ClawHub
Back to skill

Security audit

实验设计技能

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent DOE CSV generator, but it can overwrite arbitrary writable files and generate unbounded output without clear safeguards.

Review this before installing if the skill may run on important workspaces. Use only small DOE dimensions, choose a dedicated output directory, avoid absolute or parent-traversal output paths, and check whether the target CSV already exists. Do not rely on it for Taguchi or true orthogonal-array design without independent validation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/doe_generator.py:39
Finding

Unbounded DOE Dimensions Allow Memory and CPU Exhaustion

Content
View full analysis

Vulnerability Details

File Location: scripts/doe_generator.py, lines 39 and 126-140
Vulnerability Type: Uncontrolled resource consumption
Risk Level: Medium

Vulnerable Code

python
combinations = list(itertools.product(levels, repeat=num_factors))
python
if resolution == 3:
    # Resolution III: 2^(k-2)
    p = 2
    num_runs = 2 ** (num_factors - 2)
elif resolution == 4:
    # Resolution IV: 2^(k-1)
    p = 1
    num_runs = 2 ** (num_factors - 1)
else:
    # Resolution V+: requires a larger design
    p = 0
    num_runs = 2 ** num_factors

# Ensure a minimum number of runs
num_runs = max(num_runs, 4)

Technical Analysis

The command-line validation enforces only minimum values and does not impose upper limits on the number of factors, levels, generated runs, or estimated output size.

Full-factorial generation materializes the entire Cartesian product in a Python list. Its memory and processing requirements grow as num_levels ** num_factors. Fractional generation similarly calculates exponentially growing run counts and subsequently constructs all runs in memory. A sufficiently large input can therefore exhaust available memory, saturate CPU resources, or produce an extremely large output file.

Attack Path

  1. An attacker or untrusted caller invokes the Skill with an excessive dimension, such as a very large --factors, --levels, or --num-factors value.
  2. The script accepts the value because it only validates the minimum boundary.
  3. The full-factorial path materializes an exponential Cartesian product, or the fractional path calculates and iterates over an exponential number of runs.
  4. The Python process consumes excessive memory and CPU time.
  5. The process may be terminated by the operating system, and other workloads on the same host may become unavailable or degraded.

Impact Assessment

Exploitation can cause a local denial of ser ...[truncated 269 chars]

Remediation
View remediation

Remediation Suggestions

  • Define conservative maximum values for factors, levels, generated runs, and estimated output bytes.
  • Calculate the expected run count before allocating the design and reject requests exceeding the configured limit.
  • Apply checked arithmetic and reject values that exceed practical integer or storage limits.
  • Stream full-factorial rows directly to CSV instead of converting the complete Cartesian product into a list.
  • Consider operating-system resource limits, execution timeouts, and disk quotas when this script can be invoked by untrusted users.
  • Return a clear error describing the calculated run count and the configured safety limit.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/doe_generator.py:194
Finding

User-Controlled Output Path Allows Overwriting Arbitrary Writable Files

Content
View full analysis

Vulnerability Details

File Location: scripts/doe_generator.py, lines 194-201, 218, and 226
Vulnerability Type: Unrestricted file write and overwrite
Risk Level: Medium

Vulnerable Code

python
def save_to_csv(experiments: List[Dict], output_path: str, factors: List[str]) -> None:
    """
    Save the experiment design to a CSV file.
    """
    df = pd.DataFrame(experiments)

    # Ensure column order: Run, Factor_A, Factor_B, ...
    cols = ["Run"] + factors
    df = df[cols]

    df.to_csv(output_path, index=False)
python
full_parser.add_argument("--output", type=str, default="full_factorial.csv", help="Output CSV file path")
python
frac_parser.add_argument("--output", type=str, default="fractional_factorial.csv", help="Output CSV file path")

Technical Analysis

The --output argument is passed directly to pandas.DataFrame.to_csv() without canonicalization, directory confinement, an existing-file check, or symlink protection. Although the documentation describes output paths as relative, the implementation accepts absolute paths and parent-directory traversal sequences.

to_csv() normally opens the destination for writing and truncates an existing file. Consequently, any file writable by the operating-system identity running the Skill can be replaced with generated CSV content. A symlink located at the supplied output path may also redirect the write to another target.

Attack Path

  1. An attacker identifies a file writable by the Skill process or creates a symlink to such a file.
  2. The attacker supplies that path through --output, using an absolute path, directory traversal, or a symlink.
  3. The script forwards the path unchanged to DataFrame.to_csv().
  4. pandas opens the resolved destination for writing and truncates or replaces its contents.
  5. The target file is corrupted or replaced with attacker-selected DOE dimensions encoded as CSV ...[truncated 419 chars]
Remediation
View remediation

Remediation Suggestions

  • Define a dedicated output directory and resolve every requested destination with pathlib.Path.resolve().
  • Verify that the resolved destination remains beneath the approved output directory.
  • Reject absolute paths, parent-directory traversal, and paths whose components are symbolic links.
  • Use exclusive file creation so existing files are not overwritten by default.
  • Require an explicit, separately authorized overwrite option when replacement is necessary.
  • Where practical, open the destination securely with no-follow and exclusive-creation flags, then pass the resulting file object to pandas.
  • Run the Skill with a minimally privileged operating-system account that cannot write security-sensitive files.

T08 · Insecure Dependencies

Note
Location
scripts/doe_generator.py:12
Finding

Unpinned Third-Party Dependency Creates Supply-Chain and Reproducibility Risk

Content
View full analysis

Vulnerability Details

File Location: scripts/doe_generator.py, lines 12-19; SKILL.md, lines 18-20
Vulnerability Type: Insufficiently constrained third-party dependency
Risk Level: Low

Vulnerable Code

python
try:
    import pandas as pd
except ImportError:
    print(json.dumps({
        "status": "error",
        "message": "pandas not installed. Run: pip install pandas>=1.5.0"
    }))
    sys.exit(1)

The Skill documentation also specifies only:

text
pandas>=1.5.0

Technical Analysis

The dependency is constrained only by a minimum version. There is no exact version lock, upper compatibility bound, package hash, lock file, or trusted package-index configuration. Following the installation instruction allows the package manager to select any current or future pandas release and its transitive dependencies from the configured indexes.

This creates non-reproducible installations and exposes the environment to future incompatible or compromised releases. The audited source does not demonstrate an active malicious package or dependency-confusion attack, so this is a supply-chain hardening weakness rather than evidence of current compromise.

Attack Path

  1. pandas is absent from the runtime environment.
  2. An operator follows the error message and runs the suggested pip install command.
  3. pip resolves an uncontrolled compatible version and its transitive dependencies from the configured package indexes.
  4. If an index, resolved release, or transitive dependency is compromised, package installation or subsequent import executes malicious package code.
  5. That code runs with the same permissions and access available to the installing or executing account.

Impact Assessment

A compromised dependency could execute code with the privileges of the installation or Skill process, access files and environment variables available to that account, modify its enviro ...[truncated 139 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin pandas and all transitive dependencies to reviewed, exact versions in a lock file.
  • Use hash verification, such as pip requirements with --require-hashes.
  • Install packages only from an explicitly configured and trusted package index.
  • Review and update dependency versions through a controlled maintenance process.
  • Test updates in an isolated environment before deployment.
  • Avoid presenting an unconstrained installation command as the primary recovery action.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

主要功能方向基本相关，确实是一个DOE实验设计生成器，并支持CSV导出、全因子设计和带分辨率参数的部分因子设计。但描述中“覆盖DOE、正交实验、田口方法等常见设计”明显超出了代码实际能力。代码没有正交表、田口L阵列、信噪比分析或其他田口方法实现，部分因子设计也只是简化的二水平2^(k-p)方案。因此描述对支持的设计类型有实质性夸大，应判定为不匹配。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

L015 将触发条件写为“设计实验方案”“DOE”“正交实验”“因子实验”，其中“设计实验方案”范围较宽，而整行也没有说明必须与DOE相关、在哪些上下文中触发，或提供不会触发的反例。这种描述容易与一般性的实验/方案设计请求重叠，导致技能被意外调用。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest says the skill covers DOE, orthogonal experiments, and Taguchi methods, but this file's functionality is limited to full factorial generation and a basic 2^(k-p) fractional design flow. There is no implementation of orthogonal array selection, Taguchi signal-to-noise analysis, or other Taguchi-specific design constructs, so the claimed scope does not match actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language strings and docstrings entirely in Chinese, starting with the module description and continuing through user-facing help and error text. That forces a specific language for users without any opt-in or justification that the tool is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

该 Markdown 文件说明脚本会导出 CSV，并在 L090 指出保存到当前工作目录，但没有显式提醒这会在本地创建或覆盖文件、应由用户确认输出路径。对于会影响用户文件系统的数据写入行为，技能说明中应有清晰的用户提示。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The documentation states that the function obtains generators 'based on standard generator relationships,' which implies established design-generator logic. However, outside a small hard-coded table, the code falls back to ad hoc calculations and a simplified pattern generator, so the documentation overstates what the function really does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.