ClawHub
Back to skill

Security audit

八字排盘技能

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent BaZi fortune-telling skill that runs a local Python calculator, but users should treat its health and life predictions as speculative and avoid unverified source installs.

Install from the reviewed package or a pinned commit instead of blindly cloning the latest repository branch. Do not provide someone else's birth details without consent, and do not rely on the generated health, finance, marriage, or career statements for consequential decisions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:278
Finding

Unpinned Remote Repository Installation Permits Supply-Chain Substitution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 278-282
Vulnerability Type: Unpinned and unverified remote dependency
Risk Level: Medium

Vulnerable Code

bash
git clone https://github.com/dglijin-oss/bazi-pan-skill.git
cd bazi-pan-skill
python3 scripts/bazi_pan.py --help

Technical Analysis

The installation instructions clone the current default branch of a remote GitHub repository and immediately direct the user to execute a Python script from the downloaded content. No immutable commit hash, signed release, checksum, or other integrity verification is specified.

Because a repository branch is mutable, the downloaded implementation may differ from the version that was reviewed in this audit. If the repository or maintainer account is compromised, or if malicious content is subsequently committed, users following these instructions could execute substituted code without detecting the change.

This is a supply-chain weakness rather than evidence that the currently packaged scripts/bazi_pan.py file is malicious. The audited local implementation does not itself retrieve or execute remote payloads.

Attack Path

  1. An attacker compromises the referenced repository, a maintainer account, or another mechanism capable of modifying its default branch.
  2. The attacker replaces or modifies scripts/bazi_pan.py, or adds malicious imported modules.
  3. A user follows the documented installation instructions and clones the mutable default branch.
  4. The user runs python3 scripts/bazi_pan.py --help.
  5. Python executes attacker-controlled top-level code and imports with the privileges of the invoking user.

Impact Assessment

Successful exploitation permits arbitrary code execution under the account that follows the installation instructions. The resulting access is limited by that account's operating-system permissions, but may include reading or modifying user-accessible files, accessing environment variables and credentia ...[truncated 228 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin installation to an immutable, reviewed commit rather than the repository's mutable default branch:
bash
git clone https://github.com/dglijin-oss/bazi-pan-skill.git
cd bazi-pan-skill
git checkout --detach <reviewed-commit-hash>
python3 scripts/bazi_pan.py --help
  1. Publish the expected commit hash in the documentation and update it only after reviewing the corresponding source.
  2. Prefer a signed, versioned release and document signature verification before execution.
  3. Publish SHA-256 checksums for release artifacts and require users to verify them.
  4. If cloning remains necessary, verify that the checked-out commit exactly matches the audited commit before invoking Python.
  5. Protect the upstream repository with multi-factor authentication, branch protection, restricted release permissions, and signed commits or tags.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly asks for and processes birth date, hour, and gender, which are sensitive personal attributes, then uses them to generate personality, health, marriage, and fortune predictions without any privacy notice, consent guidance, or disclaimer that the output is non-scientific entertainment. This creates privacy and user-trust risks: users may disclose sensitive data unnecessarily and may rely on speculative or potentially harmful inferences presented as authoritative analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script generates health-related and consequential life-guidance statements such as organ weakness and recommendations to '养肝/养心/补肾' without any disclaimer that the output is speculative and not medical advice. In a user-facing agent skill, this can mislead users into acting on pseudomedical guidance, delaying proper medical evaluation or influencing important personal decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

All user-facing strings, CLI help text, and generated output are fixed in Chinese, with no option to select another language. The policy allows locale constraints only when users are given a choice or the constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.