ClawHub
Back to skill

Security audit

敏感词筛查 CMT 1.0

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local document sensitive-word highlighter, but it can overwrite user documents without a clear confirmation or distinct output filename.

Review before installing. Use it only on documents you are comfortable processing locally, run it in a virtual environment, choose a separate output directory, and keep backups because the current script may overwrite files with the same name.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:86
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:86-88; duplicated in references/usage.md:3-6
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:86-88:

bash
pip install python-docx openpyxl pypdf2 pymupdf

references/usage.md:3-6:

markdown
## Install Dependencies

```bash
pip install python-docx openpyxl pypdf2 pymupdf
text

### Technical Analysis

The installation instructions retrieve four third-party packages without exact version constraints, cryptographic hashes, a lockfile, or a controlled package index. Consequently, the code installed by this command can change independently of the reviewed Skill.

This creates a supply-chain exposure in which a compromised upstream release, package-index account, dependency resolution path, or configured package mirror could cause users to install unreviewed code. Python packages may execute code during installation, and their modules subsequently execute in the context of the document-processing script.

The package names do not show evidence of deliberate typosquatting, and the project does not itself retrieve a known malicious dependency. The risk arises from unsafe, non-reproducible dependency installation rather than a confirmed malicious package.

### Attack Path

1. An attacker compromises an upstream dependency release, maintainer account, package mirror, or package-resolution path.
2. The attacker publishes a malicious version under one of the dependency names accepted by the unpinned command.
3. A user follows the documented `pip install` instruction.
4. Package-management resolution selects the malicious or compromised release.
5. Attacker-controlled code executes during installation or when the script imports the affected package.
6. The code runs with the privileges of the user invoking `pip` or the document scanner.

### Impact Assessment

Successf
...[truncated 464 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed dependency lockfile with exact versions.
  2. Include cryptographic hashes and require their validation during installation:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Generate and retain the lockfile through a reproducible dependency-management process.
  4. Configure installation to use an approved package index or internal mirror.
  5. Regularly scan locked dependencies for known vulnerabilities and review updates before changing versions.
  6. Run the scanner in an isolated virtual environment or restricted container with access only to the required input and output files.
  7. Update both SKILL.md and references/usage.md so they provide identical hardened installation instructions.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/sensitive_word_checker.py:476
Finding

Output Path Collision Can Overwrite the Source Document

Content
View full analysis

Vulnerability Details

File Location: scripts/sensitive_word_checker.py:476-479; write operations at scripts/sensitive_word_checker.py:356, 384, 413, and 439
Vulnerability Type: Unsafe output-path handling and destructive file overwrite
Risk Level: Medium

Vulnerable Code

Output construction at scripts/sensitive_word_checker.py:476-479:

python
# Output path
input_path = Path(args.input)
output_dir = Path(args.output) if args.output else get_desktop_path()
output_file = output_dir / input_path.name

Relevant write operations:

python
# DOCX output, line 356
doc.save(output_file)
python
# Excel output, line 384
wb.save(output_file)
python
# PDF output, line 413
doc.save(output_file)
python
# PDF fallback output, line 439
shutil.copy(input_file, str(output_file))

Technical Analysis

The output filename always reuses the input document's basename. The script does not normalize and compare the resolved input and output paths before writing.

If --output identifies the input file's parent directory, output_file resolves to the same path as args.input. The DOCX, XLSX, and PyMuPDF processing branches may therefore save the processed document over the original source. The PyPDF2 fallback copy can instead fail because the source and destination are the same file.

This is unsafe because users reasonably expect a document-auditing utility to preserve the original document and produce a separate annotated copy. The code also writes directly to the final destination rather than first creating a temporary file and atomically replacing a distinct output target. A processing or filesystem failure during a direct overwrite may increase the risk of corruption or incomplete output.

Attack Path

  1. A user or calling automation selects a document such as /data/contracts/agreement.docx.
  2. The caller supplies /data/contracts a ...[truncated 1108 chars]
Remediation
View remediation

Remediation Suggestions

  1. Generate a distinct output name by default, such as:
    python
    output_file = output_dir / f"{input_path.stem}_highlighted{input_path.suffix}"
  2. Resolve and compare both paths before processing:
    python
    input_resolved = input_path.resolve()
output_resolved = output_file.resolve()

if input_resolved == output_resolved:
    raise ValueError("The output file must be different from the input file.")
  3. Reject collisions even when relative paths, symbolic links, or path traversal components make two differently written paths resolve to the same file.
  4. Create the output directory explicitly and validate that it is a directory:
    python
    output_dir.mkdir(parents=True, exist_ok=True)
if not output_dir.is_dir():
    raise ValueError("The output path is not a directory.")
  5. Write to a temporary file in the destination directory and atomically rename it only after successful processing.
  6. Avoid replacing an existing output unless the user explicitly supplies an overwrite option.
  7. Preserve or back up the original document when an explicit overwrite mode is supported.
  8. Add tests covering identical paths, relative-path aliases, symbolic links, nonexistent output directories, existing destination files, and interrupted writes.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
脚本位于当前 skill 目录下的 `scripts/sensitive_word_checker.py`。

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs execution of a local Python script that reads user-supplied files and writes modified output files, but it declares no tool scope or permissions boundary. This creates an authorization gap: an agent may be allowed to perform file-writing behavior without explicit least-privilege constraints, increasing the chance of unintended file modification or misuse of local file access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill name and all operating instructions are presented only in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional and justified. This can violate language/locale policy when a skill implicitly enforces one language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger keywords include very broad terms such as '检查' and '审核', which can overlap with many ordinary document-review requests unrelated to sensitive-word scanning. Overbroad activation can cause the wrong skill to run on user files, leading to unnecessary file processing, unintended highlighting/modification, or confusion about agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code saves a processed copy of the user's document to an output path, which is a file-write operation affecting user data. While progress messages are printed, there is no explicit warning or confirmation that the tool will create or overwrite a file with modified content on the desktop or in the specified output directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Saving the workbook is a safety-relevant file-write operation because it creates or replaces an output file containing user spreadsheet data. The script does not clearly disclose this behavior as a warning, nor does it confirm before writing, despite defaulting output to a desktop location.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This save operation produces a modified PDF with annotations, which changes how the user's document is stored and shared. Although the tool reports the output path afterward, it does not warn beforehand that it will write an altered copy of the source file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The stated purpose says the skill should check PDF files and highlight sensitive words in yellow. However, when PyMuPDF is unavailable, the fallback routine explicitly '只能报告不能标注' and merely copies the input PDF to the output path, so the promised highlighting behavior is not actually delivered in that execution path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Even in fallback mode, the script performs a file-write by copying the original PDF to a new output path. There is no explicit disclosure that the user's document will be duplicated to disk, which matters because the default destination is the desktop and existing files may be replaced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The docstring and all user-facing CLI messages are presented only in Chinese, which imposes a fixed language on users without opt-in. Under the policy, language-specific behavior should either offer a choice or clearly justify the locale restriction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description says it checks 'Word' files, which commonly includes both .doc and .docx. In code, the external word library is restricted to .docx and document scanning only dispatches for '.docx', while unsupported extensions are rejected, so the implemented behavior is narrower than the manifest claim.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.