ClawHub
Back to skill

Security audit

CCPA Compliance

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a local CCPA/CPRA helper rather than malware, but its advertised compliance and reporting capabilities materially exceed what the shipped code supports.

Review before installing. Treat this as a Chinese-language, local-only preliminary checklist, not a complete CCPA/CPRA compliance solution. Do not rely on its reports for legal decisions without counsel, verify which advertised commands actually exist, and avoid generating or hosting HTML reports from untrusted data unless escaping is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/core/report_core.py:64
Finding

Unescaped Report Data Enables Stored HTML and JavaScript Injection

Content
View full analysis

Vulnerability Details

File Location: scripts/core/report_core.py, lines 64–95
Vulnerability Type: Stored HTML injection / cross-site scripting in generated reports
Risk Level: Medium

Vulnerable Code

python
for r in results:
    icon = "✅" if r["severity"] == "通过" else "⚠️" if r["severity"] in ("提示", "警告") else "❌"
    rows += f"""<tr>
        <td>{icon}</td>
        <td>{r['check_id']}</td>
        <td>{r['description']}</td>
        <td>{r['severity']}</td>
        <td>{r.get('recommendation','')}</td>
    </tr>\n"""

return f"""<!DOCTYPE html>
<html lang="zh-CN">
<head><meta charset="utf-8">
<title>{data.get('tool','合规检查报告')}</title>
<style>
body {{ font-family: -apple-system, sans-serif; max-width: 960px; margin: 2rem auto; padding: 0 1rem; }}
h1 {{ color: #1a1a2e; }}
.summary {{ display: flex; gap: 1rem; margin: 1rem 0; }}
.card {{ padding: 1rem 1.5rem; border-radius: 8px; background: #f5f5f5; text-align: center; }}
.card.pass {{ background: #d4edda; }} .card.warn {{ background: #fff3cd; }} .card.fail {{ background: #f8d7da; }}
table {{ width: 100%; border-collapse: collapse; margin-top: 1rem; }}
th, td {{ padding: 0.5rem; text-align: left; border-bottom: 1px solid #ddd; }}
th {{ background: #e9ecef; }}
</style>
</head><body>
<h1>{data.get('tool','')}</h1>
<p><strong>法规：</strong>{data.get('regulation','')} | <strong>时间：</strong>{data.get('check_time','')[:19]}</p>

Technical Analysis

ReportGenerator.to_html() constructs an HTML document through direct string interpolation. Dynamic report fields—including tool, regulation, check_time, check_id, description, severity, and recommendation—are inserted without HTML encoding or sanitization.

If any of these fields contains attacker-controlled markup, the generated report preserves it as active HTML. For example, a description containing:

html
<img src=x onerror="alert(document.domain)">

would be emitted unchanged and execute when the generated report is ...[truncated 1653 chars]

Remediation
View remediation

Remediation Suggestions

  1. Escape every dynamic value before inserting it into HTML:
python
from html import escape

def html_value(value):
    return escape(str(value), quote=True)

Apply this helper to all report-derived fields, including tool, regulation, check_time, check_id, description, severity, and recommendation.

  1. Prefer an HTML template engine configured with automatic escaping rather than constructing markup with f-strings. If Jinja2 is used, create the environment with autoescaping enabled:
python
from jinja2 import Environment, select_autoescape

env = Environment(
    autoescape=select_autoescape(enabled_extensions=("html", "xml"))
)

  1. Do not mark report values as safe HTML unless they have passed a strict allowlist sanitizer.

  2. Add regression tests using payloads such as:

html
<script>alert(1)</script>
<img src=x onerror=alert(1)>
"><svg onload=alert(1)>

Tests should verify that the generated output contains encoded text such as &lt;script&gt;, not executable markup.

  1. If generated reports may be hosted, add a restrictive Content Security Policy as defense in depth. Escaping remains mandatory.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (32)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as a comprehensive CCPA/CPRA solution with multiple output formats and cross-framework support, while the finding indicates only a limited subset is actually implemented. In compliance tooling, such overclaiming is dangerous because organizations may omit manual review or legal escalation, leaving gaps in privacy controls and regulatory response.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as a comprehensive CCPA/CPRA solution with multiple output formats and cross-framework support, while the finding indicates only a limited subset is actually implemented. In compliance tooling, such overclaiming is dangerous because organizations may omit manual review or legal escalation, leaving gaps in privacy controls and regulatory response.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill is presented as a comprehensive CCPA/CPRA solution with multiple output formats and cross-framework support, while the finding indicates only a limited subset is actually implemented. In compliance tooling, such overclaiming is dangerous because organizations may omit manual review or legal escalation, leaving gaps in privacy controls and regulatory response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file is written entirely in Chinese, including headings and operational descriptions, with no indication that users can choose another language or that the locale restriction is intentional. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该文件在 L017-L019 明确声称已删除 pandas、jinja2 依赖要求，并实现“真正的零网络访问和零外部依赖”；L028-L035 进一步称所有脚本仅使用标准库、无额外依赖。但同一文件后续在 L127 与更早/更晚版本说明中又写“仅两个常见库”及“pandas/jinja2 为可选增强”，这些表述彼此冲突，会误导审计者对技能实际依赖边界的理解。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description and usage guidance are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative language option. The documented scope is California CCPA/CPRA compliance, but the README does not justify why Chinese is required for that function or indicate that another language version is available.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises executable scripts and file-generating behavior but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, undeclared shell, file read, and file write capability weakens containment and can lead to execution beyond what users or orchestrators expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The primary description and usage guidance are presented in Chinese, which effectively imposes a language choice on users. The file does not indicate that users may choose another language or that the Chinese-only presentation is an intentional opt-in or justified locale restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Overly broad trigger keywords such as general privacy and compliance terms can cause the skill to activate in unrelated contexts. In an agent setting, unintended invocation may expose local files to the skill's processing flow, trigger shell-based checks unexpectedly, or crowd out a more appropriate tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents the entire skill content in Chinese from the title onward, with no indication that the language is optional or that the skill is intended only for Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring presents the tool description entirely in Chinese while also framing it as a U.S. California privacy compliance tool. This creates a language policy concern because the skill imposes a specific language for user-facing descriptions and output expectations without any opt-in or documented locale limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language strings that force a specific language/locale for the skill experience, including the module description and later CLI help/output text. Under the policy, locale constraints should either be optional for the user or clearly documented as justified; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstrings and runtime user-facing prompts are written exclusively in Chinese, indicating the skill is designed to communicate in a fixed language. The policy allows locale constraints only when users are given a language choice or when the restriction is clearly documented and justified; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This Python file contains natural-language policy text stating that all disputes are governed by the laws of the People's Republic of China and resolved in the developer's local court. Under the policy, forcing a specific locale/jurisdiction without user opt-in or a clearly documented region-specific scope is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file-level description claims a general CCPA opt-out checking capability, but at least one advertised execution path is inconsistent with the internal result structure. In a compliance context, this mismatch is dangerous because users may believe required checks were performed when the tool either crashes or omits expected coverage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language descriptions and user-facing text exclusively in Chinese, beginning with the module docstring. The policy requires flagging language-forcing behavior when no opt-in or justification is provided, and this file does not indicate that it is region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The argparse description, argument help strings, error messages, status output, and summary are all hard-coded in Chinese. Because the file provides no language selection flag or documented locale limitation, it violates the language/locale policy for natural-language content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The CLI exposes 'sharing' and 'marketing' modes, but the result map only contains do_not_sell_link, global_signal_support, agent_authorization, and compliance_monitoring. Selecting an advertised but unimplemented mode causes a lookup of nonexistent keys, which can raise a runtime error and make the compliance tool unavailable or misleading when operators rely on those checks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains user-facing docstrings and template text that consistently force a specific language/locale. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific; here, the content is Chinese while the templates target California privacy compliance, and no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

L390 的注释明确表示“不自动创建目录，遵守‘不执行任何系统修改’声明”，但紧接着 L394-L395 仍然打开并写入 output_path，对文件系统进行了实际修改。这里的文档性说明与真实行为相矛盾，不只是信息不完整，而是对副作用的性质给出相反暗示。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file includes its module docstring and subsequent user-facing text in Chinese only, which imposes a specific language on users without opt-in. The stated policy flags language or locale constraints unless the skill offers a choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The test/output strings shown to users at runtime are all Chinese-only, which constitutes a natural-language policy issue under the language-choice requirement. There is no indication that users can select another language or that the locale restriction is required and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

L115-L123 将 1.0.4 标记为“当前”，并把 CCPA Compliance v1.0.4 描述为现行标准；但 L132-L145 已记录 1.0.5 更新，而文件开头 L003-L009 还记录了 1.1.0。该文档性陈述与文件其余内容直接矛盾，属于注释/文档与实际版本状态不一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest uses Chinese-only natural-language text in the description, which can impose a specific language on users without offering any alternative or opt-in. The policy for this audit flags language/locale constraints when they are forced rather than explicitly optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language comments describe the skill entirely in Chinese ("纯本地合规检查工具" and accompanying text) without indicating that users may choose another language or locale. Under the policy for natural-language constraints, this can be interpreted as imposing a specific language experience without explicit opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.