ClawHub
Back to skill

Security audit

策略分析报告师

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local report generator for quantitative strategy Excel data, with some ordinary security hygiene issues users should understand.

Install and run this in a virtual environment, treat uploaded Excel files and generated reports as sensitive financial data, and avoid untrusted analysis.json or strategy names until filenames are sanitized. Prefer pinned dependencies or a lock file before production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:154
Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Compromise

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:154
Vulnerability Type: Unpinned runtime dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install pandas numpy matplotlib seaborn reportlab python-docx openpyxl scipy

Technical Analysis

The documented installation command retrieves eight third-party packages without exact version constraints, package hashes, a lock file, or an explicitly trusted package index. Consequently, the installed artifacts can change between installations even when the project itself has not changed.

Python packages may execute code during installation or when imported. If a dependency release or package-distribution account is compromised, following this instruction could install attacker-controlled code. The risk also includes unexpected security regressions and incompatible releases, although the primary security concern is supply-chain integrity.

This finding does not establish that any currently named package is malicious. It identifies the absence of controls that ensure users receive the dependency versions reviewed and tested by the project.

Attack Path

  1. An attacker compromises the release process, distribution account, or upstream source of one of the listed dependencies.
  2. The attacker publishes a malicious or backdoored version under the legitimate package name.
  3. A user follows the installation command in SKILL.md.
  4. pip resolves the dependency to the attacker-controlled release because no approved version or hash is specified.
  5. Malicious code executes during installation or when the reporting application imports the affected package.

Impact Assessment

Successfully exploited package code executes with the privileges of the user running pip or the report generator. Depending on those privileges, it could read or modify accessible files, steal environment credentials, alter generated reports, make network connections, or exec ...[truncated 124 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed dependency lock file containing exact versions and cryptographic hashes.
  2. Install dependencies with hash verification, for example:
    bash
    pip install --require-hashes -r requirements.txt
  3. Generate and review the lock file using a controlled process such as pip-compile --generate-hashes.
  4. Configure an explicitly approved package index or internal artifact repository rather than relying on ambient pip configuration.
  5. Add automated dependency vulnerability and provenance scanning to the release process.
  6. Periodically update pinned dependencies through reviewed pull requests rather than allowing automatic resolution during installation.
  7. Install and run the project in an isolated, least-privileged virtual environment or container.

T09 · Insecure Skill Coding Practices

Note
Location
build_report.py:50
Finding

Unsanitized Strategy Name Allows Report Output Path Traversal

Content
View full analysis

Vulnerability Details

File Location: build_report.py:50-64; secondary path: main.py:99-113
Vulnerability Type: Path traversal and arbitrary file placement
Risk Level: Low

Vulnerable Code

Primary report-builder path:

python
output_dir = args.output or analysis.get("output_dir", "output")
name = analysis["strategy_name"]
outputs = []

if args.format in ("pdf", "all"):
    from quant_report.pdf_report_v2 import generate_pdf
    pdf_path = f"{output_dir}/{name}_策略评估报告.pdf"
    generate_pdf(analysis, content, pdf_path)
    outputs.append(pdf_path)
    print(f"PDF: {pdf_path}")

if args.format in ("docx", "all"):
    from quant_report.docx_report_v2 import generate_docx
    docx_path = f"{output_dir}/{name}_策略分析报告.docx"
    generate_docx(analysis, content, docx_path)

The same unsafe construction occurs in the direct application entry point:

python
if args.format in ("pdf", "all"):
    t0 = time.time()
    from .pdf_report_v2 import generate_pdf
    pdf_path = f"{args.output}/{name}_策略评估报告.pdf"
    generate_pdf(analysis, content, pdf_path)
    outputs.append(pdf_path)
    print(f"  PDF 报告: {pdf_path} ({time.time()-t0:.1f}s)")

if args.format in ("docx", "all"):
    t0 = time.time()
    from .docx_report_v2 import generate_docx
    docx_path = f"{args.output}/{name}_策略分析报告.docx"
    generate_docx(analysis, content, docx_path)

Technical Analysis

strategy_name is interpolated directly into a filesystem path without being reduced to a safe filename component. In build_report.py, the value is loaded from the supplied analysis JSON. In main.py, it may be supplied through the --name command-line argument.

A value containing path separators and parent-directory components, such as ../../target/report, causes the normalized destination to escape the intended output directory. Both report generators create missing parent directories before saving ...[truncated 1933 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat the strategy name only as a display value and generate a separate safe filename identifier.
  2. Reject names containing /, \, null bytes, .., drive prefixes, or other platform-specific path syntax.
  3. Apply a strict allowlist, such as letters, digits, spaces, underscores, and hyphens, with a bounded length.
  4. Resolve and verify every final destination before writing:
    python
    from pathlib import Path
import re

base = Path(output_dir).resolve()
safe_name = re.sub(r"[^A-Za-z0-9 _-]", "_", str(name)).strip()
if not safe_name:
    safe_name = "strategy"

destination = (base / f"{safe_name}_strategy_report.pdf").resolve()
if destination.parent != base:
    raise ValueError("Invalid report destination")
  5. For designs that intentionally support subdirectories, verify containment using Path.is_relative_to(base) after canonical resolution.
  6. Apply the same centralized validation in both build_report.py and main.py.
  7. Avoid overwriting existing files by default, or require an explicit overwrite option.
  8. Run automated report generation with least-privileged filesystem permissions and a dedicated output directory.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

代码与声明在“量化指标计算”和“图表生成”方面基本一致：它加载净值数据、调用 analyze() 计算多项指标，并调用 generate_all_charts() 生成图表，再将结果写入 JSON。然而，声明强调的核心交付物是“最终输出机构级 PDF（16+页）和 Word 策略评估报告”，以及“AI 撰写深度分析文字”。在本代码片段中，没有看到任何 PDF/Word 文档生成、模板渲染、报告排版、AI 调用或文本分析生成相关实现。代码注释也明确表明该脚本是“供 AI skill 使用”的分析引擎入口，说明它更像下游报告生成流程的前置分析组件，而不是完整的报告生成器本身。因此，声明描述了比当前代码更完整、更高层的能力，存在实质性描述不符。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs reading user-provided Excel files from disk and writing multiple output artifacts, yet it declares no explicit tool scope or permissions boundary. In an agent environment, this increases the chance of over-broad file access or ambiguous authorization, making unintended reads/writes harder to constrain or audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file consistently specifies Chinese-language report generation and examples, including Chinese report names and writing norms, but does not state that this is optional or limited to a region-specific use case. A skill that forces a specific language without user opt-in matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This codebase uses Chinese natural-language strings for the module description and later generates all end-user narrative output in Chinese, but provides no opt-in, fallback, or indication that the skill is intended only for Chinese-speaking users. That creates a language/locale policy concern because the skill effectively mandates one language for user-facing results.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The generate_text_summary function returns executive summaries, drawdown analysis, and recommendations entirely in Chinese string literals. Because the file does not provide any language-selection mechanism or documented justification for a Chinese-only output, it violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This Python file contains natural-language instructions and interface text entirely in Chinese, including the top-level description of the report builder and the expected content fields. There is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-language or region-specific context, which makes this a locale-policy concern under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains natural-language strings and comments entirely in Chinese, including the module docstring that defines the chart-generation engine. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified or optional, and no such justification or opt-in appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description explicitly identifies the skill as a Chinese Word report generator, and the implementation later enforces Chinese headings, date formatting, and Chinese fonts. This creates a language/locale constraint without any user opt-in or configurable locale selection, which matches the policy-violation category for forced language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code formats dates as Chinese text and sets the document font to 宋体, while the rest of the report uses fixed Chinese section titles and labels. Because there is no visible option for users to choose another language or locale, this is a natural-language policy concern rather than a functional issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains natural-language strings for the module docstring, usage examples, and argument descriptions that force a specific language experience. Under the policy, language constraints should either be optional for the user or clearly documented as a justified locale-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring explicitly defines the skill as a Chinese PDF report generator, and the rest of the file hardcodes Chinese report titles, labels, and disclaimers throughout. Because there is no opt-in, language selection, or documented region-specific justification, this appears to violate the policy against forcing a specific language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and command-line help/output strings are written in Chinese, which imposes a specific language on users. Under the policy, language constraints should either offer user choice or be clearly documented as a justified locale-specific tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

For markdown files, missing-warning findings apply when the description omits warnings about behaviors that could affect user data, privacy, or system integrity. Here the document explains where user Excel files are stored and that output reports are generated, but gives no user-facing caution that potentially sensitive strategy data will be persisted locally in data/ and output/.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The only natural-language description in the file is a Chinese title, "量化策略评估报告生成器", which indicates the skill is presented in a specific language without any visible opt-in, alternative locale, or justification. Under the language/locale policy, this can be a policy violation when the skill appears to force a specific language choice by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code file contains user-facing natural language exclusively in Chinese, starting with the module docstring on L001 and continuing through comments and labels. Under the stated policy, forcing a specific language without opt-in or documented regional justification can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This file hard-codes Chinese-language field names, comments, and user-facing defaults such as "策略", "日期", "净值", and related docstrings throughout the skill. Under the policy rule for natural-language violations, forcing a specific language/locale without user opt-in can be a violation when no language choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code creates the output directory and writes analysis.json, and earlier also generates chart files under the output path. Although file output is part of the script's purpose, there is no confirmation prompt, warning message, or comment/docstring disclosing that existing files in the output location may be created or overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.