ClawHub
Back to skill

Security audit

energy-service-risk-inspect

Security checks for vulnerabilities and agentic risk

Overview

The skill is rated suspicious because scanners report risks in its report-building and reporting workflow; the evidence does not establish malicious intent, and coverage was incomplete.

Consider the suspicious rating before installing. The scanner reports code-execution and redirected-write risks in the scan workflow, plus a risk that reports may be sent to an untrusted endpoint. The skill scan was partial: no components were fully inspected, and one analyzer was degraded, so the evidence is incomplete.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:396
Finding

Repository-controlled Python modules can execute during report assembly ## Remediation Suggestions - Invoke the reporting interpreter in isolated mode, for example `python3 -I -`, so the current repository and Python-specific environment settings cannot influence imports. - Run trusted reporting code from a trusted directory outside the checkout, supplying validated artifact paths explicitly. - Keep reporting dependencies outside repository-controlled paths. - Add a regression test containing a repository-level `json.py` with a harmless execution marker, and verify that report assembly never imports it. - Apply least privilege to the reporting process as defense in depth, limiting access to unrelated secrets and host files.

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:396–397; the workflow runs this program from the cloned repository.
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Technical Analysis

Step 3 assembles the report by invoking Python with its program supplied through standard input:

bash
python3 - <<'PY'
import json, os, base64

In a standard Python invocation of this form, the current directory participates in module resolution. Because the current directory is the repository being inspected, a repository-controlled json.py file or json package can be imported instead of the standard-library module. Importing that module executes its top-level code.

The reporting command does not use Python isolated mode or otherwise exclude the repository from module resolution. Consequently, repository content intended only for inspection can become executable code with the scanning agent's permissions.

The default setting that skips Maven compilation does not block this path: report assembly is a separate workflow stage and still invokes Python.

Attack Path

  1. An attacker contributes a top-level json.py file or json package to a repository branch that will be scanned.
  2. An authorized user requests a scan of that branch. The user need not enable isBuild.
  3. The Skill clones the repository and uses its root as the working directory.
  4. Step 3 executes python3 - and imports json.
  5. Python resolves the attacker-controlled module from the repository and executes its top-level code before report assembly completes.

This attack requires control of repository content, not control of the scanning host or the user's Skill parameters.

Impact Assessment

Successful exploitation permits arbitrary code execution under the scanning process's operating-system identity. The payload can access files, credentials, and network resources available to that process.

The supplied project does not establish sandbox res ...[truncated 233 chars]

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:467
Finding

Committed symbolic links can redirect metadata and payload writes outside the checkout ## Remediation Suggestions - Store operational metadata and report payloads in a separate trusted per-task directory that is never populated by repository checkout. - If an output must be created within the checkout, reject pre-existing entries and use exclusive, no-follow file creation, such as `os.open` with `O_CREAT | O_EXCL | O_NOFOLLOW` where supported. - Avoid relying solely on a preliminary symbolic-link check; creation must enforce the restriction atomically. - Protect all workflow-generated filenames consistently, including metadata, findings, and report payloads. - Add tests with committed symbolic links at the generated filenames and verify that external targets remain unchanged. - Restrict the scanning process's filesystem permissions to reduce the scope of any redirected write.

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:185–198 and SKILL.md:467–468
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Technical Analysis

The Skill writes fixed filenames directly into the checked-out repository. The metadata-writing command is:

bash
cat > run-meta.env <<'META_EOF'
REQ_ID=R-XJNY-685092
ODIN_NS=silverbullet
TASK_ID=12345
GIT_URL=https://git.xiaojukeji.com/amonline_energy/silverbullet.git
BRANCH=feature-risk-20260722
BRANCH_COMMIT_ID=
BASE_COMMIT_ID=5a77f5fd928c18310a7f05b3c7c93be9e4f943c7
META_EOF

The report payload is subsequently written using:

python
with open("report_payload.json", "w", encoding="utf-8") as f:
    json.dump(payload, f, ensure_ascii=False, separators=(",", ":"))

Both shell output redirection and Python's open(..., "w") follow an existing symbolic link. A repository contributor can commit either fixed filename as a symbolic link pointing outside the clone. When the workflow writes that filename, it creates or truncates the resolved target if the agent has sufficient filesystem permissions.

Randomized checkout directory names prevent naming collisions between tasks, but do not constrain the destination of a symbolic link inside the checkout. Instructions requiring the files to be located within the clone likewise do not enforce where their filesystem targets resolve.

Attack Path

  1. An attacker commits run-meta.env or report_payload.json as a symbolic link to a known host path outside the checkout.
  2. An authorized user requests a scan of the affected branch.
  3. On a platform that materializes Git symbolic links, checkout creates the attacker-controlled link.
  4. The Skill writes metadata immediately after checkout, or writes the report payload during Step 3.
  5. The write follows the symbolic link and creates or truncates its target under the agent's filesystem permissions.

The attack does not require a predictable clone directory, a same-host ...[truncated 582 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Reporting is an intended feature, but callers can override the reporting endpoint without a documented destination allowlist or HTTPS requirement. A caller able to influence configuration could redirect private-repository findings, complete HTML reports, repository metadata, and error excerpts to an attacker-controlled service; automatic reporting without interaction makes that trust-boundary failure more dangerous. HTTP endpoints are also explicitly contemplated, exposing reports to interception and tampering in transit.

Content

Scanner excerpt · SKILL.md (reported line 475)May include surrounding context.

md
- **找不到 HTML 不阻断上报**：`htmlReport` 字段缺省，其余字段照常上报。
- **`spec-findings.json` 缺失 / 解析失败不阻断上报**：`specResult` 字段缺省，其余照常（`spec_unavailable` / `parseError` 场景由 `error` 兜底）。
- **严禁本 skill 自建 / 渲染 HTML**：`htmlReport` 必须来自 spec 产物；spec 未产出就缺省，**不得用模板自行生成替代**。
- **严禁把 `specResult` / `htmlReport` 塞回 bash 变量再拼 JSON**：一切组装只经上述 Python `json.dump` 完成；`report_payload.json` 落盘后直接 `curl --data-binary @report_payload.json` 读文件上报，不再经 shell 二次展开。
- **无 clone 目录的失败行（`param_invalid` / `token_failed` / `clone_failed`）**：没有 `run-meta.env`，标量字段改经 `P_REQ_ID` / `P_ODIN_NS` / `P_TASK_ID` / `P_GIT_URL` / `P_BRANCH` / `P_BRANCH_COMMIT_ID` / `P_BASE_COMMIT_ID` 环境**字面值** export 提供（`P_BUILD_STATUS="skipped"`、`P_COMMIT_ID` 留空），Python 模板不变（`run-meta.env` 缺失自动走 P_* 分支）；`report_payload.json` 不落盘——Python 末尾的 `json.dump` 换成 `print(json.dumps(payload, ensure_ascii=False, separators=(",", ":")))`，`curl --data-binary @-` 从 stdin 读。

POST 到上报接口（先判断 `${REPORT_ENDPOINT}` 是否配置；用 `--data-binary @report_payload.json` 直接读文件，规避命令行长度与转义问题

The manifest promises automatic Maven compilation, but the workflow skips compilation by default.

Low
Category
Excessive Agency
Confidence
99% confidence
Finding

L003 describes an automatic pipeline that includes cloning and Maven compilation. However, L212–L218 execute Maven only when the additional isBuild parameter equals 1; a caller providing only the manifest-described inputs receives a scan without the advertised compilation validation.

Content

No source excerpt is available for this finding.