ClawHub
Back to skill

Security audit

Cn Text Encoding Detector

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local text-encoding checker with some accuracy and robustness issues, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Before installing, treat this as a lightweight local helper rather than a full encoding detector: it may misreport unsupported encodings, and you should avoid running it on very large files until the size calculation is hardened. The promotional footer links are optional branding and are not needed to use the tool.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/encoding_detector.py:38
Finding

Unbounded Full-File Read Can Cause Memory Exhaustion

Content
View full analysis

Vulnerability Details

File Location: scripts/encoding_detector.py, lines 38–39
Vulnerability Type: Unbounded memory allocation / denial of service
Risk Level: Medium

Vulnerable Code:

python
with open(args.file, "rb") as f:
    size = len(f.read())

Technical Analysis

The program loads the entire selected file into memory solely to calculate its byte size. This operation has no upper bound. Although detect_encoding() limits its initial sample to 10,000 bytes, the subsequent f.read() negates that protection.

If an attacker can influence the --file argument or provide a file that the application processes, they can select a very large readable file. Memory consumption will then scale with the full input size. A special stream-backed path may introduce additional availability risks if reading does not terminate as expected.

Attack Path

  1. An attacker creates, uploads, or identifies a very large file readable by the process.
  2. The attacker causes the skill to run with that path through --file.
  3. Encoding detection reads a bounded 10,000-byte sample.
  4. The size calculation calls f.read() without a limit and attempts to hold the entire file in memory.
  5. The process consumes excessive memory and may be terminated by the operating system, disrupting the agent or hosting service.

Impact Assessment

Successful exploitation can cause denial of service through excessive memory consumption, process termination, degraded host performance, or disruption of concurrent workloads. The flaw does not itself grant additional privileges, execute attacker-controlled code, disclose file contents in output, or cross an access-control boundary. Its scope is limited to files the current process can already open.

Remediation
View remediation

Remediation Suggestions

Obtain the file size from filesystem metadata instead of reading the content:

python
import os

size = os.path.getsize(args.file)

For additional hardening:

  • Use os.stat() and stat.S_ISREG() to reject devices, FIFOs, sockets, and other non-regular files when they are outside the intended use case.
  • Apply an explicit maximum accepted file size before processing.
  • Catch OSError and return a controlled error rather than a traceback.
  • If consistency between detection and reported size matters, open the file once, validate it with os.fstat(f.fileno()), and read only the bounded detection sample.
  • Run the skill with memory and execution-time limits as defense in depth.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The primary purpose mostly aligns: the script detects file encoding from a local file and auto-detects BOM markers using the standard library. However, the description overstates coverage by claiming broader encoding detection (e.g., Latin-1, 'etc.'), while the code only checks BOM, UTF-8, and GBK, otherwise returning UNKNOWN. The extra file size reporting is a minor undeclared behavior. Because the declared description specifically names Latin-1 and suggests broader support than implemented, this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown includes Chinese-only promotional/footer text and branding at L59-L61, while the rest of the skill is in English. This creates a language/locale inconsistency without opt-in or justification that the skill is intended only for Chinese-speaking users, matching the policy concern for forced locale/language content.

Content

No source excerpt is available for this finding.