ClawHub
Back to skill

Security audit

天机我要查 (免费版)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for public company due-diligence, but its optional accelerator can run an unverified local dependency with the user's privileges.

Install only if you are comfortable with Chinese-market public company lookups and related network searches. Prefer the built-in web-search workflow unless you have independently installed and trust the baidu-search skill at the configured path; do not enable the optional accelerator from an unreviewed or writable source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/business_query.py:59
Finding

Unverified External Skill Is Executed with User Privileges

Content
View full analysis

Vulnerability Details

File Location: scripts/business_query.py:28-31, 59-75; related unpinned dependency declaration at manifest.yaml:25
Vulnerability Type: Unverified third-party dependency execution
Risk Level: Medium

Vulnerable Code

python
# scripts/business_query.py:28-31
BAIDU_SEARCH_SCRIPT = os.path.expanduser(
    "~/.workbuddy/skills/baidu-search/scripts/search.py"
)
python
# scripts/business_query.py:59-75
def search(self, query: str, count: int = 8):
    """调用 baidu-search 执行一次检索；不可用时返回 None。"""
    if not self.available:
        return None
    try:
        proc = subprocess.run(
            [
                sys.executable,
                BAIDU_SEARCH_SCRIPT,
                json.dumps({"query": query, "count": count}, ensure_ascii=False),
            ],
            capture_output=True,
            text=True,
            timeout=30,
        )
        if proc.returncode == 0 and proc.stdout.strip():
            return json.loads(proc.stdout)
yaml
# manifest.yaml:25
dependencies:
  - baidu-search   # Optional search accelerator

Technical Analysis

The Skill declares baidu-search without a pinned version, authoritative source, checksum, signature, or other integrity constraint. At runtime, it resolves the dependency through a fixed path under the user's home directory.

The only availability check is whether that path exists. The code does not verify that the target is a regular trusted file, reject symbolic links, validate ownership or permissions, compare a cryptographic digest, or establish the installed component's provenance. It then executes the target with the current Python interpreter and the invoking user's privileges.

Using an argument array rather than a shell command prevents the supplied company name from directly causing shell-command injection. However, this does not protect against replacement or compromise of the dependency itself.

Attack Path

  1. An attacker installs, comp ...[truncated 1333 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin baidu-search to an exact reviewed version and document its authoritative registry or repository.
  2. Resolve it through a trusted package or Skill manager rather than automatically trusting a fixed user-writable path.
  3. Verify a digital signature or cryptographic digest before execution. Fail closed if verification is unavailable or fails.
  4. Require explicit user configuration of the integration path and display the resolved target before first execution.
  5. Canonicalize the path with realpath, reject unexpected symbolic links, and verify that the target is a regular file with trusted ownership and non-world-writable permissions.
  6. Execute the dependency in a restricted environment with only the filesystem and network permissions required for search.
  7. Prefer an authenticated, versioned API boundary over executing another Skill's source file directly.
  8. Treat malformed or untrusted subprocess output as data only and preserve the existing no-shell argument invocation.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README advertises very broad natural-language triggers such as '查一下 XX 公司' and 'XX 有没有被处罚', which can match ordinary user conversation and cause the skill to activate unintentionally. In a skill that performs web-based due-diligence lookups, accidental invocation can lead to unintended data retrieval, unnecessary network activity, and leakage of user intent or queried entities into external search flows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs the agent to run a shell command (python scripts/business_query.py ...) when certain conditions are met, but the manifest does not declare any tool scope or allowed-tools restrictions. This creates an undeclared execution path where an agent/runtime may permit shell access more broadly than intended, increasing the risk of command execution or future prompt-injection abuse if parameters or adjacent instructions become attacker-controlled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The display name, description, and trigger phrases are entirely in Chinese, with no indication that other languages are supported or that the Chinese locale is an intentional opt-in. Under the policy for natural-language violations, a skill that effectively constrains interaction to a specific language without user choice should be flagged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill sample is presented as a fixed Chinese-language report format, including the title and all section labels, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/business_query.py (reported line 68)May include surrounding context.

python
if not self.available:
            return None
        try:
            proc = subprocess.run(
                [
                    sys.executable,
                    BAIDU_SEARCH_SCRIPT,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

All user-facing instructions and usage examples in the README are presented exclusively in Chinese, and the file does not indicate that the skill is intentionally limited to a Chinese-speaking or China-specific audience. Per the policy, forcing a specific language without user opt-in or explicit justification can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file content and title are entirely in Chinese and do not provide users with an option to use another language or indicate that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This file presents all guidance and labels only in Chinese, with no indication that the skill is region-specific or that users can choose another language, which can be interpreted as forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.