ClawHub
Back to skill

Security audit

Sop Bom Report

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to compare SOP and BOM spreadsheets, but its cleanup and spreadsheet extraction behavior is broad enough to need review before installation.

Install only if you are comfortable with a local script reading the supplied spreadsheets, writing reports, and automatically deleting matching temp/report files. Run it in a dedicated working directory or sandbox, avoid sensitive shared temp environments, and consider reviewing or changing the cleanup and archive-size handling before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/sop_bom_report.py:328
Finding

Unbounded Extraction and Processing of Untrusted XLSX Archives

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/sop_bom_report.py:1192
Finding

Overbroad Recursive Deletion in the Shared Temporary Directory

Content
View full analysis
bool: try: if os.path.exists(path): if IS_WINDOWS: import stat def on_rm_error(func, p, exc_info): os.chmod(p, stat.S_IWRITE) func(p) shutil.rmtree(path, onerror=on_rm_error) else: shutil.rmtree(path, ignore_errors=True) return True ``` ### Technical Analysis The cleanup routine scans the global system temporary directory for generic names matching: - `sop_extract_*` - `bom_extract_*` - `report_*` It then recursively deletes every matching directory. The script does not verify that a directory: - Was created by the current process. - Belongs to the current Skill invocation. - Is no longer in use. - Is owned by the expected user. - Contains a marker proving its provenance. - Falls under a private, Skill-specific temporary parent. Because the namespace is shared, one invocation can remove the active working directory of another invocation. Unrelated applications can also be affected if they use a matching directory name. ### Attack Path 1. Another process creates or actively uses a directory such as `/tmp/report_active`, `/tmp/sop_extract_job`, ...[truncated 1135 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:18
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The explicit cleanup recipe 'rm -rf /tmp/sop_extract_* /tmp/bom_extract_* /tmp/report_*' is dangerous in context because the skill advertises automatic cleanup and shell-capable behavior. In shared or multi-user environments, predictable prefixes in /tmp can overlap with unrelated files, and wildcard recursive deletion may remove data outside the intended report cache set.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

如需手动清理，可执行：

bash
# Linux/Mac
rm -rf /tmp/sop_extract_* /tmp/bom_extract_* /tmp/report_*

# Windows (PowerShell)
Remove-Item -Path "$env:TEMP\sop_extract_*" -Force -ErrorAction SilentlyContinue

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The explicit cleanup recipe 'rm -rf /tmp/sop_extract_* /tmp/bom_extract_* /tmp/report_*' is dangerous in context because the skill advertises automatic cleanup and shell-capable behavior. In shared or multi-user environments, predictable prefixes in /tmp can overlap with unrelated files, and wildcard recursive deletion may remove data outside the intended report cache set.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

如需手动清理，可执行：

bash
# Linux/Mac
rm -rf /tmp/sop_extract_* /tmp/bom_extract_* /tmp/report_*

# Windows (PowerShell)
Remove-Item -Path "$env:TEMP\sop_extract_*" -Force -ErrorAction SilentlyContinue

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The explicit cleanup recipe 'rm -rf /tmp/sop_extract_* /tmp/bom_extract_* /tmp/report_*' is dangerous in context because the skill advertises automatic cleanup and shell-capable behavior. In shared or multi-user environments, predictable prefixes in /tmp can overlap with unrelated files, and wildcard recursive deletion may remove data outside the intended report cache set.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

如需手动清理，可执行：

bash
# Linux/Mac
rm -rf /tmp/sop_extract_* /tmp/bom_extract_* /tmp/report_*

# Windows (PowerShell)
Remove-Item -Path "$env:TEMP\sop_extract_*" -Force -ErrorAction SilentlyContinue

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill describes capabilities that imply reading local files and potentially invoking shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may over-grant capabilities or users may be unaware that filesystem and shell access are required, increasing the risk of unintended file access or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger condition is broadly phrased as activating whenever a user sends BOM and SOP files for comparison, which may overlap with ordinary conversations or adjacent document-analysis tasks. Overbroad activation can cause the skill to run unexpectedly on sensitive files, leading to unintended processing, file access, or execution of cleanup logic outside the user's precise intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains user-facing natural-language strings and documentation in Chinese only, starting with the module docstring and continuing throughout CLI output. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.