ClawHub
Back to skill

Security audit

double6-workbench-builder

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its optional local-deployment guidance tells hosts to add LAN-accessible persistence and scheduled tasks without a clear consent and cleanup boundary.

Install only if you want a Chinese-language local workbench builder that runs Python scripts and may use Chromium/Playwright for local evaluation. Avoid or manually review the local-deployment path: do not allow LAN exposure, server-side disk persistence, or scheduled tasks unless you explicitly requested them, see the exact command and schedule, and have a documented way to disable and remove them.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
references/host-integration-playbook.md:63
Finding

Host-Level Persistence Through Scheduled Tasks

Content
View full analysis

Vulnerability Details

File Location: references/host-integration-playbook.md:63
Related Instruction: SKILL.md:53 directs the agent to read this playbook for local deployment.
Vulnerability Type: System persistence through host automation and Windows scheduled tasks
Risk Level: High

Complete Source Snippet:

markdown
- **定时任务双保险**：服务器内置定时器 + 宿主自动化（如 Windows 计划任务）各挂一份，任一失效另一份仍能兜底。

English translation:

Use two safeguards for scheduled tasks: configure both a server-integrated timer and host automation such as a Windows scheduled task, so either can continue operating if the other fails.

Technical Analysis

The local-deployment playbook explicitly directs the agent to configure two persistent scheduling mechanisms, including a Windows scheduled task. A scheduled task can survive the current process, agent session, and system restart.

This exceeds the minimum privileges required for the Skill's principal declared function: generating and validating a single offline HTML workbench. Producing an offline file does not inherently require background execution or cross-session host configuration. The redundant scheduling instruction further increases persistence by arranging two independent execution paths.

The project does not include implementation code that directly creates the scheduled task; exploitation depends on an agent following the documented deployment instruction. Nevertheless, the instruction is actionable, is within a playbook the Skill directs the agent to read, and explicitly requests a recognized persistence mechanism.

Attack Path

  1. A user requests local deployment or a host follows the local-deployment workflow.
  2. Under SKILL.md:53, the agent reads references/host-integration-playbook.md.
  3. The agent follows the scheduled-task instruction at line 63.
  4. The agent creates both an application timer and host-level automation, such as a Windows scheduled task.

...[truncated 778 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to create Windows scheduled tasks or redundant background timers.
  2. Keep local deployment foreground-only and session-bound by default.
  3. If persistent operation is genuinely required, treat it as a separate, explicit operation requiring informed user confirmation immediately before installation.
  4. Display the exact executable, arguments, working directory, trigger, account, and duration before creating any persistent task.
  5. Apply least privilege by registering the task only for the current non-administrative user.
  6. Avoid elevated execution, hidden tasks, startup triggers, and automatic retries unless separately justified.
  7. Provide commands to inspect, disable, and permanently remove every created timer or task.
  8. Record an auditable receipt identifying what was installed and where, and verify cleanup when local deployment is stopped.

T08 · Insecure Dependencies

Warning
Location
scripts/double6_runtime/evaluation.py:374
Finding

Unpinned Playwright Installation Guidance Creates Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: scripts/double6_runtime/evaluation.py:374-378
Vulnerable Instruction: scripts/double6_runtime/evaluation.py:376
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

python
    instructions = []
    if browser_python is None:
        instructions.append("在准备给 DOUBLE6_BROWSER_PYTHON 的 Python 环境执行：python -m pip install playwright")
    if chromium is None:
        instructions.append("安装 Google Chrome 或 Chromium，或设置 DOUBLE6_CHROMIUM_EXECUTABLE 为 chrome.exe 的绝对路径")

English translation of the vulnerable instruction:

In the Python environment prepared for DOUBLE6_BROWSER_PYTHON, run: python -m pip install playwright.

Technical Analysis

When the browser-evaluation environment lacks Playwright, the preflight result recommends installing playwright without a version constraint, lock file, package hash, or explicitly trusted package index.

Consequently, the installed artifact depends on the package version and index response available at installation time rather than the version reviewed with this Skill. Package installation can execute packaging hooks and places third-party code into the interpreter later launched by the evaluation workflow.

The package name is the legitimate Playwright project name; no typosquatting or intentionally malicious dependency was identified. The vulnerability is the absence of reproducible dependency controls, not evidence that the named package is currently malicious.

Attack Path

  1. The evaluation preflight cannot import Playwright.
  2. browser_environment() returns the unpinned installation instruction.
  3. The agent or user executes python -m pip install playwright.
  4. Pip resolves the current package from its configured index without enforcing an audited version or expected hashes.
  5. A compromised index, compromised package release, or unsa ...[truncated 823 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Playwright to a reviewed version in a dependency lock file.
  2. Require cryptographic hashes for downloaded distributions, for example through a hash-locked requirements file.
  3. Specify and validate an approved package index rather than inheriting arbitrary pip index configuration.
  4. Prefer a prebuilt, isolated evaluation environment distributed through a controlled release process.
  5. Require explicit user approval before installing or modifying dependencies.
  6. Report the exact package version, source index, and expected hashes in preflight instructions.
  7. Revalidate the pinned dependency through routine security updates rather than silently resolving the newest release.
  8. Continue preferring an existing system browser instead of automatically downloading additional browser binaries.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (48)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是一个面向最终用户的本地离线个人工作台产品；而实际代码并不实现该工作台本身，而是实现一个内部浏览器收集/验收工具，用于对某个候选页面进行自动化质量检查。虽然测试内容围绕“离线单文件、本地存储、导入导出、学习/任务模块”等特性，与声明中的产品领域有关，但代码的主要目的和能力是测试与审计，而非构建或提供该本地工作台。因此属于实质性目的不一致，并包含多项未声明的自动化检查与结果采集能力。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
72% confidence
Finding

The declared description is narrowly framed around an offline-first, strictly single-file local personal workspace for end-user repetitive tasks. The provided code, however, is not implementing or clearly exposing that product behavior directly; it exposes a broader runtime interface with builder, evaluation, browser environment, and workflow/run lifecycle functions such as start_run, respond, status, propose, and clone_confirmed_run. From this snippet alone, there is no evidence of the key declared constraints like offline-first behavior, strict single-file architecture, or local-only data handling. Instead, the module appears to be a generic runtime/orchestration API. While this could be supporting infrastructure, the surfaced capabilities are materially different enough from the declared end-user purpose to flag as a likely mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明描述的是一个面向终端用户的本地个人工作台产品能力；但代码并不实现工作台、任务面板、记录复盘或保存恢复页面本身，而是在做开发/验收侧的评估基础设施。其核心职责是验证某个 index.html 候选是否满足离线单文件、本地存储、UI 合同、模块数量、响应式、可访问性、导入导出、恢复能力等要求，并在具备环境时启动浏览器自动化进行动态测试和截图取证。虽然代码确实会检查“离线优先、单文件、本地存储、不联网”等特性，和声明领域有关，但它是审核器/测试器，不是声明中的个人工作台实现。因此主目的与实际能力存在实质性不符，应判定为 mismatch。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description is about building an offline personal local workbench UI for general user workflows such as task panels, records, review tools, and save/restoreable pages. The supplied code does not implement a general personal workspace or single-file local data workbench. Instead, it is a backend/runtime content-loader and validator for predefined 'starter' scene capabilities, heavily focused on education and exam-preparation content. It reads bundled JSON reference files, validates schemas and content constraints, enforces counts and knowledge-point coverage for questions, filters visible/internal identifiers, resolves stage-specific content, and produces starter payloads for modules. While this may be part of a larger app, this specific code chunk's primary purpose is materially different from the declared purpose. There is no evidence here of local persistence, save/restore page construction, generic task/record panels, or personal-data-on-device workbench behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

Natural-language strings throughout the manifest, including names, rules, and match phrases, are entirely in Chinese, indicating a fixed language experience. There is no visible user opt-in, locale selection mechanism, or documented region-specific justification, which conflicts with the requirement not to force a specific language without user choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
90% confidence
Finding

Launching subprocesses for browser collection gives the skill an execution capability beyond simple local file generation, and that capability operates on binaries selected from the host environment. Because the skill context promises an offline, single-file, local-first workbench builder, hidden execution of external interpreters/browsers is more dangerous: users may not expect host binary execution as part of the feature set, increasing the chance of abuse through environment hijacking or trojaned local tools.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill invokes Python CLI commands and references build/evaluate flows that imply shell, file read/write, environment inspection, and likely browser/network-capable tooling, yet it declares no explicit tool scope or permissions boundary. This increases the chance that an agent executes broader capabilities than users or hosts expect, weakening least-privilege controls and making misuse or overreach harder to govern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger text uses broad, everyday phrases such as personal workspace, study desk, task board, notes, and review tools, which can cause the skill to activate in many unrelated conversations. Over-broad invocation raises the risk of unintended file generation, unnecessary tool execution, and accidental handling of sensitive personal data in contexts where the user did not intend to invoke a build-oriented skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

User-facing labels, descriptions, and trigger phrases throughout the catalog are presented only in Chinese, with no indication that users can choose another language or locale. Under the stated policy, forcing a language without explicit opt-in is a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list includes very generic everyday terms such as “宝宝” and “幼儿”, which can appear in ordinary conversation unrelated to invoking this skill. The profile does not provide narrowing context or exclusion examples, so activation scope is ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file is entirely framed as Chinese-only instructional policy for the skill, including user-facing phrasing and education-stage conventions, but it does not state that language choice is optional or region-limited. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This JSON manifest embeds user-facing educational content almost entirely in Chinese, including stage labels, prompts, explanations, and instructions, while also mixing in English-learning content presented through Chinese scaffolding. Under the policy rule, forcing a specific language without offering an explicit user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This section introduces server-style operational guidance including LAN access, host IP discovery, atomic disk writes, and scheduled tasks, which materially broadens capability beyond a simple local single-file workbench. In the context of a tool handling personal workbench data, these instructions can lead integrators to create background services or network-exposed endpoints without minimum-hardening requirements, creating avoidable confidentiality and exposure risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The playbook explicitly tells the host to perform local deployment with disk persistence and LAN access whenever the user asks, even though the skill is described as offline-first and strictly single-file. That expands the trust boundary from a local file to a network-reachable service and persistent storage model without corresponding security gates, threat model, or privacy safeguards, increasing the chance of accidental exposure of personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document instructs direct local deployment and persistence expansion without warning that user data may move from isolated browser storage into server-managed files and potentially become reachable over the local network. For a skill marketed around keeping personal data on the current device, omitting privacy and exposure warnings can cause users or hosts to deploy in a less private configuration than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This JSON manifest-like file encodes all activation keywords and source-rule text exclusively in Chinese across multiple domains. Because there is no indication that the skill is region-specific or that users can opt into this locale, it implies a fixed language policy that may exclude users and violate the requirement to avoid forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document title and all operational instructions are written in Chinese, establishing the skill's runtime contract in a single mandated language. There is no indication that users may choose another language or explicitly opt into a Chinese-only experience, which creates a language/locale policy concern under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This JSON file is a manifest/config-style file, so SQP-3 applies. In an otherwise Chinese-language skill set, the embedded vocabulary module presents English terms such as "daily" and "habit" as fixed content with no opt-in or language-selection mechanism, which can violate a language/locale policy requiring user choice rather than forcing a specific language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The scene matcher uses broad natural-language triggers for travel planning, which can activate a specialized template when a user mentions common phrases outside the intended scope. In this skill, unintended activation can mis-route the user into the wrong local workbench, causing incorrect UX flow, accidental data placement in the wrong dashboard, and unreliable task interpretation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The content-production scene is keyed off very common phrases like topic selection, content creation, script creation, and publishing schedule, which are easily mentioned in unrelated requests. Because automatic non-default selection is enabled, this ambiguity can steer users into an unintended template without sufficient boundary checks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Finance-related triggers such as month close, reconciliation, and voucher organization are generic business terms that may appear in many contexts, but here they can automatically invoke a finance workbench. In a finance context, misclassification is more dangerous because it may cause users to enter sensitive financial information into an unintended workflow, increasing the risk of errors, confusion, or improper handling of local records.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Household coordination is matched using broad phrases with no exclusion conditions, making accidental activation likely for normal planning or shopping-related requests. In this workbench-builder, that can degrade integrity of scene selection and create misleading structure for the user's task, especially since the system is designed to auto-select registered scenes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains user-facing natural-language strings entirely in Chinese, including the module docstring, CLI description, and command help text. Because the skill does not offer a language choice or justify a region-specific constraint, it appears to impose a specific language/locale on all users, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This Python file contains user-facing natural-language strings exclusively in Chinese, starting with the module docstring and continuing throughout runtime errors and status checks. For a general CLI skill, this imposes a specific language/locale without any opt-in or documented regional constraint, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code sets utterance.lang automatically to en-US or zh-CN based on character detection, which imposes a specific language/locale behavior on users. The policy allows locale constraints only when user choice or explicit justification is provided, and neither is present here.

Content

No source excerpt is available for this finding.