ClawHub
Back to skill

Security audit

hybrid-smart-fill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local document-filling helper with disclosed file reading and output generation, but users should review outputs and dependency installation carefully.

Install only in an isolated environment, pin and verify python-docx/openpyxl before installing, edit the hard-coded paths and company replacement before running, test on one copied template first, and manually review every generated Word or Excel file before submitting or sharing it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README_CN.md:175
Finding

Unpinned Third-Party Dependencies in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: README_CN.md:175
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code:

bash
pip install python-docx openpyxl

Technical Analysis

The installation command retrieves the currently available versions of python-docx, openpyxl, and their transitive dependencies without version constraints or package-integrity verification. The project provides no lockfile, verified hashes, or trusted package-index restriction.

Although the package names correspond to the libraries imported by the scripts and no typosquatting was identified, dependency resolution remains mutable and non-reproducible. If a package release or transitive dependency is compromised, malicious installation logic or imported code could execute under the account running the command.

Attack Path

  1. An attacker compromises a future release of one of the named packages or a transitive dependency.
  2. A user encounters the documented missing-module error and follows the installation instruction.
  3. pip resolves the compromised release because no reviewed version is pinned.
  4. Malicious code executes during package installation or when smart_filler.py imports docx or openpyxl.
  5. The code operates with the permissions of the user who installed or ran the Skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on those privileges, an attacker could access or modify local files, including knowledge-base data and Word or Excel templates; read user-accessible secrets; alter generated documents; or establish additional compromise outside this project.

The issue does not independently grant administrative privileges. Its scope is limited to the permissions and environment of the user performing the installation or running the affected dependencies.

Remediation
View remediation

Remediation Suggestions

  1. Create a dependency file containing exact, reviewed versions of python-docx, openpyxl, and all transitive dependencies.
  2. Record verified SHA-256 hashes for every permitted distribution.
  3. Install dependencies with hash enforcement:
    bash
    python -m pip install --require-hashes -r requirements.txt
  4. Explicitly use the official PyPI simple index or an internally controlled package mirror:
    bash
    python -m pip install --index-url https://pypi.org/simple --require-hashes -r requirements.txt
  5. Periodically review and update pinned versions through a controlled dependency-update process.
  6. Run dependency installation and document processing in a least-privileged virtual environment or isolated container.
  7. Replace the vulnerable command in the documentation with the hardened installation procedure.

T08 · Insecure Dependencies

Warning
Location
references/quick_start.md:107
Finding

Unpinned Third-Party Dependencies in Quick-Start Instructions

Content
View full analysis

Vulnerability Details

File Location: references/quick_start.md:107
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code:

bash
pip install python-docx openpyxl

Technical Analysis

The quick-start guide directs users to install third-party packages without fixed versions, integrity hashes, a lockfile, or a restricted package source. Consequently, the installed artifacts can change after the Skill has been audited.

The package names are consistent with the project's imports, and the audit found no evidence of dependency confusion or typosquatting in the names themselves. Nevertheless, an upstream or transitive dependency compromise could introduce code that executes during installation or subsequent import.

Attack Path

  1. A malicious or compromised release becomes available for a named package or one of its dependencies.
  2. A user follows the quick-start troubleshooting command.
  3. pip selects the compromised package because the guide does not constrain versions or hashes.
  4. Attacker-controlled code runs during installation or when the package is imported.
  5. The attacker gains the same local access available to the invoking user.

Impact Assessment

Exploitation could result in arbitrary code execution within the user's security context. User-accessible knowledge bases, templates, output documents, credentials, and other local data could be read or modified. The dependency could also silently manipulate filled documents.

No direct privilege-escalation mechanism was identified; the maximum immediate privilege is that of the user or service account executing the installation or scripts.

Remediation
View remediation

Remediation Suggestions

  1. Replace the direct pip install instruction with installation from a version-pinned requirements file.
  2. Include SHA-256 hashes and require verification through --require-hashes.
  3. Pin and review transitive dependencies rather than only top-level packages.
  4. Restrict package retrieval to the official PyPI index or a trusted internal mirror.
  5. Use an isolated virtual environment and a non-administrative account.
  6. Add automated dependency scanning and controlled update review to the release process.
  7. Keep the quick-start instructions synchronized with the hardened installation instructions in the main documentation.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims a narrowly scoped hybrid retrieval capability, but the described behavior includes bulk modification and output of Word/Excel documents, with references to local file processing not clearly disclosed in the top-level purpose. This mismatch undermines user consent and review, because a user invoking a retrieval skill may unknowingly trigger filesystem writes and document alteration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README encourages automated document filling and output generation but does not warn users to review generated Word/Excel files before use. In this skill’s context, incorrect field mapping or unintended replacement of sensitive business data could propagate silently into official submissions, contracts, or reports, creating integrity and confidentiality risks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
78% confidence
Finding

The skill documentation describes reading knowledge-base files and processing local templates, but it does not declare any explicit tool scope or permissions. In agent environments, missing scope declarations can cause over-broad or implicit file access, making it easier for the skill to read local data beyond what a user reasonably expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill does not prominently warn that it will automatically modify and save Word/Excel files in bulk. In a file-manipulating skill, lack of up-front disclosure increases the risk of unintended data changes, overwritten work products, or sensitive document generation without informed user approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The listed trigger phrases include short generic phrases such as "填充模板", "批量填充", and "匹配字段" without clear scope constraints or negative examples. In a markdown skill description, this can make invocation boundaries unclear and increase the chance of unintended activation for ordinary template- or matching-related requests.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
81% confidence
Finding

The skill promises a fill log showing all field matches and replacements, but it does not describe any bounds, redaction, or minimization. If the knowledge base contains sensitive business or personal data, verbose logs can leak matched values, create secondary copies of confidential data, and grow without limit during batch operations.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
The system generates:
- **Filled templates** in the output directory (marked with "已填写" suffix)
- **Fill log** showing all field matches and replacements
- **Statistics**: Total fields filled, success rate, XX基金 replacement count

## Bundled Scripts

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The document standardizes extracted fields, examples, and regex patterns around Chinese-language labels such as 法定代表人, 联系电话, and 地址. Because the specification does not state that it is limited to a Chinese-region use case or provide an opt-in language/locale choice, it effectively imposes a specific language/locale convention.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring states this is a 'complete' intelligent filling system with semantic retrieval. The actual lookup implementation later in the file uses only exact, containment, and simple keyword matching, which contradicts the stated semantic-retrieval behavior rather than merely omitting details.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a hybrid retrieval skill using BM25 semantic search and TF-IDF vector similarity for high-precision matching. In practice, the retrieval logic in find_value only does direct dictionary lookup, substring checks, and whitespace-split keyword containment, with no BM25, TF-IDF, vectorization, or semantic ranking implementation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The knowledge-base JSON is ingested wholesale into structured_data and transformed into retrievable documents without any access controls, redaction, or field sensitivity checks. Because this skill's purpose is high-precision retrieval for auto-filling documents, indexing raw document and structured content can make confidential business data easily searchable and retrievable in contexts where only specific fields should be exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code stores each Excel row's full contents in metadata under the 'data' field and later returns that metadata directly from search results. In a skill designed for template auto-filling from knowledge bases, this can expose unrelated or sensitive spreadsheet fields to any caller performing retrieval, creating a data leakage risk beyond the minimum needed for matching.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The file presents all operational instructions in Chinese and does not indicate that language selection is optional or that this is a region-specific variant. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document states "This skill uses simple Chinese tokenization" and the example/docstring explicitly frame tokenization around Chinese text. This reads as a language-specific constraint without offering a user choice or documenting opt-in, which matches the policy concern for forced language/locale behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The examples and required template structure are presented only with Chinese filenames, sheet content, and table headers, which implies the skill is intended to operate in a fixed language/locale. The document does not state that other languages are supported or give users an opt-in choice, which can conflict with language/locale flexibility policies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file’s natural-language interface is entirely Chinese, beginning with the module description and continuing through user-facing prints and docstrings. Under the policy provided, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill is described as a general-purpose intelligent template auto-filler driven by retrieval from a knowledge base. However, the code unconditionally replaces any occurrence of XX with the specific string 国寿安保基金, which is a domain-specific hard-coded transformation rather than retrieval-based filling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Natural-language strings throughout the file, including the module description and user-facing print output, are fixed in Chinese. Under the stated policy, forcing a specific language without user opt-in or documented justification is a locale-policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.