ClawHub
Back to skill

Security audit

Daoist Companion

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Daoist study notebook, but it needs Review because it can install an unpinned Python package at runtime and persist sensitive practice logs locally.

Review before installing if you do not want a skill that can run Bash, install Python packages, or save religious practice notes under your home directory. Prefer preinstalling and pinning any calendar dependency yourself, and only use the journal feature on a private machine or after changing it to ask before saving.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:259
Finding

Unpinned Third-Party Package Installation at Runtime

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 259–261
Vulnerability Type: Unsafe runtime dependency installation
Risk Level: Medium

Vulnerable Code:

bash
# Check whether zhdate is installed
python -c "import zhdate" 2>/dev/null || pip install zhdate

Technical Analysis

The Skill instructs the Agent to install the latest available version of the third-party zhdate package whenever the import check fails. The package version is not pinned, no cryptographic hash is verified, no lock file is used, and installation is not restricted to an isolated environment.

Python package installation can execute package-controlled build or installation logic with the same privileges and filesystem access as the Agent. Because the package retrieved from the package index can change after this Skill has been reviewed, the effective code executed by the Skill is mutable and is not covered by the static audit.

This is a supply-chain weakness rather than evidence that the current zhdate package is malicious.

Attack Path

  1. A user requests a lunar-calendar or Daoist festival calculation.
  2. The Skill invokes the documented import check.
  3. If zhdate is unavailable, the fallback executes pip install zhdate.
  4. pip retrieves the current package and its dependency artifacts from the configured package index.
  5. A compromised package release, package index, dependency, or build artifact executes installation-controlled code with the Agent's privileges.
  6. That code could access or modify resources available to the Agent before the requested calendar calculation continues.

Impact Assessment

Exploitation could result in arbitrary code execution under the operating-system identity running the Agent. The accessible scope could include the Agent's readable and writable files, its Python environment, network access, and any credentials exposed to that process.

The instruction does not re ...[truncated 301 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic pip install execution from the runtime workflow.
  2. Declare an exact, reviewed zhdate version in a dependency manifest and lock file.
  3. Require cryptographic hash verification, such as:
    bash
    pip install --require-hashes -r requirements.txt
  4. Install dependencies during a trusted setup phase rather than in response to a user request.
  5. Use a dedicated virtual environment with minimal filesystem and network permissions.
  6. Review and pin transitive dependencies as well as the direct dependency.
  7. If the dependency is unavailable, fail safely and explain that calendar conversion is unavailable instead of modifying the environment automatically.
  8. Where practical, replace the dependency with a small, reviewed local helper or use a host-provided calendar API that does not permit package installation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes very broad, common terms such as "practice," "meditation," and "breathing," which can cause the skill to activate in conversations that are not actually about Daoist guidance. This is a genuine prompt-scope weakness because unintended invocation can inject unrelated religious or behavioral guidance into benign chats, increasing the chance of confusing, irrelevant, or context-inappropriate responses.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The usage section repeats the same ambiguous auto-activation keywords without clarifying scope, making accidental invocation more likely in ordinary conversation. While this is not a code-execution issue, it is still a real security and safety concern in agent systems because broad triggers expand the skill's activation surface and can cause unrequested behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

触发词列表包含大量高频、泛化词汇，如“修行、入门、功课、静坐、初学、怎么开始”等，且覆盖多个常见语义场景，容易在非目标对话中被意外激活。误触发后，技能可能在未明确请求宗教/道教帮助的上下文中介入，造成上下文污染、错误建议注入或不必要暴露其内置能力。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

README 的自动激活说明写明“提到以下关键词即可自动激活本 Skill”，但未描述任何触发范围、排除条件、置信度阈值或用户确认机制。这种宽松表述会鼓励实现采用简单关键词匹配，增加误触发概率，并使技能在不相关场景中响应。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill directs writing spiritual practice logs to ~/daoist-journal/YYYY-MM-DD.md without an explicit privacy notice or confirmation. These logs may contain sensitive personal reflections, habits, or belief-related information, and silent local persistence can expose users to unintended disclosure on shared or managed systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs use of Bash to run Python and conditionally execute pip install zhdate, which modifies the local environment at runtime. For a Daoist study companion, installing packages is not essential enough to justify environment changes, and it creates supply-chain and integrity risks if the package source is compromised or if installation occurs without explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented pip install zhdate flow lacks a user-facing warning that it will alter the host environment. Unannounced installation can introduce dependency, security, and operational risks, especially on managed or production-like systems where package changes are controlled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The style rules direct the skill to avoid English mixing and prescribe fixed Chinese forms of address and phrasing. This is a language/locale constraint expressed in natural language, but the file does not present it as an opt-in choice or clearly justify it as a region-specific requirement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file includes full ritual/spell texts ('八大神咒全文') even though the skill metadata says it does not provide ritual guidance. In this skill context, that creates a policy/behavior mismatch: downstream prompting or retrieval could surface actionable liturgical content to novices, undermining the stated safety boundary and enabling ritual instruction by indirection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The reference includes concrete ritual and etiquette procedures such as how to bow, how many incense sticks to offer, placement of offerings, and temple-entry rules. While not obviously malicious, this exceeds a purely introductory cultural reference and conflicts with the skill’s stated boundary of not providing 法事指导, creating a policy/scope mismatch that could lead the agent to generate actionable religious practice guidance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This section contains actionable worship instructions for offerings and temple conduct that a beginner-focused informational companion could relay as practical guidance. In context, the danger is not code execution or classic cyber harm, but unsafe expansion of the skill into prescriptive religious instruction that users may treat as authoritative despite the product’s stated limits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire knowledge file is written in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest says the skill does not provide 法事指导, but this reference file includes concrete observance instructions such as 戊日斋戒 rules and 朔望日功课 steps, including recitation and offerings. These are not just high-level descriptions of Daoism; they function as prescriptive ritual practice guidance for users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
72% confidence
Finding

The manifest positions the skill as a beginner companion that does not transmit teachings, yet this document contains a section of 常用咒语与手诀 with specific named chants and practical use context. Even with a caution note, this goes beyond simple explanation into providing material that can directly support practice performance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire skill reference is presented only in Chinese, and the document does not state that the skill is intended specifically for Chinese-speaking users or offer any language/locale opt-in. Under the policy for natural-language issues, a fixed language without user choice can be a locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The FAQ states that bodily sensations like heat or twitching are common 'qi reactions' during meditation, which can normalize potentially concerning symptoms before directing users to professional help. Although it does mention consulting a Daoist doctor or TCM practitioner if symptoms are strong or uncomfortable, it does not clearly advise seeking licensed medical care for significant, persistent, or alarming symptoms, creating a risk of delayed treatment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.