ClawHub
Back to skill

Security audit

Box-KVCache

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its local Ollama compression purpose, but it includes an unsafe compressed-file loader and automatic local process launching that merit review before installation.

Review the Python scripts before installing, use an isolated virtual environment with pinned dependencies, and do not load compressed .npz/.npy files from untrusted sources unless allow_pickle is removed. Expect the launch helper to run local Ollama commands and potentially leave an Ollama service running.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lowrank_compress.py:99
Finding

Unsafe NumPy Archive Deserialization with Pickle Enabled

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:30
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
scipy== ``` 2. For stronger artifact integrity, generate and publish a lock file containing cryptographic hashes, then require hash verification: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Document installation inside an isolated virtual environment rather than the system Python environment. 4. Use `python -m pip` to ensure dependencies are installed into the interpreter that will run the scripts. 5. Document the intended trusted package index and advise users to review pip configuration and relevant environment variables before installation. 6. Add automated dependency update and vulnerability scanning so pinned versions can be reviewed and updated safely rather than remaining stale. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Tainted flow: 'user_input' from input (line 114, user input) → subprocess.run (code execution)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.

Content

Scanner excerpt · scripts/launch_compressed.py (reported line 120)May include surrounding context.

python
break
            
            # 调用 ollama
            result = subprocess.run(
                ["ollama", "run", model, user_input],
                capture_output=True, text=True, timeout=120
            )

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Using shell=True causes the shell to interpret the command string, which is a classic command-injection sink. Although this script currently builds command strings from fixed literals rather than CLI arguments, the utility function normalizes an unsafe pattern across the codebase and skill context, making later misuse likely and potentially leading to arbitrary OS command execution.

Content

Scanner excerpt · scripts/check_env.py (reported line 18)May include surrounding context.

python
def run_cmd(cmd, timeout=5):
    """执行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True,
            text=True, timeout=timeout
        )

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/check_env.py (reported line 177)May include surrounding context.

python
下一步:
  1. 安装 Ollama: https://ollama.com
  2. 下载模型: ollama pull llama3
  3. 使用压缩启动: python scripts/launch_compressed.py --model llama3 --compress
        """)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

Using shell=True for a simple status check is an avoidable tool-parameter abuse pattern because it grants shell interpretation where none is needed. In an agent or automation context, even constant shell commands are more dangerous because future refactors or environmental influence can turn a harmless check into command execution exposure.

Content

Scanner excerpt · scripts/launch_compressed.py (reported line 16)May include surrounding context.

python
def check_ollama_running() -> bool:
    """检查 Ollama 是否在运行"""
    result = subprocess.run(
        "tasklist | findstr ollama",
        shell=True, capture_output=True, text=True
    )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documentation is written entirely in Chinese, including headings, usage guidance, warnings, and examples, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking context. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The entire skill description is written in Chinese, with no indication that other languages are supported or that the locale restriction is intentional and justified. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language strings that force a specific language/locale for all users, including the module docstring and runtime messages. Under the policy, locale-specific language is only acceptable when users can opt in or when the restriction is explicitly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
93% confidence
Finding

The helper executes arbitrary shell command strings via subprocess.run(..., shell=True). In this file the current callers use hardcoded commands, so immediate exploitability is limited, but the wrapper is generic and unsafe by design: any future or indirect use with user-controlled input would enable command injection and arbitrary command execution.

Content

Scanner excerpt · scripts/check_env.py (reported line 18)May include surrounding context.

python
def run_cmd(cmd, timeout=5):
    """执行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True,
            text=True, timeout=timeout
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains natural-language documentation and user-facing output entirely in Chinese, beginning with the module docstring. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the tool is clearly documented as region-specific, which is not stated here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This uses shell=True to execute a shell pipeline, which unnecessarily invokes the Windows shell and increases command-execution risk. Although the command string is constant and not directly user-controlled here, shell invocation expands the attack surface and can be abused via environment manipulation, shell behavior, or future code changes that introduce untrusted input.

Content

Scanner excerpt · scripts/launch_compressed.py (reported line 16)May include surrounding context.

python
def check_ollama_running() -> bool:
    """检查 Ollama 是否在运行"""
    result = subprocess.run(
        "tasklist | findstr ollama",
        shell=True, capture_output=True, text=True
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/launch_compressed.py (reported line 33)May include surrounding context.

python
try:
        # Windows: 启动 ollama serve
        subprocess.Popen(
            ["ollama", "serve"],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/launch_compressed.py (reported line 120)May include surrounding context.

python
break
            
            # 调用 ollama
            result = subprocess.run(
                ["ollama", "run", model, user_input],
                capture_output=True, text=True, timeout=120
            )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The argparse description, help strings, and other runtime messages are all written in Chinese, with no option for users to choose another language. Because this is user-facing natural language in a general-purpose script, it constitutes a language policy issue under the stated rules.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/launch_compressed.py (reported line 150)May include surrounding context.

python
# 列出模型
    if args.list_models:
        print("已下载的模型:")
        subprocess.run(["ollama", "list"])
        return
    
    # 启动 Ollama

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/launch_compressed.py (reported line 181)May include surrounding context.

python
else:
        # 直接运行（单次查询）
        try:
            result = subprocess.run(cmd, timeout=120)
            sys.exit(result.returncode)
        except Exception as e:
            print(f"运行出错: {e}")

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This finding describes the same unsafe behavior in the file-loading path: the method appears to load compressed numeric data, but it enables pickle-capable deserialization. That mismatch is dangerous because callers may reasonably assume the routine is safe for ordinary data files when it can actually deserialize attacker-controlled objects.

Content

No source excerpt is available for this finding.

Insecure deserialization: numpy.load(allow_pickle=True)

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The loader calls numpy.load with allow_pickle=True on a user-supplied filepath, which permits deserialization of pickled object arrays. If an attacker can supply or replace the .npz/.npy file, loading it may execute arbitrary code during deserialization, making this a genuine insecure deserialization issue.

Content

Scanner excerpt · scripts/lowrank_compress.py (reported line 100)May include surrounding context.

python
def load_compressed(self, filepath: str):
        """从文件加载压缩数据"""
        data = np.load(filepath, allow_pickle=True)
        self.U = data["U"]
        self.S = data["S"]
        self.Vt = data["Vt"]

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown states that the skill can '一键启动压缩模式' by changing Ollama startup parameters, but it does not warn the user about possible configuration impact or that local runtime behavior may be altered. For a markdown file, configuration-affecting behavior should be disclosed when it could affect system integrity or runtime setup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This is a natural-language policy issue because the file forces a specific language for its title and description, and the same pattern continues in user-visible strings throughout the script. There is no indication that the tool is region-specific or that users can opt into another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file’s user-facing description and instructional text are written entirely in Chinese, and the script’s visible CLI/demo output and error guidance continue that assumption. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific; this file does neither.

Content

No source excerpt is available for this finding.