ClawHub
Back to skill

Security audit

Zyt ai creation

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to support the stated Chanjing API workflow, but its handling of API secrets is too broadly configurable and could expose credentials if the API endpoint environment is unsafe.

Review before installing. Use this only with credentials you intend to grant to Chanjing AI creation APIs, keep ~/.chanjing private, and do not set CHANJING_API_BASE unless it is a trusted HTTPS Chanjing-controlled endpoint. Consider using limited-scope or test credentials, and expect the skill to submit tasks, list task history, poll results, cache tokens locally, and consume API quota.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/_auth.py:11
Finding

Unrestricted API Base Override Can Exfiltrate Credentials and Access Tokens

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_auth.py:49
Finding

Credential File Is Written Without Enforcing Restrictive Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (16)

Tainted flow: 'req' from os.environ.get (line 64, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The token request destination is derived from CHANJING_API_BASE, an environment variable, and the code sends app_id and secret_key to that URL. If an attacker can influence the environment, they can redirect the request to an attacker-controlled server and exfiltrate long-lived credentials over HTTPS or HTTP-equivalent endpoints they control.

Content

Scanner excerpt · scripts/_auth.py (reported line 70)May include surrounding context.

python
headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=30) as resp:
        return json.loads(resp.read().decode("utf-8"))

Credential Access

High
Category
Privilege Escalation
Confidence
78% confidence
Finding

The skill explicitly instructs use of a local credentials file containing AK/SK material, which confirms access to sensitive secrets during execution. Even if this is functionally necessary, exposing broad credential-file consumption inside a general-purpose skill raises the risk of accidental disclosure, misuse by downstream scripts, or execution in contexts where secret access was not clearly authorized.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
本 Skill 使用：

* 配置文件：`~/.chanjing/credentials.json`
* 若设置环境变量 `CHANJING_CONFIG_DIR`：使用 `$CHANJING_CONFIG_DIR/credentials.json`
* API 基础地址：`https://open-api.chanjing.cc`（可用 `CHANJING_API_BASE` 覆盖）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
#!/usr/bin/env python3
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；无 AK/SK 或 AK/SK 无效时在默认浏览器打开蝉镜官方登录页
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 2)May include surrounding context.

python
#!/usr/bin/env python3
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；无 AK/SK 或 AK/SK 无效时在默认浏览器打开蝉镜官方登录页
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 11)May include surrounding context.

python
#!/usr/bin/env python3
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；无 AK/SK 或 AK/SK 无效时在默认浏览器打开蝉镜官方登录页
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 18)May include surrounding context.

python
#!/usr/bin/env python3
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；无 AK/SK 或 AK/SK 无效时在默认浏览器打开蝉镜官方登录页
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 27)May include surrounding context.

python
#!/usr/bin/env python3
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；无 AK/SK 或 AK/SK 无效时在默认浏览器打开蝉镜官方登录页
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 28)May include surrounding context.

python
#!/usr/bin/env python3
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；无 AK/SK 或 AK/SK 无效时在默认浏览器打开蝉镜官方登录页
import json
import os

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill advertises scripts that read environment variables, access local credential files, write outputs, and make network requests, but it does not declare any explicit tool scope or permission boundaries. This weakens reviewability and can cause an agent runtime to invoke a capability-rich skill without clear least-privilege constraints, increasing the chance of unintended local file access, credential handling, or outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. The natural-language trigger section presents only Chinese trigger phrasing and says these utterances should trigger the skill, with no opt-in, multilingual alternative, or explanation that the skill is intentionally restricted to a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language instructions throughout the file are presented in Chinese, which effectively forces a specific language for users reading the skill reference. SQP-3 applies to all file types and flags language-policy issues when no user opt-in, alternative language, or explicit justification for the locale constraint is provided.

Content

No source excerpt is available for this finding.

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 11, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_auth.py (reported line 50)May include surrounding context.

python
def write_config(data):
    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code reads credentials from a local file and sends them in an HTTP POST request to obtain a token. While the operation is core to authentication, this file provides no user-facing disclosure via print/logging, prompt, or explanatory docstring/comment near the network transmission itself that sensitive credentials will be sent to a remote service.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/_task_api.py (reported line 8)May include surrounding context.

python
from _auth import clear_cached_token, get_token

API_BASE = __import__("os").environ.get("CHANJING_API_BASE", "https://open-api.chanjing.cc")

RUNNING_STATUSES = {"Queued", "Ready", "Generating"}
SUCCESS_STATUSES = {"Success"}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The section on explicit download says the command downloads output and reports a local file path, but it does not warn that the operation writes files to the local system or note any implications such as destination handling or overwriting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file documents a download_result action that downloads output_url content to the local machine, which can affect user data or system state. Under the markdown variant of SQP-2, the description should disclose file-writing behavior so users understand that running the skill may create local files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.