ClawHub
Back to skill

Security audit

Statistical Analysis Advisor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local statistical-method advisor with no evidence of hidden data access, exfiltration, persistence, or destructive behavior, though its install instructions should be tightened.

Before installing, avoid or remove the requirements.txt entries for dataclasses and enum when using Python 3.10+, or install only in an isolated virtual environment. Treat the statistical results as advisory and verify recommendations before using them for research or publication.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unnecessary Unpinned Packages Duplicate Python Standard-Library Modules

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Related Installation Instruction: SKILL.md:181-186
Vulnerability Type: Unnecessary and unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1-2:

text
dataclasses
enum

SKILL.md:181-186:

markdown
## Prerequisites

```text

# Python dependencies
pip install -r requirements.txt
text

### Technical Analysis

The project declares Python 3.10 or later, where both `dataclasses` and `enum` are provided by the Python standard library. The implementation imports those standard-library modules, but the prerequisites instruct users to retrieve packages with the same names from a Python package index.

These dependencies are unnecessary and have no version or integrity constraints. Running the documented installation command therefore expands the trust boundary to external package-index content without a functional need. If a matching package, one of its releases, its maintainer account, or the selected package source is compromised, package-controlled build or installation logic could execute in the installer context. Installed modules could also shadow or conflict with the expected standard-library modules.

This is a supply-chain weakness rather than evidence that the currently referenced packages contain malicious code.

### Attack Path

1. An attacker compromises a referenced package, package release, maintainer account, or package source, or influences dependency resolution through an untrusted index.
2. A user follows `SKILL.md` and runs:
   ```bash
   pip install -r requirements.txt
   ```
3. Pip resolves and downloads the unpinned `dataclasses` and `enum` distributions.
4. Package-controlled build or installation behavior runs with the permissions of the user or automation account invoking pip.
5. The malicious or compromised package can modify that Python environmen
...[truncated 744 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both entries from requirements.txt; Python 3.10+ already supplies these modules.
  2. Remove or revise the pip install -r requirements.txt prerequisite when no external runtime dependencies exist.
  3. Retain the existing Python 3.10+ requirement and import dataclasses and enum only from the standard library.
  4. If third-party dependencies are added later:
    • Pin reviewed versions.
    • Use hashes through a locked requirements file.
    • Restrict installation to a trusted package index.
    • Disable unexpected extra indexes and dependency links.
    • Scan packages and transitive dependencies before release.
    • Install inside an isolated, least-privileged virtual environment or build container.
  5. Add automated checks that reject unnecessary standard-library backports and unpinned production dependencies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description ends with 'based.' and does not specify the inputs, context, or boundaries for invocation. Because this markdown/manifest content is used to describe when the skill applies, the incomplete phrasing increases the risk of unintended or inconsistent activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Phrases like 'use this skill when the task needs...' and broad references to 'data analysis tasks' do not clearly distinguish this skill from other general analysis skills. The section also lacks negative examples or explicit exclusion conditions, so invocation boundaries remain ambiguous.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

At L153 the skill says 'Does not perform actual data analysis (recommendations only)', yet earlier sections claim it performs normality tests, Levene/Bartlett tests, effect size estimation, sample size calculations, and post-hoc power analysis at L091-L100. Those operations go beyond mere recommendation and amount to analytical computation, creating an intent-level contradiction in the documentation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The limitations section states 'Cannot access raw data directly' at L154, which actively conflicts with the example API at L118-L121 that accepts data=[group1, group2] and with the assumption-checking capability description at L091-L095. This is a direct contradiction in the skill's own documentation about whether the code handles raw data inputs.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
dataclasses
enum

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
dataclasses
enum

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description says the skill recommends appropriate statistical methods such as T-test vs ANOVA based on dataset characteristics. In addition to recommendation logic, the code also implements power analysis, sample-size estimation, and effect-size interpretation, which are adjacent statistical consulting functions but broader than the narrowly described recommendation behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.