ClawHub
Back to skill

Security audit

Competitor Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed competitor-monitoring helper with ordinary dependencies and no bundled code, hidden persistence, or deceptive behavior.

Before installing, confirm you are comfortable with a skill that may fetch and analyze public marketplace data and install Python packages. Prefer an isolated environment and pinned dependency versions if your deployment needs stricter supply-chain control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-24
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

yaml
"install":
  [
    {
      "id": "requests",
      "kind": "pip",
      "package": "requests",
      "label": "安装依赖：pip3 install requests",
    },
    {
      "id": "pandas",
      "kind": "pip",
      "package": "pandas",
      "label": "安装依赖：pip3 install pandas",
    },
  ],

Technical Analysis

The skill declares the requests and pandas packages without fixed versions, integrity hashes, a lock file, or an explicitly trusted package index. Consequently, dependency resolution may install whichever releases are current on the configured Python package index at installation time. The installed code can therefore differ from the code reviewed during this audit.

This creates a mutable software-supply-chain boundary. If a future package release, transitive dependency, or configured package index is compromised, malicious code could execute through package build hooks during installation or when the dependency is imported at runtime. No evidence indicates that the currently named packages are malicious; the finding concerns the absence of dependency pinning and integrity verification.

Attack Path

  1. An attacker compromises a declared package release, one of its resolved transitive dependencies, or the package index used by the environment.
  2. The compromised component is published as a version satisfying the unrestricted dependency declaration.
  3. A user installs or updates the skill dependencies.
  4. pip resolves and downloads the attacker-controlled release because no approved version or hash is enforced.
  5. Malicious code executes through an installation/build hook or after the dependency is imported.
  6. The code operates with the privileges of the account installing or running the skill.

Impact Assessmen

...[truncated 459 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed, exact version, for example requests==X.Y.Z and pandas==X.Y.Z.
  2. Generate a lock file that also fixes all transitive dependency versions.
  3. Record cryptographic hashes for every approved distribution and install with pip --require-hashes.
  4. Configure an explicit, trusted package index rather than relying on ambient pip configuration.
  5. Prefer prebuilt, reviewed wheels and reject unexpected source distributions where practical.
  6. Run dependency installation and the skill under a minimally privileged, isolated environment.
  7. Continuously scan locked dependencies for known vulnerabilities and update them through a controlled review process.
  8. Reproduce dependency installation in CI to verify that only approved package versions and hashes are accepted.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The usage examples are phrased as broad natural-language requests like “分析这个竞品的月销量和趋势” and “生成竞品分析报告” without clear activation boundaries, required parameters, or platform constraints. In an agent ecosystem, this can cause the skill to trigger on loosely related user messages and perform unintended competitor-tracking or data-collection actions, increasing the risk of overreach and privacy/compliance issues.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.