ClawHub
Back to skill

Security audit

Interior Fullplan

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a straightforward Chinese interior-design Markdown generator, but its output filename handling can write outside the intended Desktop location and overwrite writable files.

Review before installing. Use only trusted project names without slashes, backslashes, leading dots, or path-like text, and be aware it may overwrite an existing generated file. The safer fix is to sanitize the project name, force the resolved output to remain inside Desktop, and avoid silent overwrites.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
generate_fullplan.py:354
Finding

Unsanitized Project Name Allows Output Path Traversal and Arbitrary File Overwrite

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The title and output requirements indicate the skill is designed around Chinese-language usage and specifically states the output should conform to domestic Chinese residential/commercial standards. There is no indication that users can choose another language or locale, which can violate a language/locale policy requiring opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The docstring says this is an '室内设计全案方案自动生成器' that generates output '按照隐室空间设计标准规范'. In practice, the script collects manual input, inserts preset text, and leaves major sections such as structure analysis, lighting analysis, traffic analysis, problem optimization, layouts, and construction extras blank at L311-L315 and L327-L354, which contradicts the claim of automatically generating a full standards-based plan.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language interface and generated content are fixed to Chinese, including prompts and template text, with no indication that the user can select another language. This can violate language/locale policy when a skill forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Tainted flow: 'output_path' from input (line 357, user input) → open (file write)

Medium
Category
Data Flow
Confidence
92% confidence
Finding

The output filename is derived directly from untrusted user input (project) and then passed to open() for writing. If the project name contains path separators or traversal sequences, os.path.join can produce a path outside the intended Desktop directory, enabling overwrite of arbitrary files writable by the current user.

Content

Scanner excerpt · generate_fullplan.py (reported line 358)May include surrounding context.

python
)
    
    output_path = os.path.join(os.path.expanduser("~/Desktop"), f"{project}_全案方案.md")
    with open(output_path, "w", encoding="utf-8") as f:
        f.write(content)
    
    print(f"✓ 全案方案已生成: {output_path}")

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code performs a file write to a user-visible location, creating or overwriting a file named from user input on the Desktop. Although it prints a success message afterward, there is no advance disclosure or confirmation before the write occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description and tags are written in Chinese and the keyword list explicitly includes "chinese", which suggests the skill may be intended to operate in a specific language/locale. The manifest does not state that users can choose another language or that the Chinese-only scope is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.