ClawHub
Back to skill

Security audit

质量月报生成技能

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent quality-report generation skill, with some dependency-installation and data-retention details users should review before use.

Install only if you are comfortable letting the agent process the supplied quality-report files and generate local JSON/HTML outputs. Require explicit approval before any pip or npm dependency installation, and avoid providing sensitive project data unless the conversation history and any exported JSON files are acceptable for your environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
f.write(mermaid_code)
        
        # 调用 mmdc 转换
        result = subprocess.run(
            ["mmdc", "-i", str(temp_mmd), "-o", str(temp_svg), "-t", "default", "-w", "800"],
            capture_output=True,
            text=True,
Confidence
83% confidence
Finding
The script writes untrusted Mermaid content from the Markdown file to a temporary file and passes it to an external renderer (mmdc). Although subprocess.run is used safely without shell=True, the real risk is delegated parsing of attacker-controlled diagram content by a large external toolchain, which can expose the host to parser bugs, SSRF-like fetches, local file access, or sandbox escape depending on mermaid-cli/Puppeteer behavior and configuration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares no permissions while explicitly describing capabilities that read user files, write output files, and invoke shell-accessible tooling like mermaid-cli. This creates a trust gap: users and enforcement layers may underestimate what the skill can do, increasing the chance of unsafe file access or command execution without informed consent.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The stated purpose sounds like a report-generation skill, but the documented behavior also includes parsing arbitrary Excel content, converting data formats, rendering HTML, and spawning an external mermaid-cli process. That mismatch matters because users may authorize a seemingly narrow reporting task without realizing it performs broader file processing and command execution, which expands the attack surface.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The TRACE section claims there is no external dependency risk, yet the skill explicitly states it auto-installs packages and uses mermaid-cli as a system dependency. This misleading safety framing can cause operators to trust and run the skill without applying the additional scrutiny appropriate for dependency installation and subprocess execution.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Automatic installation of pandas, openpyxl, and mermaid-cli changes the runtime environment and may pull untrusted or vulnerable packages without explicit user approval. In enterprise or locked-down environments, silent dependency installation can violate policy and introduce supply-chain or integrity risks.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill says it maintains a historical data pool and can export it, but it does not clearly explain retention boundaries, sensitivity handling, or persistence implications. Because the input may include internal quality metrics, defects, and operational history, quiet accumulation of data increases confidentiality and governance risk.

Ssd 3

Medium
Confidence
93% confidence
Finding
Instructions to maintain and export an accumulated historical dataset create a real data-handling risk, especially when the skill processes potentially sensitive test, defect, and project information. The context makes this more dangerous because quality reports often contain internal operational details, and the skill normalizes retaining them without robust consent or minimization.

Static analysis

No suspicious patterns detected.