ClawHub
Back to skill

Security audit

Build Plots

Security checks for vulnerabilities and agentic risk

Overview

This plotting skill is coherent and purpose-aligned, with ordinary Python plotting dependencies and a disclosed optional interactive HTML output, but users should note the unpinned package install and remote Bokeh JavaScript in one example.

Install the dependencies in a virtual environment or container, avoid running pip as an administrator, and be aware that opening or regenerating the Bokeh HTML example can load JavaScript from Bokeh's CDN. Prefer locked dependencies and inline or vendored Bokeh resources for stricter environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/requirements.txt:1
Finding

Dependency installation is not reproducibly pinned or integrity-verified

Content
View full analysis
=2.1,<3.0 matplotlib>=3.8,<4.0 seaborn>=0.13,<1.0 bokeh>=3.4,<4.0 ``` The skill directs users to install these dependencies: ```bash python3 -m pip install -r {baseDir}/scripts/requirements.txt ``` ### Technical Analysis The requirements specify broad version ranges rather than exact versions and do not provide cryptographic hashes. Consequently, two installations performed at different times can resolve to different package artifacts. Although the listed package names are established projects and no typosquatting was identified, the installation process implicitly trusts the configured Python package index, package maintainers, dependency resolver, transitive dependencies, and downloaded artifacts. It can also accept source distributions whose build backend executes code during installation. This is an insecure dependency-management practice rather than evidence that the currently named packages are malicious. ### Attack Path 1. A user follows the installation command in `SKILL.md`. 2. `pip` resolves the newest versions satisfying the broad ranges, including their transitive dependencies. 3. An attacker compromises an eligible package release, transitive dependency, package-index connection/configuration, or build artifact. 4. The compromised package or source-build backend executes during installation or later when imported by the plotting scripts. 5. The payload runs with the privileges of the user performing the installation. ### Impact Assessment Successful exploitation could execute arbitrary code as the installing user. This may permit access to files, environment variables, credentials, datasets, and network resources available to that account. It could also mo ...[truncated 322 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/build_book_examples.py:140
Finding

Generated interactive chart executes remote JavaScript without integrity verification

Content
View full analysis
``` ### Technical Analysis Opening the generated HTML causes the browser to retrieve and execute JavaScript from `cdn.bokeh.org`. The script element has no Subresource Integrity (`integrity`) attribute, and the artifact is therefore not self-contained despite the skill's verification statement that the Bokeh HTML should open without requiring local data files. HTTPS protects transport in ordinary conditions but does not protect against a compromised CDN, compromised upstream release, DNS/trust-store compromise, or unauthorized replacement at the remote endpoint. A modified response would execute in the chart document's browser context. The reviewed bundled HTML contains ordinary Bokeh document data and no identified malicious custom JavaScript. The vulnerability is the mutable remote execution boundary, not a confirmed malicious payload. ### Attack Path 1. The builder generates `supplier_market_share.html` using `resources=CDN`, or a user opens the bundled HTML artifact. 2. The browser requests `https://cdn.bokeh.org/bokeh/release/bokeh-3.9.2.min.js`. 3. An attacker who can compromise or substitute the CDN response serves modified JavaScript. 4. Because no integrity hash is declared, the browser accepts and executes the modified response. 5. The payload operates with the permissions available to JavaScript in the document's browser context. ### Impact Assessment A ...[truncated 581 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This example HTML imports and executes Bokeh JavaScript from a third-party CDN. Even though the file appears to be a static visualization example, loading active script from an external origin creates a supply-chain and integrity risk: if the CDN, dependency, or network path is compromised, arbitrary code could run in the viewer's browser. The skill context makes this somewhat more concerning because this is a local asset example that does not inherently require remote code execution to demonstrate plotting output.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: bokeh has 2 known advisory(ies) (CVE-2026-21883 (Bokeh server applications have Incomplete Origin Validation in WebSockets); CVE-2026-21883 (Bokeh server applications have Incomplete Origin Validation in WebSockets)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
70% confidence
Finding

The manifest allows any Bokeh release from 3.4 up to, but not including, 4.0, and it does not pin to a specific patched version. If a vulnerable 3.x release is selected and the skill is used in a context that runs a Bokeh server application, incomplete WebSocket origin validation could enable cross-origin interaction or abuse of the exposed app.

Content

No source excerpt is available for this finding.