ClawHub
Back to skill

Security audit

Screenshot Tool

Security checks for vulnerabilities and agentic risk

Overview

This screenshot skill does what it claims, but its scripts can let crafted URLs or filenames run unintended local shell commands.

Review before installing or running. Use only trusted URLs and trusted filenames/paths, preferably in a sandbox or disposable environment, until the scripts are changed to call subprocess.run with argument lists and shell=False. Treat generated screenshots and converted images as sensitive, especially for logged-in pages or private documents.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_command(cmd, timeout=120):
    """运行命令并返回结果"""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,
Confidence
99% confidence
Finding
The code builds a shell command string from user-controlled values (`input_file` and `output_dir`) and executes it with `subprocess.run(..., shell=True)`. Quoting with double quotes is not sufficient to prevent shell metacharacter expansion such as command substitution, so a crafted filename like `$(id).docx` can lead to arbitrary command execution under the tool's privileges.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_command(cmd, timeout=120):
    """运行命令并返回结果"""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,
Confidence
98% confidence
Finding
The helper executes shell commands via subprocess.run(..., shell=True) using command strings built from user-controlled inputs such as url and output. Even though the values are wrapped in double quotes, shell metacharacters like embedded quotes or command substitutions can break out of the intended argument boundary and lead to arbitrary command execution.

Context-Inappropriate Capability

Medium
Confidence
76% confidence
Finding
The skill exposes an undeclared capability to execute external programs, specifically LibreOffice via subprocess. While calling a local converter is expected for document rendering, the use of subprocess increases the attack surface and should be explicitly declared because it can execute host binaries and interact with the local environment.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill supports loading arbitrary URLs in a headless browser but does not warn users that doing so will contact remote servers, exposing the user's IP address, user agent, timing, and potentially other environmental details. In a screenshot tool, this context makes the issue more relevant because network access is core functionality and users may reasonably assume screenshotting is a local-only action.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
- 需要将 PPT/Word/PDF 转为图片
  - 需要高清文档截图
metadata: {"clawdbot":{"emoji":"📸","requires":{"bins":["libreoffice","pdftoppm","agent-browser"]}}}
allowed-tools: Bash(screenshot-tool:*)
dependencies:
  - agent-browser: "网页截图功能必需，用于 headless 浏览器截图"
  - libreoffice: "文档转换功能必需，用于 PPT/Word/Excel 转 PDF"
Confidence
93% confidence
Finding
`allowed-tools: Bash(screenshot-tool:*)` grants broad shell access across the skill namespace rather than narrowly constraining execution to specific vetted commands. In this skill's context, shell use is expected for document conversion and screenshots, but unrestricted Bash increases the blast radius if later scripts mishandle input, invoke unexpected binaries, or are modified to perform unrelated actions.

Static analysis

No suspicious patterns detected.