ClawHub
Back to skill

Security audit

software-copyright-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with generating Chinese software copyright documents, but it includes unsafe document-processing and credential-handling guidance that users should review before installing.

Install only if you are comfortable giving the skill access to the target project code and generated documents. Avoid the D2 curl-to-shell installer, do not pass real passwords on the command line, protect or avoid exported cookie files, and run DOCX/image replacement only on trusted documents in an isolated workspace.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/配图生成最佳实践.md:41
Finding

Unverified Remote Installer Executed Directly Through a Shell

Content
View full analysis

Vulnerability Details

File Location: references/配图生成最佳实践.md:41-44; duplicated in references/图表工具调研报告.md:66
Vulnerability Type: Unverified remote code retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
### D2 installation
curl -fsSL https://d2lang.com/install.sh | sh -s --

Technical Analysis

The documentation instructs the user or Agent to download a mutable script from an external server and pipe it directly into a shell. The script is neither pinned to an immutable version nor verified using a cryptographic hash or signature before execution.

This collapses download, trust assessment, and execution into one operation. The effective payload can consequently change after the Skill has been reviewed. Compromise of the hosting server, its distribution infrastructure, DNS resolution, or the TLS trust path could result in arbitrary commands being executed with the invoking user's privileges.

D2 is presented as an optional diagramming alternative rather than a mandatory component of the primary Excalidraw-based workflow. Direct shell execution of its remote installer therefore exceeds the minimum privileges and supply-chain exposure necessary for the Skill's declared document-generation functionality.

Attack Path

  1. An attacker compromises the installer host, distribution path, or an authorized release account.
  2. The attacker modifies the response returned by https://d2lang.com/install.sh.
  3. A user or Agent follows the Skill's installation instructions.
  4. curl retrieves the attacker-controlled response.
  5. The pipe passes the response directly to sh without inspection or integrity verification.
  6. The malicious commands execute with all permissions available to the invoking account.
  7. The payload may access project source code, user documents, credentials available to the process, or other files writable by that account.

Impact Assessment

Successfu ...[truncated 365 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all curl | sh installation instructions, including the duplicate in references/图表工具调研报告.md.
  2. Prefer an official, version-pinned package-manager installation method.
  3. If a standalone artifact is necessary:
    • Pin an immutable release version.
    • Download the artifact as a separate step.
    • Obtain the expected SHA-256 digest or signature through an independently authenticated channel.
    • Verify the artifact before execution.
    • Inspect the installer and execute it only after explicit user approval.
  4. Do not invoke the installer with administrative privileges unless strictly required.
  5. Keep D2 optional and use the already bundled local rendering workflow where possible.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/replace_docx_images.py:29
Finding

Unsafe Extraction of User-Supplied DOCX Archives

Content
View full analysis

Vulnerability Details

File Location: scripts/replace_docx_images.py:29-30
Vulnerability Type: Unvalidated archive extraction
Risk Level: High

Vulnerable Code:

python
# Extract the DOCX file
with zipfile.ZipFile(docx_path, 'r') as zip_ref:
    zip_ref.extractall(temp_dir)

Technical Analysis

A DOCX file is a ZIP archive whose entry names are controlled by the file's producer. The script extracts every member without first validating its name, resolved destination, file type, size, or compression ratio.

Relying on unrestricted bulk extraction creates exposure to malicious archive entries, including path-manipulation attempts and resource-exhaustion archives. Security behavior can also vary by Python runtime and archive-entry semantics, so explicit destination validation is required at the application boundary rather than relying solely on library normalization.

The extraction process additionally lacks limits on total uncompressed size, individual member size, member count, and compression ratio. A crafted DOCX can therefore consume excessive disk space or processing resources even when path traversal is normalized by the runtime.

Attack Path

  1. An attacker creates a malformed DOCX containing malicious ZIP member names or highly compressed oversized content.
  2. The attacker supplies the DOCX as a reference or generated document for image replacement.
  3. The user invokes replace_docx_images.py on that file.
  4. The script passes the complete archive directly to extractall().
  5. Depending on runtime handling and archive structure, extraction may attempt to place content outside the intended workspace or consume excessive local resources.
  6. Extracted content is subsequently traversed and repackaged by the script.

Impact Assessment

The principal impact is unauthorized filesystem modification under the invoking user's permissions or denial of service through disk and resour ...[truncated 284 chars]

Remediation
View remediation

Remediation Suggestions

  1. Enumerate archive members instead of calling unrestricted extractall().
  2. For each member:
    • Reject absolute paths and drive-qualified paths.
    • Resolve the intended destination and verify that it remains inside the temporary root.
    • Reject traversal components and unsupported special-file entries.
    • Permit only files expected in a valid DOCX package.
  3. Enforce limits on member count, individual uncompressed size, total uncompressed size, and compression ratio.
  4. Reject encrypted or malformed archives unless explicitly supported.
  5. Extract each validated member individually.
  6. Run document processing without elevated privileges and inside an isolated working directory.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/replace_docx_images.py:24
Finding

Predictable Shared Temporary Directory Used for DOCX Processing

Content
View full analysis

Vulnerability Details

File Location: scripts/replace_docx_images.py:24-27
Vulnerability Type: Insecure temporary-file handling
Risk Level: Medium

Vulnerable Code:

python
# Create temporary directory
temp_dir = "/tmp/docx_replace_temp"
if os.path.exists(temp_dir):
    shutil.rmtree(temp_dir)
os.makedirs(temp_dir)

The same predictable path is later removed:

python
# Clean up temporary directory
shutil.rmtree(temp_dir)

Technical Analysis

The script uses a fixed path in a shared temporary filesystem. It checks for the path, removes it, and recreates it through separate non-atomic operations. This creates a time-of-check/time-of-use window and allows concurrent processes to predict and interfere with the workspace.

Multiple legitimate invocations can also delete or overwrite one another's extracted document contents. The directory is not created through a secure temporary-directory API, and the code does not explicitly establish restrictive permissions or verify ownership before operating on an existing path.

Attack Path

  1. A local attacker or concurrent process predicts /tmp/docx_replace_temp.
  2. The process creates or manipulates that path between the script's existence check, removal, creation, extraction, and cleanup operations.
  3. The victim runs the image-replacement operation.
  4. The attacker interferes with extracted files, causes processing failures, or attempts to observe transient document contents.
  5. Concurrent invocations may remove each other's workspace or cause corrupted output.

Impact Assessment

Exploitation may expose the contents of user-supplied DOCX files, corrupt generated output, or cause denial of service. The attack primarily requires local access to the same host or a concurrent process running under a context able to manipulate the shared temporary namespace. The issue does not independently provide elevated privileges, but its ...[truncated 57 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the fixed path with tempfile.TemporaryDirectory().
  2. Use the temporary directory as a context manager so cleanup occurs reliably:
    python
    import tempfile

with tempfile.TemporaryDirectory(prefix="docx_replace_") as temp_dir:
    # Validate and extract the archive here.
    pass
  3. Ensure the directory is created with permissions that restrict access to the current user.
  4. Never recursively delete a pre-existing predictable path in a shared temporary directory.
  5. Keep each invocation in a unique workspace and avoid exposing document contents longer than necessary.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auto_screenshot.py:395
Finding

Application Password Accepted as a Plaintext Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: scripts/auto_screenshot.py:340-344, 395
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

Vulnerable Code:

python
elif args.username and args.password:
    # Use username and password to log in
    await login_with_credentials(
        page, args.url, args.username, args.password,
        args.username_selector, args.password_selector, args.submit_selector
    )

The password is defined as an ordinary command-line option:

python
login_group.add_argument('--password', help='Password')

Technical Analysis

Supplying a password through a command-line argument can expose it through process listings, shell history, terminal logs, audit systems, CI job output, debugging information, and process-monitoring tools.

Authentication is a legitimate part of the screenshot functionality, and the reviewed code does not persist or intentionally transmit the password to an unrelated destination. The vulnerability concerns the credential-delivery channel rather than the authentication operation itself.

Attack Path

  1. A user launches the screenshot script with --password actual-password.
  2. The full command is stored in shell history or exposed in the process command line while the process is running.
  3. Another local user, monitoring tool, administrator, CI-log reader, or support-log recipient observes the argument.
  4. The observer recovers the plaintext password.
  5. The password is reused to authenticate to the target application.

Impact Assessment

Successful exploitation discloses the target application's account password. The resulting privileges are those assigned to the compromised application account and may include access to private application data or administrative functions. The issue does not itself grant operating-system privilege escalation, but password reuse could broaden the impact beyond the target ...[truncated 12 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove or deprecate the --password command-line option.
  2. Prompt interactively with Python's getpass.getpass() when a password is required.
  3. For automation, accept the secret through a protected file descriptor, standard input, or an approved secret manager.
  4. Avoid environment variables where stronger secret-delivery mechanisms are available, as environments may also be observable in some deployment contexts.
  5. Redact credentials from exceptions, debugging output, CI logs, and telemetry.
  6. Document restrictive file permissions for cookie files and recommend short-lived, least-privileged test accounts for automated screenshots.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (183)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A CLI that can modify embedded images in arbitrary DOCX files extends beyond generation of specific registration documents and introduces generalized document-manipulation capability. That can cause unintended alteration of user documents if invoked broadly or without clear scope restrictions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
references/excalidraw-diagram/lib/chunk-EIO257PC.js:2

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/excalidraw-diagram/lib/chunk-K2UTITRG.js:1