ClawHub
Back to skill

Security audit

DuIvyTools Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese-language reference skill for using the DuIvyTools scientific CLI, with ordinary package-install and file-processing guidance but no hidden or destructive behavior in the artifacts.

Install DuIvyTools only from a source you trust, preferably in a virtual environment, and consider pinning a reviewed version. Expect the skill to help run `dit` on molecular simulation files and create analysis outputs in the working directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–24
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash
pip install DuIvyTools

Or using a third-party mirror:

bash
pip install DuIvyTools -i https://pypi.tuna.tsinghua.edu.cn/simple

Technical Analysis

The Skill directs the Agent to install DuIvyTools from an external Python package index without pinning an exact version or verifying an artifact hash. The implementation of that package is not included in the audited project, so its installation behavior and the behavior of subsequent dit commands cannot be verified from the available files.

Package index artifacts are mutable over time. If the package publisher account, distribution process, or index response is compromised, the same installation command could retrieve attacker-controlled code after this Skill has already passed review. Python package installation can execute build-related code, while later invocation of the installed dit entry point directly executes package code.

The alternative command uses the Tsinghua PyPI mirror. No evidence indicates that this mirror is malicious, but using an additional package-distribution intermediary expands the external supply-chain trust boundary. Neither command constrains the resolved artifact by version and cryptographic digest.

Attack Path

  1. An attacker compromises the DuIvyTools publisher account, release pipeline, or package-distribution path.
  2. The attacker publishes or substitutes a malicious package release.
  3. The Agent follows the installation instructions in SKILL.md.
  4. pip resolves and installs the current externally supplied artifact because no exact version or hash is required.
  5. Malicious code executes during an applicable build or installation stage, or when the Agent subsequently invokes a documented dit command.
  6. The code operates with ...[truncated 719 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin a specifically reviewed package version, for example with DuIvyTools==<reviewed-version>.
  2. Publish a requirements lock file containing cryptographic hashes and install it with pip --require-hashes.
  3. Verify the package against its official source repository and document the expected publisher, version, and artifact digest.
  4. Install the package in a dedicated virtual environment or other restricted execution environment rather than into a global interpreter.
  5. Avoid privileged installation and execution; grant access only to the input and output directories needed for the analysis.
  6. Prefer a trusted primary package index with explicit index configuration. If a mirror is necessary, document its trust assumptions and verification controls.
  7. Audit the source corresponding to the pinned release, including build configuration and console entry points, before allowing automated installation or execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description is written as a Chinese-only invocation and usage description, with no indication that other languages are supported or that the user can choose a preferred language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

该文件从标题开始整体以中文编写，未见任何提示说明这是面向特定中文用户群的区域性文档，也未提供用户可选择的语言/locale 选项。按规则，未获用户选择即强制特定语言属于自然语言层面的组织政策风险。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes this skill as a usage guide for DuIvyTools focused on XVG/XPM visualization, NDX operations, statistical analysis, Ramachandran plots, and format conversion. This reference file also documents mdp_gen and find_center, which are unrelated capabilities for generating GROMACS parameter templates and computing geometric centers from GRO/NDX inputs, expanding the advertised purpose of the skill.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents all usage instructions, warnings, and examples exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified or alternatives are offered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.