ClawHub
Back to skill

Security audit

PASM Learning Tutor Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent offline tutoring skill, with normal but mutable Python package installation risk.

Install in a virtual environment or container, avoid running pip as an administrator, and consider pinning reviewed package versions. Expect persisted learning state and mistake history if you use save or the interactive run mode.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:67
Finding
Unpinned Third-Party Package and Repository Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 67-68, 95-97, and 189 **Vulnerability Type**: Unverified and mutable third-party dependencies **Risk Level**: Medium ### Evidence ```markdown | **pasm-skills**（基座） | 只提供能力，**不含任何智能体** | `pip install pasm-skills` | | **pasm-agents**（本技能来源） | 游戏 NPC / 老人陪伴 / 学习陪伴 + 7 个验证智能体 | `pip install pasm-agents` | ``` ```bash pip install pasm-agents # 自动带上基座 pasm-skills（推荐） # 没有 PyPI 环境时改源码安装： # git clone https://gitee.com/arronzheng/pasm-agents && cd pasm-agents && pip install -e . ``` ```markdown | `bionic` | 仿生：完整 PASM 核心 + emotion 模块（需 torch） | `pip install pasm-agents[torch]` | ``` ### Technical Analysis The installation instructions retrieve and install third-party code without pinning an exact package version, immutable repository commit, or verified artifact hash. Commands such as `pip install pasm-agents` resolve the package and its transitive dependencies according to the state of the package index at installation time. The source-installation alternative clones the current repository state and immediately installs it in editable mode. Python package installation can execute package-controlled build logic through supported packaging mechanisms. Consequently, the effective code executed during installation may differ from the code originally reviewed if a package release, transitive dependency, repository branch, or publisher account is compromised. The documented project homepage points to GitHub, while the source-installation fallback uses Gitee. This is not evidence that either source is malicious, but it creates additional provenance ambiguity because the instructions do not establish which repository is authoritative or how mirrors are synchronized and verified. ### Attack Path 1. An attacker compromises the `pasm-agents` package, one of its transitive dependencies, a publisher account, or the mutable repository referenced by the instructions. 2. The attacker ...[truncated 1265 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin `pasm-agents`, `pasm-skills`, optional components, and all transitive dependencies to reviewed versions. 2. Supply a locked requirements file containing cryptographic hashes and install with hash enforcement, such as: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 3. For source installation, check out a reviewed immutable commit rather than the repository's default branch: ```bash git clone https://<authoritative-host>/<owner>/pasm-agents.git cd pasm-agents git checkout <reviewed-commit-hash> ``` 4. Publish and verify the expected commit fingerprint or signed release tag before installation. 5. Clearly designate the authoritative repository and document how any GitHub or Gitee mirror is verified and synchronized. 6. Install the package inside a dedicated virtual environment or container using a non-privileged account. 7. Review release artifacts and package build configuration before allowing installation in environments containing sensitive data. 8. Use automated dependency monitoring and periodically regenerate the lock file after security review. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The title and primary descriptive content are presented only in Chinese, and the examples and interaction guidance continue in Chinese throughout the file. For a general-purpose tutor skill, this effectively imposes a language/locale constraint without documenting user choice or a justified region-specific limitation.

Static analysis

No suspicious patterns detected.