ClawHub
Back to skill

Security audit

ISO9001质量管理体系文件生成

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a Chinese ISO9001 document generator, but it persistently stores and automatically reveals company profile details in the workspace without enough privacy controls.

Install only in a private workspace. Treat enterprise-info.json and generated documents as confidential business records, and delete the profile file when the project is finished or before switching companies. Use a virtual environment for python-docx and avoid sharing or committing generated files unless reviewed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/generate_iso_docs.py:21
Finding

Third-Party Dependency Installed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_iso_docs.py:21-25
Related Location: SKILL.md:19-22
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet

python
except ImportError:
    print("Error: the python-docx library must be installed")
    print("Run: pip install python-docx==1.1.2")
    exit(1)

The corresponding dependency declaration in SKILL.md:19-22 is:

text
python-docx==1.1.2

Technical Analysis

The project instructs users to install python-docx directly from the package source configured for pip. Although the dependency is pinned to version 1.1.2, no cryptographic hash, lockfile, trusted-index requirement, package signature verification, or transitive dependency integrity control is supplied.

Version pinning provides reproducibility but does not establish authenticity. If the configured package index, network path, package release, or dependency-resolution configuration is compromised, an attacker-controlled distribution could be installed. Python packages may execute build or installation logic and are subsequently imported by this script.

No evidence indicates that python-docx itself is malicious. The vulnerability is the absence of supply-chain integrity controls around installation.

Attack Path

  1. An attacker compromises a configured Python package index, package publication account, local package mirror, or dependency-resolution path.
  2. The attacker serves a malicious distribution matching the requested package and version, or compromises a transitive dependency selected by pip.
  3. A user follows the displayed pip install python-docx==1.1.2 instruction.
  4. Malicious package installation or build logic executes with the privileges of the user running pip.
  5. The malicious package may execute again when generate_iso_docs.py imports the docx module.

Im

...[truncated 477 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a hash-locked dependency file generated from a reviewed artifact, for example:
    text
    python-docx==1.1.2 --hash=sha256:<verified-distribution-hash>
  2. Require installation with:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Lock and verify all transitive dependencies rather than only the top-level package.
  4. Document the approved package index and use an explicitly configured HTTPS index.
  5. Perform dependency vulnerability and provenance checks in CI.
  6. Install dependencies in an isolated virtual environment under a non-privileged account.
  7. Correct the statement in SKILL.md:894 that claims there is no external dependency risk.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:27
Finding

Plaintext Persistence of Potentially Confidential Enterprise Information

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:27-47
Vulnerability Type: Plaintext storage of sensitive organizational data
Risk Level: Medium

Vulnerable Instruction Snippet

The relevant instructions, translated into English while preserving their meaning, are:

text
Enterprise profile file:
- File name: ./enterprise-info.json, stored in the user workspace
- Content: all mandatory information, including company name, scope,
  industry, size, organizational structure, allocation of responsibilities,
  and business processes
- Update mechanism: retain only the latest enterprise information

Profile-reading process:
1. At the beginning of every conversation, check whether
   enterprise-info.json exists.
2. If it exists, read the profile and display the company name.
3. If the user selects option A, use the stored information.
4. If the user selects option B, collect new information and overwrite
   the profile file.

Technical Analysis

The Skill instructs the Agent to persist detailed enterprise information in ./enterprise-info.json inside the user workspace. The data includes organizational structure, responsibilities, operational scope, and business-process descriptions, which may be commercially confidential.

The instructions do not require explicit storage consent, encryption, restrictive file permissions, retention expiry, secure deletion, repository exclusion, or validation that the workspace is private. A relative path also makes the actual storage location dependent on the Agent's current working directory.

This is not an exfiltration mechanism, and the audit found no network transmission of the stored information. The risk arises from local plaintext persistence and unintended disclosure through shared workspaces, backups, source-control commits, generated archives, or other processes that can access the file.

Attack Path

  1. A user provides internal enterprise i ...[truncated 890 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make persistence explicitly opt-in and explain which fields will be stored before writing the file.
  2. Default to session-only handling when persistent storage is unnecessary.
  3. Minimize stored data and omit detailed responsibilities or business processes unless required for later use.
  4. Store the profile in a designated private data directory rather than an ambiguous current working directory.
  5. Create the file with owner-only permissions, such as mode 0600 on supported systems.
  6. Encrypt the profile at rest when the execution environment provides secure key management.
  7. Add retention controls, expiration, and a user-accessible command to delete the stored profile.
  8. Add enterprise-info.json to .gitignore and equivalent packaging or synchronization exclusion rules.
  9. Warn users not to provide personal data, credentials, trade secrets, or regulated information.
  10. Avoid displaying stored enterprise data until the current user or workspace context has been appropriately validated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (22)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

声明强调的是依据 ISO9001、过程方法和风险思维来生成完整质量管理体系文件，听起来像是内容生成/规则驱动的体系文件编制工具。但代码只接收现成的 Markdown 内容，并将其转换为 Word 文档，附带封面、目录提示、表格和表单模板等排版功能。它没有任何 ISO9001 条款映射、过程识别、风险分析、乌龟图建模、四级文件结构生成或内容推理逻辑。因此其实际主用途与声明相比明显更窄且不同：是文档转换/模板化工具，而不是 ISO9001 体系文件智能生成器。另有一个小实现问题：代码在 main 中使用 sys 前未在模块顶部导入，并在结尾重复调用 main() 两次，但这不影响本次用途失配判断。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill name, description, prompts, examples, and workflow are entirely Chinese-language, and the TRACE section highlights Chinese interaction support, but the document does not state that language is optional or user-selectable. This can constitute a locale policy issue because the skill effectively forces one language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to persist enterprise information in a workspace file and reuse it later, but does not present a clear privacy notice, retention period, consent flow, or deletion mechanism. Because the stored data includes company identity, scope, structure, responsibilities, and business processes, this can expose sensitive organizational information across sessions or to unintended users with workspace access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Persistent storage of user-provided enterprise information without minimization or clear controls creates a real data-retention and leakage risk. The requested dataset is commercially sensitive, and retaining the 'latest' enterprise profile in a shared or reused workspace increases the chance of unauthorized access or unintended reuse in future generations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly tells the agent to read prior records at the start of every conversation and display the archived company name. This directly increases cross-session disclosure risk: a later user or another process interacting with the same workspace may learn the identity of a previous organization's records even before authorization is established.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example normalizes continued use of saved enterprise information for future requests, reinforcing a pattern of cross-session persistence without strong scoping or re-consent. In practice, this makes inadvertent disclosure more likely because operators may assume reuse is harmless even when workspaces are shared, transferred, or audited.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document is entirely written in Chinese and even the sample agent dialogue is presented only in Chinese, which indicates the skill expects or enforces a single language experience. Under the policy, locale or language constraints should either be optional for the user or clearly documented as a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document title and all instructional content are presented exclusively in Chinese, with no indication that language selection is optional or that the guide is intended only for a Chinese-speaking or region-specific audience. Under the policy, natural-language content that imposes a locale or language without opt-in can be a violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Natural-language strings in the module docstring present the skill as Chinese-only, and the rest of the CLI messages follow the same pattern. For an all-users skill file, forcing a specific language without user opt-in matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The workflow saves generated documents into the current workspace without an up-front warning about file creation, naming, overwrite behavior, or the sensitivity of the generated content. In a skill that produces internal quality documents, silent file creation can lead to accidental disclosure, clutter, or overwriting in shared or monitored workspaces.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

L894 将该技能描述为“纯文档/脚本技能，无外部依赖风险”，给人以低副作用的印象。但前文多处明确要求读取、保存并覆盖 ./enterprise-info.json，以及生成并保存 .docx 文件到工作区，这说明该技能具有本地持久化写入行为。该描述与实际说明的文件读写副作用存在直接冲突。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains user-facing instructions and content exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file presents the skill reference material entirely in Chinese, beginning with the title and overview, with no indication that users may choose another language or that the locale restriction is required for a China-specific use case. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and it does not indicate that the language is optional or that the template is intended only for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

L637说明“附件3：业务流程图 - 见本手册7.6”，但正文中业务流程图实际位于L410-L428的“附件3：业务流程图”，而L286-L288的7.6是“过程关系图”。这是文档内部说明对内容位置的直接错误指向，属于文档意图与实际内容不一致。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

L638写明“附件4：程序文件目录 - 见本手册6.2”，但6.2正文L201-L203仅写“见本手册附件4：程序文件目录”，程序文件目录的实际内容位于L430-L454。该说明把附件内容与正文引用关系写反，构成交叉引用层面的意图-内容不一致。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

L639写“附件5：管理体系过程关系图 - 见本手册7.6”，但7.6在L286-L288只是“见本手册附件5：管理体系过程关系图”，附件5实际内容在L456-L485。这里的说明同样把正文中的引用章节误写成附件内容位置，形成文档说明与实际结构不一致。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

文件头文档将该工具描述为 Markdown 到 Word 的转换器，但实际实现不仅是格式转换，还会根据文档类型注入 ISO 体系文档模板元素，如封面、目录页、页眉页脚、表单头尾和签名区。这不是简单的文档不完整，而是对工具行为范围的主动缩窄描述，与代码的模板生成行为存在意图层面的偏差。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

This code performs a file write operation via doc.save(output_path). Although it prints a success message afterward, there is no prior confirmation, cautionary comment, or user-facing warning about overwriting or creating files at the specified path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

This second save path writes output to disk with doc.save(output_path) and only notifies the user after completion. There is no prior disclosure about file creation/overwrite risk in the code comments, prompts, or visible warnings.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

函数注释表明会添加页眉页脚，而页脚内容通常意味着实际页码或至少可用的页脚信息；但实现仅设置了静态字符串“第 页”，没有插入 Word 页码字段。这构成了注释/意图与实际行为不一致，尤其在质量体系文档场景下，页码通常是正式文档的重要组成。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.