ClawHub
Back to skill

Security audit

纪念日管理

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent private date manager that stores user-entered date records locally, with some privacy and dependency hygiene caveats but no evidence of deception or exfiltration.

Install only if you are comfortable storing personal dates, relationships, and notes in a local plaintext JSON file under the skill directory. Use a virtual environment, consider pinning the optional dependencies before installing them, and be careful with delete commands because the artifact does not provide an undo or confirmation step.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:488
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:488
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install zhdate chinese-calendar

Technical Analysis

The installation instruction retrieves zhdate and chinese-calendar from the user's configured Python package index without fixed versions, package hashes, a lockfile, or a verified source constraint. Consequently, the dependencies resolved at installation time may differ from those reviewed or tested by the project author.

Python packages may execute code during installation and when imported. The script imports these packages at runtime for lunar-date and solar-term functionality. If a package release, its maintainer account, the configured package index, or the dependency-resolution path is compromised, attacker-controlled code could execute with the privileges of the user running the installation or script.

The audit found no evidence that these packages are currently malicious. The issue is the mutable and insufficiently verified supply-chain boundary.

Attack Path

  1. An attacker compromises a dependency release, maintainer account, package-index mirror, or another relevant package-resolution component.
  2. The user follows the documented pip install zhdate chinese-calendar instruction.
  3. pip resolves the attacker-controlled version because the project imposes no version or hash restrictions.
  4. Malicious package code executes during installation or when date_manager.py imports the dependency.
  5. The payload operates with the invoking user's privileges and can access resources available to that account.

Impact Assessment

Successful exploitation could permit arbitrary Python code execution under the invoking user's account. The accessible scope could include the project's date records, files readable or writable by that user, environment variables, and network resources available to the process. This fi ...[truncated 126 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin each dependency to a specifically reviewed version.
  2. Generate a lockfile or requirements file containing cryptographic hashes.
  3. Install with hash verification, for example:
bash
python -m pip install --require-hashes -r requirements.txt
  1. Use an explicitly documented and trusted package index rather than relying silently on arbitrary user configuration.
  2. Review direct and transitive dependencies before updating pinned versions.
  3. Run dependency installation and the Skill with least privilege, preferably in an isolated virtual environment or container.
  4. Add automated dependency vulnerability and integrity checks to the release process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/date_manager.py (reported line 20)May include surrounding context.

python
if sys.platform == 'win32':
    # Windows 控制台编码处理
    try:
        os.system('chcp 65001 >nul 2>&1')
    except:
        pass

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes Python scripts, reads and writes a local JSON file, and instructs package installation, but it declares no explicit tool scope such as allowed tools or permissions. This creates an overbroad execution surface where the agent may use shell and filesystem access without least-privilege constraints, increasing the chance of unintended command execution or data access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to match ordinary conversation about birthdays, holidays, memorials, or generic requests like '记一下XXX', which can cause the skill to activate unexpectedly. Because the skill performs local data storage and command execution, accidental invocation could lead to collection or modification of personal data without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

L003 及全文内容将技能描述和输出行为固定在中文语境下，面向一般用户时未说明可切换语言或需用户选择语言。根据语言/locale 政策，强制单一语言而无用户选择可能构成自然语言策略违规。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill stores sensitive personal information such as birthdays, relationships, memorial dates, and notes in a local JSON file, but it does not warn users about this retention. In this context, the data is highly personal and potentially revealing, so silent local persistence raises privacy and consent concerns even if the file stays on-device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The delete command documentation omits any warning that deletion may be permanent and affect reminders or historical records. Given that this skill manages sentimental and memorial data, accidental deletion can cause irreversible loss of important personal information and emotional harm.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill manifest explicitly says all date calculations must use the calc command rather than being computed elsewhere. However, functions and commands across the file directly compute ages, countdowns, anniversaries, next weekdays, month boundaries, and date differences using datetime/timedelta logic instead of routing those calculations through cmd_calc.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill persists sensitive personal data such as birthdays, memorial dates, relationships, and notes to a local JSON file without any user-facing disclosure or explicit consent flow. In the context of a private date manager, this increases privacy risk because users may provide highly personal information assuming it is ephemeral.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The delete command removes an item from the in-memory dataset and immediately persists the change to disk, making it an irreversible data-modifying operation from the user's perspective. There is no confirmation prompt, dry-run mode, or explicit warning that the deletion will permanently alter the saved records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The top-level docstring presents the script as an 'all-purpose' date manager, which broadens the apparent intent beyond the manifest's framed role as a private date steward for reminders, conversions, holidays, and related date queries. While the implemented features are still date-related, the documentation overstates scope compared with the narrower manifest positioning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file-level description and user-facing strings are written exclusively in Chinese, and the CLI help/output is designed around that locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale restriction is explicitly documented.

Content

No source excerpt is available for this finding.