数字公式计算器-招投标价格

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:10 PM UTC
• Version: 1.0.0

Overview

This is a coherent math and Excel formula helper with no bundled executable code, though users should note the mutable install command and optional local learning file behavior.

Install with normal user privileges, verify the ClawHub package and publisher, and prefer a pinned installer version when available. If formulas or bid data are sensitive, only allow LEARNINGS.md updates when you are comfortable storing those local notes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:83

Finding

Unpinned Remote Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:83
Vulnerability Type: Supply-chain risk caused by executing an unpinned npm package
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install math-formula-calculator

Technical Analysis

The recommended installation command invokes npx with the mutable latest tag. If the selected package version is not already available locally, npx may retrieve it from the configured npm registry and execute its package entry point with the installing user's privileges.

Because latest is mutable, the package executed in the future may differ from the version reviewed when this documentation was published. The project does not provide a fixed package version, package integrity hash, lockfile, verified registry identity, or other mechanism for users to confirm that the downloaded installer is a reviewed release.

This creates a supply-chain trust boundary outside the audited project. Compromise of the package publisher account, registry distribution path, or a future package release could change the effective installation behavior without requiring any modification to this repository.

Attack Path

1. An attacker compromises the clawhub npm package, its publisher account, or another relevant distribution component.
2. The attacker publishes a malicious release and causes the mutable latest tag to reference it.
3. A user follows the installation command documented in README.md.
4. npx downloads and executes the attacker-controlled package.
5. The malicious package runs with the privileges and environmental access of the user who launched the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that user's privileges and environment, the malicious package could access or modify user-readable files, project data, environment variables, credentials available to the process, and net ...[truncated 368 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an explicitly reviewed and fixed package version:

   bash

   npx clawhub@1.2.3 install math-formula-calculator
   

2. Document the expected npm registry and verified package publisher so users can detect namespace or registry substitution.
3. Publish the expected package integrity digest and provide instructions for verifying the downloaded artifact before execution.
4. Prefer an installation workflow that separates retrieval, inspection, and execution rather than immediately executing remotely obtained package code.
5. Maintain release provenance through signed releases or registry-supported provenance attestations.
6. Advise users to perform installation with the minimum required privileges and never run the command as an administrator unless strictly necessary.
7. Update pinned versions deliberately after security review instead of relying on a mutable distribution tag.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is written entirely in Chinese and the usage examples also assume Chinese-language interaction, but the README does not state that the skill is region-specific or offer any language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version at install time. Using an unpinned, remotely resolved executable creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is entirely in Chinese and presents the skill as a Chinese-language specialist without any indication that other languages are supported. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.