults to `https://api.tafu.me/api/v1`

If you need concrete payload examples, read `{baseDir}/references/examples.md`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The examples demonstrate sending full birth data, including date, time, location, and gender, to a paid third-party API without any privacy warning, consent guidance, retention notice, or data-minimization advice. In this skill's context, that data is intrinsically sensitive because it can identify individuals and reveals personal profile information that users may reasonably expect to remain private.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tafu_api.sh (reported line 18)May include surrounding context.

sh
METHOD="$1"
PATH_INPUT="$2"
BODY_INPUT="${3:-}"
BASE_URL="${TAFU_API_BASE_URL:-https://api.tafu.me/api/v1}"

case "$PATH_INPUT" in
  /*) PATH_SUFFIX="$PATH_INPUT" ;;

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tafu_api.sh (reported line 29)May include surrounding context.

sh
URL="${BASE_URL}${PATH_SUFFIX}"

if [ "$BODY_INPUT" = "" ]; then
  exec curl -sS --fail-with-body \
    -X "$METHOD" \
    -H "Authorization: Bearer $TAFU_API_KEY" \
    "$URL"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This shell script sends requests to a remote API using curl and may transmit user-supplied JSON bodies or the contents of a local file via --data-binary. Aside from a usage string and missing-key check, there is no confirmation prompt, logging, comment, or docstring disclosing that local data will be sent to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script reads the TAFU_API_KEY environment variable and uses it as a bearer token for outbound requests. While the variable is required for operation, there is no comment or user-facing disclosure that the skill consumes sensitive credentials and transmits them in an Authorization header.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.