ClawHub
Back to skill

Security audit

Chaoxing Download

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises, but it downloads Chaoxing documents without authentication checks and can write persistent PDF/TXT files in ways that need careful review.

Review before installing. Use this only for documents you are authorized to access, prefer a dedicated output directory, avoid untrusted names or batch inputs, confirm destinations before downloading, and pin/install dependencies in an isolated environment. Treat generated TXT files as sensitive because OCR can expose the full document contents in searchable plaintext.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:51
Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51-56
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip install pymupdf rapidocr-onnxruntime

Technical Analysis

The Skill directs the agent to install pymupdf and rapidocr-onnxruntime without exact version constraints, integrity hashes, a lock file, or an explicitly trusted package index. Consequently, the installed code may differ from the code that existed when the Skill was audited.

Python packages can execute package-controlled installation or build logic and subsequently run inside the PDF conversion process. If a dependency, transitive dependency, release account, or configured package index is compromised, following this instruction could introduce attacker-controlled code. The instruction does not itself prove that either named package is malicious; the vulnerability is the mutable and unverified dependency resolution process.

Attack Path

  1. A user invokes the Skill to download and convert a document.
  2. The required Python packages are unavailable in the current environment.
  3. The agent follows the documented prerequisite and runs the unpinned pip install command.
  4. pip resolves the latest available packages and transitive dependencies from its configured index.
  5. A compromised or unexpectedly modified package executes during installation, import, or document processing.
  6. The package code operates with the privileges of the account running the agent.

Impact Assessment

Successful supply-chain exploitation could execute arbitrary code with the invoking user's privileges. This may expose files, environment variables, credentials available to that account, and data processed by the Skill. It could also modify user-accessible files or make unauthorized network requests. The issue does not independently grant administrative privileges unless the installation is ...[truncated 43 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every direct and transitive dependency to a reviewed exact version.
  • Store dependencies in a lock file or hash-checked requirements file.
  • Install with hash verification, for example through pip install --require-hashes.
  • Specify and enforce an approved package index rather than inheriting an arbitrary local pip configuration.
  • Install dependencies inside an isolated virtual environment with the minimum required permissions.
  • Scan pinned artifacts for known vulnerabilities and review updates before changing versions.
  • Prefer prebuilt, verified artifacts and document their expected hashes.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:139
Finding

Unsanitized Document Name Permits Path Traversal and Unsafe Shell Expansion

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 139-145
Vulnerability Type: Improper validation of a user-controlled output path
Risk Level: Medium

Vulnerable Code:

bash
for oid_name in "OBJECTID1:NAME1" "OBJECTID2:NAME2"; do
  oid="${oid_name%%:*}"; name="${oid_name##*:}"
  info=$(curl -s -L "https://contestyd.chaoxing.com/app/files/$oid/getYunFiles?key=allData")
  pagenum=$(echo "$info" | grep -o '"pagenum":[0-9]*' | cut -d: -f2)
  pdf_url=$(echo "$info" | grep -o '"pdf":"[^"]*"' | head -1 | tr -d '"' | sed 's/^pdf://')
  echo "$name: ${pagenum}p"
  curl -s -L -o ~/Downloads/chaoxing_pdfs/${name}.pdf "$pdf_url"
done

The placeholder names in the excerpt above are translated to English; the command structure is unchanged.

Technical Analysis

The name value is derived from task data and inserted into a filesystem path without validation or canonicalization. A value containing path separators or traversal components such as ../ can cause the destination to resolve outside ~/Downloads/chaoxing_pdfs.

In addition, ${name} is unquoted in the shell command. Shell word splitting and pathname expansion therefore apply to its expanded value. Spaces and wildcard characters can alter the argument list or cause unpredictable output behavior. Shell control operators embedded inside the variable are not reparsed as command syntax, so the shown code does not by itself establish arbitrary shell-command injection; the confirmed issues are path traversal, unintended file placement, and unsafe shell expansion.

The batch loop also does not implement the stated no-overwrite behavior. By default, curl -o replaces an existing writable destination, increasing the impact of a traversal path.

Attack Path

  1. An attacker or untrusted task source supplies a document name containing traversal components, such as ../../target.
  2. The loop extracts that value into name.
  3. The value is c ...[truncated 1159 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat every user-provided name as untrusted.
  • Reject absolute paths, path separators, null bytes, . and .. path components.
  • Convert the input to a safe basename and apply a conservative character allowlist.
  • Resolve the final canonical path and verify that it remains beneath the canonical download directory.
  • Quote every shell expansion:
    bash
    output="$HOME/Downloads/chaoxing_pdfs/${safe_name}.pdf"
curl --fail --silent --show-error --location --output "$output" "$pdf_url"
  • Use -- where supported to terminate command options and prevent option confusion.
  • Create the destination directory with controlled permissions before downloading.
  • Enforce no-clobber behavior by default, or require explicit user confirmation before overwriting an existing file.
  • Prefer implementing path construction in a language with robust path APIs rather than constructing paths in a shell loop.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly states that only an objectid is needed to retrieve a direct PDF link and that no cookies or authentication are required. That materially lowers the barrier to accessing and redistributing documents referenced by user-supplied identifiers, creating a clear data exposure risk if the identifiers point to documents that were not meant for broad public retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill directs automatic remote download of PDFs and local writes into the user's Downloads directory, followed by TXT generation, without an explicit confirmation or warning about filesystem modification. This is dangerous because it causes network access and persistent local side effects from parsed user input, increasing the risk of unwanted file creation, storage of sensitive material, or misuse if the input is malformed or socially engineered.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill goes beyond downloading by automatically converting the entire PDF into plain text and using OCR on image pages, which increases the accessibility, searchability, and persistence of potentially sensitive document contents. This amplifies exposure because material that may have been harder to extract from PDFs becomes trivially reusable in TXT form.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The CLI and batch examples normalize remote fetching and include overwrite-capable behavior (-f) without safety guidance about downloading untrusted content or replacing existing files. In an agent setting, this can lead to silent retrieval of attacker-chosen files and unintended file replacement if the tool is invoked from user-controlled input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.