ClawHub
Back to skill

Security audit

Plagiarism Checker

Security checks for vulnerabilities and agentic risk

Overview

This is a local text-similarity pre-screener with no evidence of hidden network access or persistence, though its documentation overstates some capabilities and its file output needs caution.

Install only in an isolated environment, preferably without the unnecessary dataclasses dependency on Python 3.7+. Treat results as a local duplicate-pattern pre-check, not a comprehensive plagiarism check. Use --output only with a deliberate workspace path because the report may include text from the analyzed document and can overwrite an existing writable file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned and Unnecessary Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1 and SKILL.md:134-137
Vulnerability Type: Uncontrolled third-party package resolution
Risk Level: Medium

Vulnerable code/configuration:

text
dataclasses

The documented installation command is:

bash
# Python dependencies
pip install -r requirements.txt

Technical Analysis

The project instructs users to install an unpinned dataclasses package from the configured Python package index. The dependency has no exact version or integrity hash, so installation is not reproducible and package selection may change over time.

Furthermore, dataclasses is part of the Python standard library in Python 3.7 and later, and the audited code imports it directly:

python
from dataclasses import dataclass, asdict

Unless the project intentionally supports an older Python release, installing a third-party backport is unnecessary. An avoidable dependency expands the software supply-chain attack surface. If an attacker compromises the selected package release, controls the configured package index, or can influence pip resolution, package installation logic may execute with the privileges of the user running pip.

Attack Path

  1. A user follows the prerequisite instructions in SKILL.md.
  2. The user runs pip install -r requirements.txt.
  3. Pip resolves dataclasses without an exact version or expected cryptographic hash.
  4. A compromised package release or attacker-controlled package index supplies a malicious distribution.
  5. Malicious installation or imported package code executes in the local Python environment.
  6. The payload gains the filesystem, network, and process permissions available to the installing user or runtime environment.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the account installing or running the skill. The accessible scope would depend on th ...[truncated 257 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove dataclasses from requirements.txt and declare Python 3.7 or later as the minimum supported runtime.
  2. If legacy Python support is explicitly required, pin the backport to a reviewed exact version.
  3. Record cryptographic hashes and install with pip --require-hashes.
  4. Use a trusted, explicitly configured package index rather than allowing arbitrary index substitution.
  5. Generate and retain a lock file or other reproducible dependency manifest.
  6. Add automated dependency and provenance scanning to the release process.
  7. Install dependencies in an isolated virtual environment under a non-privileged account.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/main.py:450
Finding

Unrestricted Output Path Allows Overwriting Arbitrary Writable Files

Content
View full analysis

Vulnerability Details

File Location: scripts/main.py:450-453
Vulnerability Type: Unrestricted file write and overwrite
Risk Level: Medium

Vulnerable code:

python
if args.output:
    Path(args.output).write_text(output, encoding='utf-8')
    print(f"Report saved to: {args.output}")
else:
    print(output)

The destination originates directly from the command-line argument:

python
parser.add_argument('--output', '-o', type=str,
                    help='Output file path (JSON format)')

Technical Analysis

The --output value is passed directly to Path.write_text without resolving and validating it against an approved output directory. Absolute paths and paths containing parent-directory components are accepted. Existing files are opened for writing and truncated by default.

No protection is applied against symbolic-link destinations, and no exclusive-create mode is used. Consequently, a caller who can influence command-line arguments can direct the report to any path writable by the skill process. This behavior also conflicts with the documented security objective that output should be restricted to the workspace.

The report body is derived from analyzed input, meaning an attacker may have partial control over the replacement content. Even when the generated format limits exact content control, truncating or replacing a sensitive file can cause configuration corruption or denial of service.

Attack Path

  1. An attacker supplies or influences the --output argument used by an agent, wrapper, or automated workflow.
  2. The attacker selects an absolute path, a parent-directory traversal path, or a symbolic link that resolves to a sensitive writable file.
  3. The skill performs its analysis and formats the report.
  4. Path(args.output).write_text(...) opens the selected destination for writing.
  5. An existing destination is truncated and replaced with report content ...[truncated 821 chars]
Remediation
View remediation

Remediation Suggestions

  1. Define a dedicated output directory controlled by the application.
  2. Resolve both the approved directory and requested destination with Path.resolve(), then verify that the destination remains beneath the approved directory.
  3. Reject absolute paths and parent-directory traversal components when only filenames are expected.
  4. Reject symbolic-link destinations and validate parent directories to mitigate symlink redirection.
  5. Avoid overwriting existing files by default. Use exclusive creation mode and require an explicit, separately authorized overwrite option when replacement is necessary.
  6. Run the skill under a least-privileged account with write access limited to its workspace.
  7. Return a sanitized error when path validation fails, without exposing unrelated filesystem details.
  8. Add tests covering absolute paths, ../ traversal, existing files, and symbolic-link destinations.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
python scripts/main.py --input "Your text here" --threshold 0.75

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
python scripts/main.py --input "Your text here" --threshold 0.75

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
python scripts/main.py --input "Your text here" --threshold 0.75

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes local file read and write behavior (--file input and --output report path) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization/documentation gap where an agent or reviewer cannot verify what filesystem access is intended, increasing the risk of overbroad file access, path traversal, or accidental handling of sensitive files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest and module description present this as a plagiarism/originality checker that detects duplicate or similar content. However, the analysis loop only compares each segment against other segments from the same input text, which detects internal repetition rather than plagiarism against outside material or another document corpus.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest says the skill accepts documents with 'txt, md, docx support via text extraction', which implies actual document parsing capability. In code, read_file only handles .txt and .md explicitly, then falls back to UTF-8 text reading for other extensions, so real .docx extraction is not implemented and would typically fail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest mixes English and Chinese trigger phrases, but the skill documentation does not explain whether Chinese-language invocation is optional, configurable, or intended for a specific locale. This can create a natural-language policy concern because a locale-specific activation path is embedded without documented user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The statement "Optimized for English and CJK languages" imposes a language/locale preference in natural language documentation. Because the file does not offer opt-in, alternatives, or a clear region-specific justification, this may violate the policy against forcing a specific language/locale without user choice.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
dataclasses

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code writes the generated report to a user-specified path, which is a filesystem-modifying operation. While the CLI exposes the --output argument, there is no confirmation prompt, overwrite warning, or explanatory comment/docstring near the write operation indicating that an existing file may be replaced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.