Chuwi Minibook

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.1

Overview

The skill claims to monitor system hardware, but its code instead searches shared local databases outside the skill and can load external Python code from that location.

Review this skill carefully before installing. It is not just a system monitor as described: it can read shared local knowledge/history data and import Python code from an external database directory. Install only if you trust that shared directory and are comfortable with the undocumented knowledge-search behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: chuwi_minibook.py:17

Finding

Undisclosed Shared Database Access and Unsafe Import-Path Precedence

Content

View full analysis

Vulnerability Details

File Location: chuwi_minibook.py, lines 17–21 and 45–66
Vulnerability Type: Unauthorized access outside the declared skill boundary and unsafe dynamic module resolution
Risk Level: Medium

Vulnerable Code

python

def _search_kb(query: str, limit: int = 5) -> list[dict]:
    """搜索本地知识库"""
    try:
        sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "db"))
        from knowledge_bridge import search_knowledge
        return search_knowledge(query, limit)
    except Exception:
        return []

python

    # 2. 洞察引擎历史
    try:
        sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "db"))
        from pathlib import Path as P2
        history_dir = P2(__file__).parent.parent.parent / "db" / "insight_data" / "history"
        if history_dir.exists():
            for f in sorted(history_dir.glob("cycle_*.json"))[-3:]:
                data = json.loads(f.read_text(encoding="utf-8"))
                for ins in data.get("insights", []):
                    title = ins.get("title", "")
                    if _TOPIC_LOWER in title.lower() or search_term.lower() in title.lower():
                        results.append({
                            "source": "insight_cycle",
                            "type": "insight",
                            "content": title[:200],
                            "url": ins.get("url", ""),
                        })
    except Exception:
        pass

Technical Analysis

The skill is documented as a hardware-monitoring utility, but its implementation accesses a shared database located outside the project directory. It imports knowledge_bridge after inserting the external database directory at index zero of the process-wide sys.path.

Python executes a module's top-level code during import. Consequently, any knowledge_bridge.py that resolves from the prepended directory executes with the same permissions as the ag ...[truncated 2366 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the shared knowledge-database import and history-file access if they are not required for the documented hardware-monitoring function.
2. Implement the advertised CPU, memory, disk, battery, and temperature checks through a reviewed and pinned system-information dependency.
3. Do not modify the process-wide sys.path to import modules from data directories.
4. If an external module is genuinely required, package it as a normal pinned dependency or load it from a fixed, administrator-controlled location after verifying its resolved path, ownership, permissions, and integrity.
5. Separate executable code from writable database and history directories. Executable Python modules must not reside in locations writable by untrusted users, other skills, or data-ingestion processes.
6. Restrict history access to an explicitly approved, read-only directory and use canonical-path validation to ensure files remain within that directory.
7. Apply least-privilege filesystem permissions so the agent can read only the information required for its declared operation.
8. Document all external data sources and returned fields in SKILL.md, including any possibility that shared titles or URLs are returned.
9. Replace broad exception suppression with narrowly scoped exception handling and security-relevant logging that does not expose sensitive data.
10. Align SKILL.md with the implementation: either implement the documented quick and battery monitoring modes or clearly describe the actual knowledge-search behavior.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill mixes English with Chinese but presents key descriptive sections and trigger content in Chinese without stating that the skill is China-specific or offering a language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad terms such as "system info", "chuwi", and especially the generic Chinese term for monitoring ("监控"), which can match ordinary conversation and cause the skill to invoke when the user did not intend it. Because the skill exposes system and hardware status, accidental activation can disclose device details or create confusing, privacy-impacting behavior in unrelated contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file’s natural-language strings and documentation are entirely in Chinese, including the generated skill description and function docstrings, with no indication that language choice is user-configurable or region-specific. This can violate language/locale policy when a skill implicitly enforces one language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.