ClawHub
Back to skill

Security audit

AHKB-CPS — 阿色全息知识库建产系统

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a coherent local knowledge-base tool, but it persistently broadens agent permissions and automatically installs dependencies, so users should review it before installing.

Install only in a dedicated Vault/workspace, not a sensitive home or project root. Review or avoid running setup-permissions unless you intentionally want broad Claude permissions persisted in .claude/settings.json. Prefer a virtual environment with pinned dependencies, and expect the skill to scan, move, create, and trash files inside the selected workspace.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def copy_to_clipboard(text):
    """Copy text to clipboard using Windows clip command."""
    try:
        proc = subprocess.Popen(['clip'], stdin=subprocess.PIPE, shell=True)
        proc.communicate(text.encode('utf-8'))
        print("[OK] Copied to clipboard!", file=sys.stderr)
    except Exception as e:
Confidence
94% confidence
Finding
The code invokes a subprocess with shell=True, which is unnecessary for running the fixed Windows clip utility and causes command resolution to occur through the shell. Even though no user-controlled arguments are interpolated, shell execution increases attack surface via PATH/COMSPEC hijacking or unexpected shell behavior, especially in untrusted environments.

Hidden Instructions

High
Category
Prompt Injection
Content
O�ǓB�_9.�_m����C�0]:�3ɘ�Kv,���?�!��}��Y;�P�Wa��9	��B�n�����j�#b�:��;&��C�&��89�Ί� ��~NE���i�'��M�:mv�T\_:�~��u��ar:�n!����'ර����爳�π
^:�G$�9
&I'd�M3�bY�,G
���D�J��$�	@�q���I6M�]�sgDyO�
��כ���h�ڍ��n�bLMG�⚁YR�=���_
�V��u����0_������N�,���j����
4�3A��@P]���Q��z0rU��2
Confidence
94% confidence
Finding
The PNG appears to contain a right-to-left override/control character (U+202E), which is a classic obfuscation primitive for hiding or visually reordering embedded text. In an agent-skill context, hidden Unicode control characters can conceal prompt instructions, filenames, or payloads from reviewers while still being processed by downstream tooling, making this materially dangerous even inside a nominal image asset.

Unpinned Dependencies

Low
Category
Supply Chain
Content
jieba>=1.0.0
Confidence
94% confidence
Finding
The dependency is specified with a lower bound only (jieba>=1.0.0), which allows installation of any newer version, including unexpected major releases or a compromised upstream release. This weakens build reproducibility and increases supply-chain risk because different environments may resolve to different package versions over time.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-pptx>=1.0.0
python-docx>=1.1.0
openpyxl>=3.1.0
pymupdf>=1.24.0
Confidence
92% confidence
Finding
The dependency is specified with a lower bound only, which allows installation of any newer release, including versions with breaking changes or newly introduced vulnerabilities. This weakens build reproducibility and increases supply-chain risk over time, especially for document-processing libraries that often handle untrusted files.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-pptx>=1.0.0
python-docx>=1.1.0
openpyxl>=3.1.0
pymupdf>=1.24.0
Pillow>=10.0.0
Confidence
92% confidence
Finding
The package uses a minimum-version constraint instead of an exact pin, so different environments may resolve to different releases. This creates a supply-chain exposure where a later compromised or vulnerable version could be installed without code changes.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-pptx>=1.0.0
python-docx>=1.1.0
openpyxl>=3.1.0
pymupdf>=1.24.0
Pillow>=10.0.0
jieba>=1.0.0
Confidence
92% confidence
Finding
Using an unpinned dependency permits nondeterministic installs and can silently pull in vulnerable or incompatible releases. For libraries that parse complex office formats, this can expand attack surface if hostile files are processed.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-pptx>=1.0.0
python-docx>=1.1.0
openpyxl>=3.1.0
pymupdf>=1.24.0
Pillow>=10.0.0
jieba>=1.0.0
Confidence
92% confidence
Finding
A >= specifier for pymupdf allows any later release to be selected, which undermines reproducibility and can introduce vulnerable builds unexpectedly. Because PDF parsing libraries commonly process attacker-controlled content, dependency drift is a meaningful security concern.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-docx>=1.1.0
openpyxl>=3.1.0
pymupdf>=1.24.0
Pillow>=10.0.0
jieba>=1.0.0
Confidence
97% confidence
Finding
The unpinned lower-bound constraint for Pillow is especially dangerous here because the static analysis also indicates a known vulnerable version at this line. This combination creates both reproducibility issues and an elevated chance of installing or retaining a release affected by image-parsing vulnerabilities, potentially leading to code execution or memory corruption when handling crafted files.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openpyxl>=3.1.0
pymupdf>=1.24.0
Pillow>=10.0.0
jieba>=1.0.0
Confidence
90% confidence
Finding
The jieba dependency is not pinned, so installations are not reproducible and may unexpectedly absorb future vulnerable or malicious releases. While the direct exploitability may be lower than binary file parsers, it still represents avoidable supply-chain risk.

Known Vulnerable Dependency: Pillow==10.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical
Category
Supply Chain
Confidence
98% confidence
Finding
The requirements file permits or reflects use of Pillow 10.0.0, which the finding reports as having multiple advisories including arbitrary code execution and buffer overflow issues. In a skill that appears to process documents and images, a crafted input file could trigger exploitation during parsing or rendering, making this materially more dangerous than a generic library issue.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def copy_to_clipboard(text):
    """Copy text to clipboard using Windows clip command."""
    try:
        proc = subprocess.Popen(['clip'], stdin=subprocess.PIPE, shell=True)
        proc.communicate(text.encode('utf-8'))
        print("[OK] Copied to clipboard!", file=sys.stderr)
    except Exception as e:
Confidence
88% confidence
Finding
The duplicated finding refers to the same risky subprocess pattern: a shell-backed invocation of clip. In an agent or automation context, spawning shell-mediated tools is more sensitive because runtime environment manipulation can convert an otherwise fixed command into execution of unintended code.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def copy_to_clipboard(text):
    """Copy text to clipboard using Windows clip command."""
    try:
        proc = subprocess.Popen(['clip'], stdin=subprocess.PIPE, shell=True)
        proc.communicate(text.encode('utf-8'))
        print("[OK] Copied to clipboard!", file=sys.stderr)
    except Exception as e:
Confidence
88% confidence
Finding
The duplicated finding refers to the same risky subprocess pattern: a shell-backed invocation of clip. In an agent or automation context, spawning shell-mediated tools is more sensitive because runtime environment manipulation can convert an otherwise fixed command into execution of unintended code.

Static analysis

No suspicious patterns detected.