Skill Trust Decision
wenzi-runse
Hardcoded API key embedded in source and undeclared Tencent Cloud network endpoints constitute significant hidden behavior not reflected in documentation, with plaintext local credential storage as an additional concern.
Most direct threat evidence
High Credential Theft
Hardcoded API key in distributed skill package A full OpenAI-format API key (sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7) is hardcoded as DEFAULT_API_KEY in scripts/runse.py line 21. This key is packaged and distributed with the skill, making it trivially extractable by anyone who installs the skill. The key's purpose and ownership are unclear — it is not the user's key but a shared/developer key embedded in the delivery artifact.
scripts/runse.py:21 Why this conclusion was reached
2/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
2 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
What drove the risk score up
Hardcoded API key in source +15
scripts/runse.py:21 contains sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7 hardcoded as DEFAULT_API_KEY — a credential distributed with the skill package
Undeclared external network endpoints +15
SKILL.md declares Bash but does not mention the two Tencent Cloud Function URLs (ap-shanghai.tencentscf.com); skill-card.md vaguely mentions 'cloud service' but omits the specific infrastructure endpoint
Doc-code mismatch on data flow +10
SKILL.md describes '无状态运行，不存储原文' but the implementation writes user text to a temp file (./tmp_input.txt) before sending — this file I/O is not declared
Most important evidence
High Credential Theft
Hardcoded API key in distributed skill package
A full OpenAI-format API key (sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7) is hardcoded as DEFAULT_API_KEY in scripts/runse.py line 21. This key is packaged and distributed with the skill, making it trivially extractable by anyone who installs the skill. The key's purpose and ownership are unclear — it is not the user's key but a shared/developer key embedded in the delivery artifact.
scripts/runse.py:21 Remove the hardcoded key from source code. Use environment variable OPENAI_API_KEY or prompt the user at runtime. If a shared public key is necessary for free tier, retrieve it from a secure, rotation-capable endpoint rather than embedding it in the script.
Medium Doc Mismatch
Undeclared external network endpoints
SKILL.md and skill-card.md describe the skill as calling a 'cloud function' but do not name the specific infrastructure. The actual implementation makes HTTP requests to https://1257707270-955niawhww.ap-shanghai.tencentscf.com/bailian/chat and https://1257707270-955niawhww.ap-shanghai.tencentscf.com/v1/models — Tencent Cloud Function endpoints — neither of which is mentioned in any documentation. Users cannot audit which external service their text is sent to.
scripts/runse.py:19 Document the specific cloud service provider, endpoint URLs, and data flows in SKILL.md under a clearly labeled 'Network Access' or 'Third-Party Services' section.
Medium Doc Mismatch
Undeclared temporary file I/O
SKILL.md instructs to write text to a temporary file (./tmp_input.txt) before processing but does not declare filesystem WRITE access as part of the skill's capabilities. The file write/read cycle is used for the main processing flow but is not mentioned in the allowed-tools mapping or capability description.
scripts/runse.py:163 Ensure filesystem WRITE is explicitly declared and documented as part of the normal processing workflow when temporary files are involved.
Low Credential Theft
Plaintext local credential storage without encryption
User-provided personal API keys are saved in plaintext JSON format (0o600 file mode) to a user-specified or default path (~/.workbuddy/wenzi-runse-config.json). While the skill-card.md mentions this, SKILL.md frames it as an optional '进阶' feature and does not prominently warn about plaintext storage risks.
scripts/runse.py:62 Add a prominent security warning about plaintext credential storage. Consider using the system keyring (keyring module) instead of JSON files for storing API keys.
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
SKILL.md declares Write; runse.py writes temp files at line 163 Network Pass
Declared WRITE
→ Inferred WRITE
Bash declared in allowed-tools; HTTP POST to tencentscf.com implicit via script invocation Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md declares Bash; runse.py executed as subprocess Environment Pass
Declared NONE
→ Inferred READ
runse.py reads os.environ via sys.stdout.encoding check; documented key storage path includes ~ expansion Suspicious artifacts and egress
Critical API Key
sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7 scripts/runse.py:21
High API Key
API_KEY = "sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7" scripts/runse.py:21
Medium External URL
https://1257707270-955niawhww.ap-shanghai.tencentscf.com/bailian/chat scripts/runse.py:19
Medium External URL
https://1257707270-955niawhww.ap-shanghai.tencentscf.com/v1/models scripts/runse.py:20
Medium External URL
https://clawhub.ai/user/abcqq1234567 skill-card.md:9
Medium External URL
https://clawhub.ai/abcqq1234567/skills/wenzi-runse skill-card.md:39
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| urllib | stdlib | Python standard library | No | Used for HTTP requests — stdlib, no external dependency |
| json | stdlib | Python standard library | No | Stdlib JSON serialization |
| os | stdlib | Python standard library | No | Stdlib file system operations |
| argparse | stdlib | Python standard library | No | Stdlib CLI argument parsing |
File composition
5 files · 454 lines
Markdown 3 files · 260 linesPython 1 files · 189 linesJSON 1 files · 5 lines
Files of concern · 2
scripts/runse.py Hardcoded API key in distributed skill package · Undeclared external network endpoints · Undeclared temporary file I/O · Plaintext local credential storage without encryption · sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7 · API_KEY = "sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7" · https://1257707270-955niawhww.ap-shanghai.tencentscf.com/bailian/chat · https://1257707270-955niawhww.ap-shanghai.tencentscf.com/v1/models
skill-card.md https://clawhub.ai/user/abcqq1234567 · https://clawhub.ai/abcqq1234567/skills/wenzi-runse
Other files · SKILL.md · README.md · _meta.json
Security positives
No obfuscation techniques detected — no base64, eval(), or dynamic code generation
No attempts to access ~/.ssh, ~/.aws, .env, or other sensitive credential paths outside the declared config
No reverse shell, C2 communication, or data exfiltration patterns observed
Input text length validation (≥300 chars) prevents abuse via tiny payloads
API key format validation (must start with 'sk-') before saving
File permissions set to 0o600 on credential storage file where supported
User confirmation required before saving personal API key to disk (not auto-saved)
Skill-card.md correctly discloses cloud service usage and plaintext credential storage risks under 'Known Risks and Mitigations'
All Python dependencies (urllib, json, os, sys, argparse) are stdlib — no third-party supply chain risk