ClawHub
Back to skill

Security audit

Wenshushu File Uploader

Security checks for vulnerabilities and agentic risk

Overview

This file-sharing skill is not clearly malicious, but it needs Review because it can upload arbitrary local files and performs unverified automatic dependency installation with weak confirmation boundaries.

Review this before installing. Use it only for files you intentionally want to share through wenshushu.cn, confirm the exact local path before upload, and avoid sensitive files unless encrypted. Do not allow automatic setup to run remote installers or package installs unless you trust and verify those dependencies; prefer a pinned, reviewed installation. Be aware that public links, pickup codes, management links, and optional login tokens may create additional access paths if stored locally.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:14
Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content
View full analysis
/dev/null; then echo "📦 Installing uv (Python package manager)..." curl -LsSf https://astral.sh/uv/install.sh | sh export PATH="$HOME/.local/bin:$PATH" fi ``` `README.md:62-66`: ```bash # If uv is not installed, install it automatically curl -LsSf https://astral.sh/uv/install.sh | sh # Create a virtual environment ``` `SKILL.md:205-208`: ```bash # 1. Install uv curl -LsSf https://astral.sh/uv/install.sh | sh # 2. Install wssf ``` ### Technical Analysis The project downloads a mutable shell script from an external URL and immediately sends its contents to `sh`. There is no version pinning, local inspection, cryptographic checksum validation, signature verification, or immutable artifact reference between retrieval and execution. HTTPS protects the connection under normal conditions but does not establish that the returned installer is the same payload that was reviewed. The effective code can change after the Skill is audited. Compromise of the distribution server, domain, publishing infrastructure, or trusted TLS path could therefore turn installation into arbitrary command execution. The behavior is operationally unnecessary for the declared file-upload function. Uploading requires network access and read access to an explicitly selected file, but it does not require automatically executing an unverified remote shell program. Consequently, this installation path exceeds the minimum privileges required by the Skill. ### Attack Path 1. The Skill or user invokes `install.sh` on a system where `uv` is unavailable. 2. The script requests `https://astral.sh/uv/install.sh`. 3. An attacker who has compromised the remote distribution ...[truncated 1242 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/upload.py:31
Finding

Third-Party Uploader Is Installed and Executed at Runtime Without Artifact Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The '| sh' pattern creates a direct command chain from untrusted network input to code execution, eliminating any meaningful validation step. In the context of an agent skill that may encourage automated setup, this is especially dangerous because it normalizes unsafe installation behavior and could lead to full host compromise.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

首次使用时，技能会自动检查并安装依赖：

bash
# 如果未安装 uv，会自动安装
curl -LsSf https://astral.sh/uv/install.sh | sh

# 创建虚拟环境
uv venv

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Using a pipeline into 'sh' causes immediate execution of remote content without review, creating a classic command-chaining abuse path. In this skill, that is more dangerous because the same skill already contemplates automatic installation and shell use, so an agent could normalize unsafe execution patterns around high-trust file-sharing workflows.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

方法二：手动安装

bash
# 1. 安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. 安装 wssf
uv venv

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The '| sh' pattern creates an execution chain where untrusted network data is interpreted immediately as shell commands. This removes opportunities for inspection and validation and significantly increases the chance of arbitrary code execution if the fetched script is malicious or tampered with.

Content

Scanner excerpt · install.sh (reported line 17)May include surrounding context.

sh
# 检查 uv，如未安装则安装
if ! command -v uv &> /dev/null; then
    echo "📦 正在安装 uv（Python 包管理器）..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    export PATH="$HOME/.local/bin:$PATH"
fi

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented trigger phrases are broad enough that ordinary requests like '发文件给我' or '上传文件' could invoke the skill without strong confirmation of which local file should be exfiltrated. In an agent context, ambiguous auto-invocation increases the chance of unintended file uploads and accidental disclosure of sensitive data to a third-party service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill describes shell-capable behavior such as automatic installation and command execution, but it does not declare any explicit tool scope or permissions boundaries. This increases the chance that an agent invokes shell access more broadly than intended, especially because the skill handles arbitrary file paths and networked uploads.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description emphasizes convenience but does not clearly warn up front that files, filenames, metadata, links, and pickup codes will be sent to a third-party service and may become accessible to anyone with the link and code. Because the skill is designed for sharing local files, omission of this warning makes accidental data disclosure more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to match common requests like '发文件给我' or '生成下载链接', which could cause the skill to activate in situations where the user did not intend third-party upload. In this context, mistaken activation is especially risky because the action exfiltrates local files to a public external service.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs persistent logging of uploaded filenames, sizes, timestamps, public URLs, pickup codes, and management links in a local memory file. Storing both access artifacts and management URLs creates an additional leakage surface beyond the original upload, enabling later unauthorized access or discovery of shared content if local memory is exposed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script's comments and user-facing messages are written in Chinese, and L33 instructs users to trigger the skill by saying '上传文件'. This imposes a specific language expectation without any visible opt-in, alternative language phrasing, or explanation that the skill is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installer downloads a remote script and immediately executes it with the shell, which gives the remote server full code execution during installation. If the upstream host, network path, or fetched content is compromised, users can be made to run arbitrary commands without any verification or explicit warning.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/upload.py (reported line 22)May include surrounding context.

python
"""检查 wssf 是否已安装"""
    try:
        # 尝试运行 wssf --help
        result = subprocess.run(
            [UV_PATH, "run", "wssf", "--help"],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill can modify the runtime environment by installing new software, which is a privileged side effect unrelated to the core task of uploading a file. In a skill context, this is more dangerous because users may expect a narrow file-transfer action, not package management with code-execution implications.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

This code installs a package at runtime from an external package source, which expands the skill's behavior beyond simple file upload and introduces supply-chain risk. In an agent environment, automatic dependency installation can execute unreviewed code during install time and may expose the host to compromise if the package, index, or transport is tampered with.

Content

Scanner excerpt · scripts/upload.py (reported line 37)May include surrounding context.

python
print("📦 正在安装 wssf...")
    try:
        # 使用 uv 安装 wssf
        subprocess.run(
            [UV_PATH, "pip", "install", "wssf==5.0.6"],
            check=True,
            timeout=120

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This function uploads arbitrary local files to a third-party service without an explicit consent gate or a clear privacy warning at the point of action. In an agent skill, that materially increases risk because the agent may be asked to upload sensitive workspace data, credentials, or internal documents to an external host.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/upload.py (reported line 85)May include surrounding context.

python
try:
        print(f"📤 正在上传: {filepath.name} ({filepath.stat().st_size / 1024:.1f} KB)")
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

All user-facing examples, invocation guidance, and interaction patterns are presented only in Chinese, and the skill does not indicate that users may choose another language. This can be a natural-language locale policy issue when a skill effectively forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The README instructs users to fetch and execute a remote installation script via curl piped directly to the shell, which bypasses review and makes the host trust live network content at execution time. If the remote server, transport path, or hosting account is compromised, arbitrary code can run on the user's system during skill setup.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

首次使用时，技能会自动检查并安装依赖：

bash
# 如果未安装 uv，会自动安装
curl -LsSf https://astral.sh/uv/install.sh | sh

# 创建虚拟环境
uv venv

External Script Fetching

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The skill includes instructions to fetch and run a remote install script directly from the network. Even if presented as manual installation guidance, this pattern is dangerous because compromise of the remote host, transport, or script content would lead to arbitrary code execution on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

方法二：手动安装

bash
# 1. 安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. 安装 wssf
uv venv

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The description only states that the skill uploads files and generates a share link and pickup code, but it does not define when the skill should activate, what user confirmation is required, or what boundaries apply to file selection and upload. For a file-upload skill, vague activation scope can cause unintended invocation or overly broad handling of local files, increasing the risk of accidental data exfiltration through normal agent behavior rather than an overt exploit.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The script fetches executable installation content from an external URL at install time. Even though HTTPS is used, there is no checksum, signature verification, or pinning to a reviewed artifact, so trust is delegated entirely to the remote endpoint.

Content

Scanner excerpt · install.sh (reported line 17)May include surrounding context.

sh
# 检查 uv，如未安装则安装
if ! command -v uv &> /dev/null; then
    echo "📦 正在安装 uv（Python 包管理器）..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    export PATH="$HOME/.local/bin:$PATH"
fi

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

Most user-facing output and usage instructions in the script are written only in Chinese, which imposes a language preference without any visible opt-in or fallback. The policy allows locale constraints when documented and justified, but this file does not clearly state that the skill is intentionally Chinese-only or provide a user language choice.

Content

No source excerpt is available for this finding.