ClawHub
Back to skill

Security audit

Ecommerce Product Info Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ecommerce product-image workflow, with some documentation and dependency hygiene issues but no artifact-backed malicious behavior.

Before installing, confirm why SUDOCODE_API_KEY is required, review or obtain the missing scripts before running them, and avoid sending confidential product images to the disclosed external API unless that service is approved for your use. Use a virtual environment and pinned dependency versions where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:878
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 878 and 883
Vulnerability Type: Supply-chain risk from mutable, unverified dependencies
Risk Level: Medium

Complete Code Snippet

bash
pip install opencv-python numpy
bash
winget install TesseractOCR.Tesseract
pip install pytesseract

Technical Analysis

The Skill instructs users or an executing agent to install third-party packages without pinning reviewed versions or verifying package hashes. Consequently, each installation resolves to whatever package release and dependency graph the configured package index serves at execution time.

This makes installation non-reproducible and creates a supply-chain exposure. If a package release, maintainer account, package-index route, or transitive dependency is compromised, installation or subsequent import could execute attacker-controlled code in the user's Python environment. The documented winget command is similarly unpinned, although the primary finding concerns the Python packages installed through pip.

No evidence in the reviewed file demonstrates that these packages are currently malicious. The vulnerability is the absence of dependency integrity controls.

Attack Path

  1. An attacker compromises an upstream package, maintainer account, distribution channel, or transitive dependency.
  2. The attacker publishes a malicious release that satisfies the unbounded dependency request.
  3. A user or agent follows the installation commands in SKILL.md.
  4. pip resolves and installs the attacker-controlled release without checking a project-supplied version lock or expected hash.
  5. Malicious code runs during an applicable installation hook or when the dependency is imported by the referenced image-processing workflow.
  6. The payload operates with the privileges of the user running pip or the associated Skill.

Impact Assessment

Successful exploitation could permit ...[truncated 632 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed, exact version.
  2. Record and pin the complete transitive dependency graph in a lock file.
  3. Require cryptographic hashes during installation, for example:
    bash
    python -m pip install --require-hashes -r requirements.txt
  4. Configure an approved package index or internally controlled mirror rather than relying on an unspecified index configuration.
  5. Pin the Tesseract package version in the winget command and verify its publisher and installer integrity.
  6. Run installation and image processing in an isolated virtual environment or restricted container without unnecessary credentials.
  7. Add automated dependency vulnerability and provenance scanning to the release process.
  8. Commit the referenced scripts and dependency manifest to the audited package so their imports and actual dependency usage can be reviewed together.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

L0223-L0240 明确规定目标国家/区域直接决定“语言文字”，例如欧洲、东南亚、巴西统一使用英文，且后文 L0304、L0494 还规定当前阶段仅输出中文。该文件没有提供用户语言/locale 选择或 opt-in 机制，属于自然语言层面的语言策略强制。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

L0302-L0316 规定“卖点结构化（仅中文输出）”，L0304 明确写明本阶段仅输出中文；L0492-L0517 对文案设计也再次要求“仅中文”。对于国际化电商视频场景，这种固定语言输出没有用户选择或同意，构成语言/locale policy violation。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 907)May include surrounding context.

使用方式：

bash
# 设置认证凭据（.env 文件或环境变量）
set AIGC_APP_KEY=your_app_key
set AIGC_APP_SECRET=your_app_secret

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L0003 将触发条件描述为用户上传产品图片并要求“分析这个产品”“提取卖点”“生成产品信息”时触发，其中“分析这个产品”尤其接近日常通用表述，缺少更明确的电商视频或商品营销上下文约束。文档也未提供负例或排除条件来界定何时不应触发该技能。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

L0071-L0072、L0415-L0416、L0531-L0533 都强调只有 product_layer.png 为图片，背景层和人物层仅为文本描述；但 L0651 又写“同时三层图片文件独立保存（不合成）”，与前述核心设计直接冲突。这会误导调用方认为本 Skill 会落地产生背景/人物图片文件。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L0302-L0304 明确说明卖点结构化“仅中文输出”，L0492-L0495 也说明文案设计“仅中文”，但 L0649-L0700 的强制输出模板却要求 {language} 市场语言、{product_name_translated}、{main_selling_point_translated}、{cta_translated} 等翻译后字段。这不是单纯遗漏，而是对该 Skill 是否负责多语言输出给出了互相冲突的指令。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.