ClawHub
Back to skill

Security audit

美光车险PDF转Excel

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform the advertised insurance-PDF extraction, but it exports sensitive personal data into an unprotected spreadsheet with avoidable safety gaps.

Install or use this only if you are authorized to process the insurance PDFs involved. Change the output path to a protected location, restrict access to the generated spreadsheet, delete it when no longer needed, and treat source PDFs as untrusted. Do not run the optimize_*.py scripts unless you intentionally want to rewrite run_extract.py and have a backup.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/run_extract.py:4299
Finding

Spreadsheet Formula Injection Through Untrusted PDF Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
python scripts/run_extract.py

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
python scripts/run_extract.py

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is explicitly designed to extract and export highly sensitive personal and insurance-policy data, including names, ID numbers, phone numbers, VINs, policy numbers, and license plates, yet it provides no privacy, consent, retention, or secure-handling guidance. This creates a real risk of unauthorized disclosure, insecure local storage, and non-compliant processing of regulated personal data, especially because the output is written to a desktop Excel file that may be broadly accessible.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring states this is a 'Performance optimization patch' that applies optimizations 'without changing output logic'. However, the script replaces parsing code paths with cache-backed alternatives, adds fallback logic, and alters how values are derived across multiple parser functions, which can change behavior if cached content differs from fresh reads or if replacement snippets modify control flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script unconditionally overwrites run_extract.py in place, which is dangerous because it modifies executable parsing logic without confirmation, backup, or integrity checks. In an agent skill context, this can silently alter downstream behavior, corrupt the target file, or introduce hard-to-detect logic changes if the patch content is wrong or tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script unconditionally opens run_extract.py for writing and replaces its contents without any confirmation, backup, path validation, or dry-run mode. In an agent skill context, this is dangerous because running the script mutates source code in place, making accidental corruption, unauthorized code modification, or destructive changes much easier.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This script extracts highly sensitive personal data from insurance PDFs, including names, ID numbers, phone numbers, license plates, and VINs, then propagates that data across records using matching and majority-vote logic. In skill context, this increases privacy and compliance risk because it amplifies disclosure scope, can wrongly associate one person's identifiers with another record, and processes more personal data than minimally necessary.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/run_extract.py (reported line 4336)May include surrounding context.

python
# 按保险公司名称↑ + 车牌号码↑ 排序
    df = df.sort_values(by=["保险公司名称", "车牌号码"], ascending=True)
    # 清理非法字符，防止 openpyxl IllegalCharacterError
    _ILLEGAL_RE = __import__('re').compile(r'[\x00-\x08\x0b\x0c\x0e-\x1f]')
    for col in df.columns:
        if df[col].dtype.kind == 'O':
            df[col] = df[col].apply(lambda v: _ILLEGAL_RE.sub('', v) if isinstance(v, str) else v)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script writes a consolidated Excel file containing sensitive insurance and identity data to a fixed desktop path without encryption, access control checks, masking, or any user-facing privacy warning. In this context, that creates a real confidentiality risk because the output is easy to discover, copy, sync, or mishandle on an endpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

All user-facing documentation, labels, and instructions are presented in Chinese, and there is no indication that users can choose another language or that the Chinese-only scope is an intentional, documented locale constraint. The policy requires flagging natural-language locale constraints when a specific language is effectively forced without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The file contains multiple hard-coded Chinese-language docstring/comment fragments and text-processing literals, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The embedded natural-language description and many injected labels hard-code Chinese-language naming and field conventions, such as the version banner and multiple Chinese field names. There is no indication that the skill offers a language choice or that the locale restriction is explicitly documented as region-specific, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The primary natural-language description, operational scope, and many comments are presented exclusively in Chinese. For a general-purpose skill file, this imposes a language constraint without any opt-in, alternative locale, or justification that the tool is region-specific only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Allowing LOG_FILE to direct logs to an arbitrary filesystem path can expose operational data to unintended locations, especially in shared or privileged environments. While this script does not obviously log full extracted document contents by default, exception traces, filenames, and future debug additions can still leak sensitive information into insecure log files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The section header and docstring describe an "OCR fallback," suggesting image-based text recognition for garbled PDFs. However, extract_product_name_from_pdf only opens the PDF with fitz and calls page.get_text("text"), which is another text-layer extraction method rather than OCR, so the documentation overstates what the code actually does.

Content

No source excerpt is available for this finding.