ClawHub
Back to skill

Security audit

海运托书智能提取 Shipping Booking Extractor

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate shipping-document extraction skill, but it needs Review because it can send sensitive documents and API credentials to unvalidated external AI endpoints and auto-read local OpenClaw auth profiles.

Install only if you are comfortable with booking documents, including commercial and personal shipping details, being sent to the configured AI provider. Use a trusted provider endpoint, avoid setting OPENAI_BASE_URL to an untrusted host, review OpenClaw auth-profile access, and use an isolated environment with pinned dependencies for sensitive workflows.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/extract.py:539
Finding

Unrestricted Custom API Endpoint Can Receive Credentials and Document Contents

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/extract.py:327
Finding

Untrusted Document Instructions Can Manipulate AI-Generated Extraction Results

Content
View full analysis
dict: """纯文本模式（Excel/Word/RTF）""" prompt = f"{PROMPT_TEMPLATE}\n\n【托书文本内容】\n{text}" if provider == "anthropic": message = client.messages.create( model=_get_model(provider), max_tokens=2048, messages=[{"role": "user", "content": prompt}] ) return parse_claude_response(message.content[0].text) else: response = client.chat.completions.create( model=_get_model(provider), max_tokens=2048, messages=[{"role": "user", "content": prompt}] ) return parse_claude_response(response.choices[0].message.content) ``` The returned content is accepted using permissive JSON extraction: ```python def parse_claude_response(raw: str) -> dict: """解析 Claude 返回的 JSON""" raw = raw.strip() json_match = re.search(r'\{[\s\S]*\}', raw) if not json_match: raise ValueError("Claude 返回格式异常，未找到有效 JSON") return json.loads(json_match.group()) ``` The subsequent validity check only requires two populated core fields: ```python def is_valid_booking(data: dict) -> bool: if data.get("confidence") == "invalid": return False core_fields = ["shipper_name", "consignee_name", "pol", "pod", "cargo_description"] non_null = sum(1 for f in core_fields if data.get(f)) return non_null >= 2 ``` ### Technical Analysis Text extracted from an attacker-controlled PDF, spreadsheet, Word file, or RTF file is concatenated into the same model message as the extraction instructions. The model is not explicitly instructed to treat instructions found inside the document as untrusted data, and no struc ...[truncated 1952 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (30)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares shell, file-read, and environment-dependent behavior but does not define an explicit tool/permission scope. That creates unnecessary privilege ambiguity: an agent may execute commands, read local files, or access API keys beyond the minimum needed, increasing the blast radius if the skill is mis-triggered or its downstream script behaves unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill explicitly routes document content to third-party model endpoints, so uploaded booking documents may leave the local environment and be processed by external providers. Because booking files commonly contain commercial and personal data, unintended disclosure can occur if users are not clearly gated, if tenant-approved endpoints are not enforced, or if the skill is triggered on the wrong file.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
|------|------|
| ✅ 推荐 | 在 OpenClaw 中已配置 AI 账号，**自动读取，无需任何操作** |
| Anthropic Claude | `export ANTHROPIC_API_KEY=your_key` |
| DeepSeek | `export OPENAI_API_KEY=your_key` `export OPENAI_BASE_URL=https://api.deepseek.com/v1` |
| 通义千问 | `export OPENAI_API_KEY=your_key` `export OPENAI_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1` |
| Kimi | `export OPENAI_API_KEY=your_key` `export OPENAI_BASE_URL=https://api.moonshot.cn/v1` |
| 智谱 GLM | `export OPENAI_API_KEY=your_key` `export OPENAI_BASE_URL=https://open.bigmodel.cn/api/paas/v4` |

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This finding reflects another third-party endpoint option for transmitting extracted document content to an external AI service. In this skill’s context, the danger is not the specific provider string itself but the designed behavior of sending potentially sensitive shipping instructions to outside services, which increases confidentiality and compliance risk.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
| Anthropic Claude | `export ANTHROPIC_API_KEY=your_key` |
| DeepSeek | `export OPENAI_API_KEY=your_key` `export OPENAI_BASE_URL=https://api.deepseek.com/v1` |
| 通义千问 | `export OPENAI_API_KEY=your_key` `export OPENAI_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1` |
| Kimi | `export OPENAI_API_KEY=your_key` `export OPENAI_BASE_URL=https://api.moonshot.cn/v1` |
| 智谱 GLM | `export OPENAI_API_KEY=your_key` `export OPENAI_BASE_URL=https://open.bigmodel.cn/api/paas/v4` |
| 自定义文本模型 | `export SHIPPING_MODEL=your_model_name` |
| 自定义视觉模型 | `export SHIPPING_VISION_MODEL=your_vision_model`（用于图片/PDF） |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes generic terms such as “解析”, “识别”, and “extract”, which are common in many unrelated file-processing requests. This can cause unintended activation on non-booking documents, leading the skill to run extraction logic and potentially transmit unrelated uploaded content to external AI APIs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file contains all instructional content in Chinese and does not provide an English alternative, opt-in, or justification that the skill is intentionally limited to a Chinese-speaking or region-specific workflow. That can violate language/locale policy because it effectively forces one language for users consuming the skill documentation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract.py (reported line 89)May include surrounding context.

python
with tempfile.NamedTemporaryFile(suffix='.txt', delete=False) as tmp:
            tmp_path = tmp.name
        try:
            result = subprocess.run(
                ['textutil', '-convert', 'txt', '-output', tmp_path, file_path],
                capture_output=True, text=True, timeout=30
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract.py (reported line 133)May include surrounding context.

python
# 非 macOS：尝试 LibreOffice headless
        try:
            with tempfile.TemporaryDirectory() as tmp_dir:
                result = subprocess.run(
                    ['libreoffice', '--headless', '--convert-to', 'txt:Text', '--outdir', tmp_dir, file_path],
                    capture_output=True, text=True, timeout=60
                )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code sends extracted text and document images to third-party AI providers, which may include sensitive commercial and personal shipping data, without any explicit warning or confirmation step. In this skill context, booking instructions commonly contain consignee/shipper identities, addresses, cargo details, and routing information, so silent external transmission materially raises confidentiality risk.

Content

No source excerpt is available for this finding.

Ssd 1

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Untrusted document text is concatenated directly into the same prompt that contains extraction instructions, so instruction-like content inside the booking document can semantically steer the model. In practice, this can cause incorrect extraction, refusal, fabricated JSON, or attempts to override the intended schema, reducing integrity and reliability of downstream structured data.

Content

No source excerpt is available for this finding.

Ssd 1

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The PDF path mixes extraction instructions, text-layer content, and page images in a single multimodal prompt. A malicious PDF can embed natural-language directives in either text or visible content that influence the model's interpretation, making output integrity especially fragile for scanned forms and adversarial layouts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill claims to process uploaded booking documents, but it also reads local OpenClaw authentication files to discover API credentials automatically. That expands its access beyond the user-provided file set and can surprise users, especially in a document-processing tool that has no obvious need to inspect unrelated local config data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Accessing unrelated local authentication material is outside the minimum privileges required for extracting booking data from uploaded files. Even if the code only uses the keys for outbound API calls, the capability itself increases the blast radius of compromise and violates least-privilege expectations for this skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/extract.py (reported line 450)May include surrounding context.

python
]
    # OpenAI 兼容的国产模型 base_url 映射
    OPENAI_COMPAT_PROVIDERS = {
        "deepseek":  "https://api.deepseek.com/v1",
        "qwen":      "https://dashscope.aliyuncs.com/compatible-mode/v1",
        "moonshot":  "https://api.moonshot.cn/v1",
        "zhipu":     "https://open.bigmodel.cn/api/paas/v4",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/extract.py (reported line 553)May include surrounding context.

python
]
    # OpenAI 兼容的国产模型 base_url 映射
    OPENAI_COMPAT_PROVIDERS = {
        "deepseek":  "https://api.deepseek.com/v1",
        "qwen":      "https://dashscope.aliyuncs.com/compatible-mode/v1",
        "moonshot":  "https://api.moonshot.cn/v1",
        "zhipu":     "https://open.bigmodel.cn/api/paas/v4",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/extract.py (reported line 452)May include surrounding context.

python
OPENAI_COMPAT_PROVIDERS = {
        "deepseek":  "https://api.deepseek.com/v1",
        "qwen":      "https://dashscope.aliyuncs.com/compatible-mode/v1",
        "moonshot":  "https://api.moonshot.cn/v1",
        "zhipu":     "https://open.bigmodel.cn/api/paas/v4",
        "openai":    None,  # 官方 OpenAI，无需自定义 base_url
    }

Ssd 1

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This call path passes text derived from rich documents into the same prompt channel used for tasking the model. Since office documents can contain hidden or non-obvious natural-language content, an attacker could embed paraphrased jailbreak or behavior-redirecting instructions that static keyword matching would miss.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency list leaves anthropic unpinned, so builds may install different versions over time, including versions with known security defects or breaking behavior. In a file-processing skill that handles untrusted user uploads, dependency drift increases supply-chain risk and makes it impossible to verify whether a safe release is installed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
anthropic
openai
pdfplumber
pymupdf

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The manifest does not pin anthropic, so it is impossible to determine whether deployment will use a version affected by known advisories. Even though this package is not a document parser, known SDK flaws combined with version ambiguity create avoidable supply-chain and runtime risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The openai package is unpinned, which makes installations non-reproducible and can silently introduce vulnerable or incompatible versions. Although this is not direct code execution by itself, it weakens supply-chain integrity and operational assurance.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
anthropic
openai
pdfplumber
pymupdf
python-docx

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

pdfplumber is unpinned, allowing arbitrary future releases to be installed during deployment. Because this skill parses uploaded documents, parser-library changes can introduce exploitable bugs or unsafe defaults without notice.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
anthropic
openai
pdfplumber
pymupdf
python-docx
openpyxl

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

PyMuPDF is unpinned despite known advisories existing for some releases, so the deployment may resolve to an affected version without visibility. This is more concerning here because the skill ingests attacker-controlled PDFs and images, making document-parser vulnerabilities more relevant than in a non-file-processing tool.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
anthropic
openai
pdfplumber
pymupdf
python-docx
openpyxl
xlrd

Unverifiable Dependency: pymupdf has 2 known advisory(ies) (CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
98% confidence
Finding

PyMuPDF has known advisories and the requirements file does not pin a version, so an affected release could be installed unknowingly. This is especially dangerous in this skill because PyMuPDF processes untrusted uploaded documents, making parser/path-handling flaws directly reachable through expected user inputs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

python-docx is unpinned even though older releases have had XML external entity-related issues. Since this skill processes uploaded Office-style documents from users, leaving the parser version uncontrolled increases the chance of exposing the service to file-based attacks.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text
openai
pdfplumber
pymupdf
python-docx
openpyxl
xlrd
striprtf

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
98% confidence
Finding

python-docx has known XXE-related advisories, and without version pinning there is no assurance the deployed environment uses a patched release. Because this skill accepts user-provided document files, a vulnerable XML parser could potentially be exploited via crafted DOCX content during normal operation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

openpyxl is unpinned and historical versions have had XXE-related vulnerabilities. In a workflow that parses user-supplied spreadsheet files, this elevates the practical risk because a vulnerable parser could be reached directly through normal skill usage.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text
pdfplumber
pymupdf
python-docx
openpyxl
xlrd
striprtf

Static analysis

No suspicious patterns detected.