{
  "skill_name": "glm-coding-agent",
  "skill_path": "/workspace/skills/clawhub-glm-coding-agent",
  "skill_directory": "/workspace/skills/clawhub-glm-coding-agent",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 1,
  "findings": [
    {
      "id": "llm_finding_glm-coding-agent_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Credential Exposure via OpenClaw Config File Access",
      "description": "The skill reads API keys from the OpenClaw configuration file (~/.openclaw/openclaw.json on Unix, %USERPROFILE%\\.openclaw\\openclaw.json on Windows) and exports them as environment variables (ANTHROPIC_AUTH_TOKEN). While reading from a local config file is a common pattern, this creates a potential credential exposure risk if the skill is used in an untrusted context or if the config file permissions are misconfigured. The API key is then passed to the claude CLI tool via environment variable, which could be logged or exposed through process listings.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "API_KEY=$(jq -r '.models.providers.zai.apiKey // empty' \"$CONFIG_FILE\" 2>/dev/null)\nexport ANTHROPIC_AUTH_TOKEN=\"$API_KEY\"",
      "remediation": "1. Ensure OpenClaw config file has restrictive permissions (chmod 600 on Unix)\n2. Consider using more secure credential storage (OS keychain/credential manager)\n3. Avoid exporting credentials as environment variables when possible\n4. Add warnings in documentation about config file security\n5. Implement credential validation before use",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The glm-coding-agent skill is a wrapper for the Claude Code CLI that integrates with GLM 4.7 via Z.AI's API. The skill implements a git-based safety workflow for code changes. Security analysis reveals MEDIUM severity concerns around credential handling (reading API keys from config files and exposing via environment variables) and LOW severity issues with missing optional metadata and external binary dependencies. The skill does not contain prompt injection, data exfiltration to external servers, or malicious code execution. The primary security concern is credential exposure risk, which can be mitigated through proper file permissions and secure credential storage practices. The skill's behavior matches its description and does not exhibit deceptive characteristics.",
        "primary_threats": [
          "Credential exposure via config file access",
          "Missing security metadata",
          "Unpinned external binary dependency"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "This is standard CLI credential management (reading from config, passing via env var), not malicious. The risk is real but mitigated by: (1) reading from user's own config file, (2) no exfiltration to external servers, (3) standard practice for Anthropic CLI tools. Severity is MEDIUM because misconfigured permissions could expose credentials, but this is user configuration issue, not skill malice.",
        "meta_exploitability": "Low - Requires misconfigured file permissions (world-readable config) or process inspection access",
        "meta_impact": "Medium - API key exposure could allow unauthorized API usage, but limited to Z.AI endpoint"
      }
    }
  ],
  "scan_duration_seconds": 23.701104640960693,
  "duration_ms": 23701,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-06T02:26:37.214062"
}