ClawHub
Back to skill

Security audit

Logistics Tracker

Security checks for vulnerabilities and agentic risk

Overview

This shipment-tracking skill does what it says, but it uses an unsafe setup flow that asks users to paste an API key into chat and save it inside the skill file.

Review before installing. Do not paste a Track123 API key into chat or allow the agent to write it into SKILL.md; use a protected environment variable or secret store instead. Be aware that tracking numbers will be sent to Track123, which may reveal shipment activity and delivery metadata.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:69
Finding

API Key Requested Through Chat and Persisted in Plaintext

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69-71
Vulnerability Type: Plaintext credential exposure and insecure secret management
Risk Level: High

Vulnerable Code

markdown
**API Key Setup (first time only)**

If the curl commands below still contain `$TRACK123_API_KEY`, ask the user to visit **https://www.track123.com/api** → Dashboard → API tab → copy and paste the key here. Once received, replace `$TRACK123_API_KEY` in this skill file with the actual key value.

Technical Analysis

The Skill instructs the user to paste a Track123 API key into the conversation and then directs the Agent to replace the environment-variable reference in SKILL.md with the actual credential. This exposes the secret through two separate insecure channels:

  1. The API key enters conversation history, Agent context, and potentially platform logs.
  2. The API key is persisted as plaintext in a project file that may be committed, backed up, scanned, packaged, or shared.

This behavior is unnecessary for the declared shipment-tracking functionality. The existing curl examples already reference $TRACK123_API_KEY, so the credential can remain in a protected environment variable or secret manager without modifying the Skill file.

The external Track123 requests themselves are relevant to the declared functionality. However, transmitting the API credential becomes unsafe when its value has first been collected through chat and embedded in a distributable file.

Attack Path

  1. A user invokes the Skill without a configured TRACK123_API_KEY.
  2. The Skill asks the user to paste the API key into the conversation.
  3. The key becomes available in conversation records, Agent context, telemetry, or other retained logs.
  4. The Agent replaces $TRACK123_API_KEY in SKILL.md with the plaintext key.
  5. The modified file is committed to source control, included in a backup or Skill package, or exposed to anothe ...[truncated 916 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all instructions asking users to paste API keys into conversations.

  2. Never replace $TRACK123_API_KEY in SKILL.md with a literal credential.

  3. Require the key to be supplied through a protected environment variable or an approved secret manager.

  4. Validate only whether the variable is configured; do not print, echo, log, or otherwise expose its value.

  5. Document secure setup using a placeholder, for example:

    markdown
    Configure `TRACK123_API_KEY` in your runtime's protected secret store before invoking this Skill. Do not paste the key into chat or save it in this project.

  6. Add secret-scanning controls to source-control and packaging workflows.

  7. Ensure local secret configuration files are excluded through .gitignore and have restrictive filesystem permissions.

  8. Redact authorization headers from command output, debugging data, telemetry, and error reports.

  9. If this instruction has already been followed, revoke and rotate the affected API key, remove it from the working tree, and purge it from source-control history and retained artifacts where feasible.

  10. Inform users that tracking numbers are transmitted to Track123 and obtain consent before the first third-party request because shipment identifiers and returned location history may be privacy-sensitive.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to solicit a user’s Track123 API key and then persist it by editing the skill file. That exceeds the stated purpose of package tracking and creates a credential-handling vulnerability: secrets are being requested through chat and stored in a place that may be exposed to logs, versioning, or future runs.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill tells users to paste an API key into chat and then store it in the skill file, which is unsafe credential collection and persistence. This can expose secrets in transcripts, logs, analytics systems, or shared file history, enabling unauthorized use of the user’s Track123 account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says the skill is triggered when the user 'asks to track a shipment,' which is broad natural language without clear boundaries or exclusions. This could overlap with general logistics discussions and does not specify precise invocation constraints or negative examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Phrases like 'asks about delivery status, parcel location, or estimated arrival' and 'where is it?' are context-dependent and could refer to many things beyond parcel tracking. The trigger section does not provide exclusion conditions or disambiguation guidance for these broad phrases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to send tracking numbers to Track123, a third-party service, without clearly notifying the user that their shipment identifiers will be transmitted externally. Tracking numbers can reveal order activity and delivery metadata, so silent disclosure creates a privacy and data-sharing risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This instruction causes external transmission of a user-supplied API secret and encourages persistent storage of that secret in the skill file. In context, the transmission is not just ordinary API use; it creates avoidable credential exposure and expands the blast radius through logs and file persistence.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

API Key Setup (first time only)

If the curl commands below still contain $TRACK123_API_KEY, ask the user to visit https://www.track123.com/api → Dashboard → API tab → copy and paste the key here. Once received, replace $TRACK123_API_KEY in this skill file with the actual key value.

Step A — Register the tracking number:

bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill sends tracking numbers to the Track123 API endpoint, which is an external transmission of potentially sensitive shipment identifiers. While third-party API use is expected for this functionality, it is still a real privacy risk because the skill provides no consent, disclosure, or minimization controls.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Step A — Register the tracking number:

bash
curl -s -X POST "https://api.track123.com/gateway/open-api/tk/v2/track/import" \
  -H "Track123-Api-Secret: $TRACK123_API_KEY" \
  -H "accept: application/json" \
  -H "content-type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The query step transmits the tracking number again to the same third-party API, compounding the privacy exposure without any explicit warning or consent flow. Repeated submissions may increase retention and correlation risk for shipment activity.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Step B — Query the tracking status:

bash
curl -s -X POST "https://api.track123.com/gateway/open-api/tk/v2/track/query" \
  -H "Track123-Api-Secret: $TRACK123_API_KEY" \
  -H "accept: application/json" \
  -H "content-type: application/json" \

Static analysis

No suspicious patterns detected.