ClawHub
Back to skill

Security audit

Wanpaike Opc Business Plan

Security checks for vulnerabilities and agentic risk

Overview

The skill’s business-plan purpose is coherent, but it can automatically modify the local Python environment while generating PPT files without clear user confirmation.

Review this skill before installing. It appears intended to generate business-plan slides, but use it only if you are comfortable with the agent running a local Python script; ideally install python-pptx yourself first or remove the auto-install fallback, and choose a safe output path for any sensitive business data.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
except ImportError:
    print("正在安装python-pptx...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "python-pptx", "-q"])
    from pptx import Presentation
    from pptx.util import Inches, Pt, Emu
    from pptx.dml.color import RGBColor
Confidence
94% confidence
Finding
The script invokes pip via subprocess at runtime to install a missing dependency. This introduces package-management and potential network execution behavior during normal use, which can modify the host environment and expose users to supply-chain risk if package indexes, mirrors, or dependency resolution are compromised.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill invokes local file access and shell execution behaviors (reading references/scripts and running a Python command) while declaring no permissions or capability boundaries. This is dangerous because users and hosting platforms cannot accurately assess that the skill may execute commands or write files locally, increasing the chance of unexpected code execution or unsafe tool invocation.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented behavior materially overstates what the skill does and omits that it may auto-install dependencies via pip. Hidden package installation and execution behavior are security-relevant because they introduce network access, supply-chain risk, and unanticipated system modification beyond the advertised business-plan generation workflow.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill includes runtime package installation capability that is not essential to the core logic of rendering a PPT from JSON input. Even though the installed package name is fixed, this still grants the script the ability to reach out to package infrastructure and alter the execution environment, expanding the attack surface beyond simple document generation.

Missing User Warnings

Low
Confidence
76% confidence
Finding
The skill promises automatic PPT generation and delivery without an explicit warning that it will create and write a local .pptx file. While expected for this use case, silent file creation can still surprise users, overwrite existing files, or expose sensitive business data in local artifacts.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script automatically runs pip without explicit warning or confirmation, causing silent environment modification and possible network access. This is dangerous in automation, CI, or restricted environments because users may not expect package installation side effects from a PPT generator and may inadvertently permit unreviewed code to be fetched and installed.

Static analysis

No suspicious patterns detected.