ClawHub
Back to skill

Security audit

doc-search

Security checks for vulnerabilities and agentic risk

Overview

This document-search skill is mostly purpose-aligned, but its local persistence design can retain sensitive documents and includes unsafe loading behavior that could run attacker-controlled code if storage files are tampered with.

Review before installing. Use this only with a trusted local persistence directory, avoid opening vector stores from other people, and do not index sensitive documents unless you are comfortable with local retention. Prefer a pinned dependency setup, and ask the publisher to replace pickle storage with a safer format and move model loading behind explicit user choice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
chromadb_document_vectorizer_simple.py:127
Finding

Unsafe Deserialization of Persistent Data with Python Pickle

Content
View full analysis
_data.pkl` with a malicious pickle payload. 3. The attacker also ensures that the corresponding `_index.json` file exists, satisfying the initial existence check. 4. The victim or Agent initializes `DocumentVectorizer`. 5. `_load_from_disk` opens the malicious file and invokes `pickle.load`. 6. The payload executes with the pr ...[truncated 775 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:203
Finding

Unpinned Third-Party Package Installation Instruction

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
chromadb_document_vectorizer_simple.py:39
Finding

Import-Time Retrieval and Loading of an Unpinned External Model

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents capabilities that read user-supplied files and persist processed data to disk, but it declares no explicit tool scope or permissions boundary. That mismatch can cause the agent or user to invoke file read/write behavior without clear authorization expectations, increasing the risk of unintended filesystem access or persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented clear_collection() operation deletes all vector-store data, but no warning, confirmation, or recovery guidance is provided. In an agent setting, this raises the chance of accidental destructive actions leading to data loss, especially when operating on shared or persistent document collections.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill states that vector data and indexes are automatically saved and reloaded from local disk, but the overall description does not warn users that document contents or derivatives will persist beyond the current session. This can expose sensitive document data to unintended retention, later access by other processes or users, and privacy/compliance issues.

Content

No source excerpt is available for this finding.

Insecure deserialization: pickle.load()

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The code deserializes persisted state using pickle.load() from a file path under a configurable directory. If an attacker can place or replace the .pkl file in that directory, unpickling can execute arbitrary Python code during startup, turning simple data loading into code execution. In this skill context, automatic loading on initialization increases danger because exploitation can happen without any explicit user action beyond instantiating the vectorizer.

Content

Scanner excerpt · chromadb_document_vectorizer_simple.py (reported line 131)May include surrounding context.

python
if self.data_file.exists() and self.index_file.exists():
            try:
                with open(self.data_file, 'rb') as f:
                    data = pickle.load(f)
                    self.documents = data.get('documents', [])
                    self.embeddings = data.get('embeddings', [])
                    self.metadatas = data.get('metadatas', [])

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The skill documentation is written entirely in Chinese, while the manifest description includes English and the functionality claims multilingual support. There is no explicit statement that users may interact in their preferred language, which can create a locale policy concern if the skill behavior is assumed to be Chinese-only by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains natural-language descriptions and user-facing messages entirely in Chinese, starting in the module docstring and continuing throughout the file. Because the skill does not provide any user opt-in or alternative language handling, it may violate a language/locale policy that requires not forcing a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The package description is written entirely in Chinese, which indicates a language-specific presentation without any stated user choice or opt-in. The policy for natural-language content requires flagging language or locale constraints when the skill does not explicitly offer a language choice or justify the restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.