Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious with medium confidence, citing report-generation security weaknesses and concerns about automatic dependency installation and credential handling; parts of the scan were incomplete.
Consider the suspicious verdict before installing. Review the report-generation findings and how the skill installs dependencies and handles access keys; the scanners do not establish that these issues have been exploited. Coverage was partial: 16 of 42 components were scanned, and some checks on bundled JavaScript and the report template could not fully evaluate obfuscated text or expressions beyond parser limits, so the evidence is incomplete.
scripts/merge_report_generator.pyCloud inspection text can escape the HTML report's JSON script element
Injected JavaScript can alter the displayed inspection results and read report data available in the document. Where browser networking permits, it can transmit that data externally. This does not establish arbitrary local-file access or host code execution.
scripts/merge_report_generator.pyCloud-supplied descriptions are written as executable Excel formulas
An attacker can supply a formula that falsifies the displayed judgment standard or presents an attacker-selected hyperlink. Spreadsheet applications supporting external-data formulas may also issue attacker-directed requests if their external-content policies allow them. No automatic shell execution is established.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
1. Group Config records by check_item_id (the policy_assignment_id).
2. Mark a rule as non-compliant when any of its records carries the risk
status, compliant otherwise.
3. Return rule totals: total_rules / compliant_rules /
non_compliant_rules.
Args:
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow directs the agent to install missing packages without first disclosing the environment change or requiring an isolated environment. An inspection request can consequently modify a shared Python installation and introduce package installation code into an environment with access to cloud credentials.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
continues to Step 5, and `--secmaster-file` is passed only when the exit code is `0`.
- [ ] **Step 5 (Convert raw results)**: invokes `merge_inspection_results.py` with
`--oa-file` / `--config-file` / `--secmaster-file` derived from Steps 2-4 outputs,
without asking for confirmation; a source that produced no artifact is omitted and the
merge records it as `missing` in `meta.sources`. `--secmaster-file` is also omitted
when Step 4 exited non-zero, so absent or incomplete SecMaster data is never recorded
as `ok`. On scoped runs it receives the same `--cloud-services` value as Step 2 and is
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
counted in `meta.cloud_service_filter`, `meta.counts` stays equal to the length of
`results`, and a scope matching no record exits non-zero without writing a file.
- [ ] **Step 6 (Generate report)**: invokes `merge_report_generator.py` with `--input`
pointing to the Step 5 output, without asking for confirmation; produces both HTML and
XLSX reports. On scoped runs it additionally writes
`merge_inspection_report_<ts>_risk_items.json` next to them and logs its absolute path;
on full-tenant runs that file is absent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
a statement for services that matched no record, the wording "已匹配 N 条检查记录，未发现
风险项" when `totals.items` is 0 but `totals.records` is not, and one line for the
records excluded as unclassified. Full-tenant runs present no such table.
- [ ] **No confirmation prompts**: Steps 5, 6, 7 and 8 must not ask the user for parameters
or confirmation; each script command line is printed before execution without
blocking. Steps 2 and 3 run with the script default options and may ask about script
parameters, but never about the region.
The example encourages users to place real AK/SK credentials directly in command-line arguments, which can expose them through shell history, process inspection, or captured execution logs. These credentials authorize cloud access, so disclosure could compromise tenant resources depending on their IAM privileges.
The module documentation (L15-L28), loader docstring (L215-L216), and warning (L239-L240) explicitly promise that a missing alias table preserves literal-code matching. However, L238-L243 return an empty map, and the resolver at L133-L136 has no literal fallback; consequently, classification marks all requested services unsupported and parsing raises an error at L392-L396, preventing the documented degraded inspection.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# 'hcloud version ...'
"""
try:
result = subprocess.run(
command,
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""
command = ["hcloud", IAM_SERVICE, AUTH_DOMAINS_API, f"--cli-region={cli_region}"]
try:
result = subprocess.run(
command,
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
command = ["hcloud"] + cmd_args
LOGGER.debug("Executing: %s", " ".join(command))
try:
completed = subprocess.run(
command,
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
rate_limiter.acquire()
cmd = ["hcloud"] + args
try:
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
except FileNotFoundError as exc:
raise RuntimeError(
"hcloud command not found. Make sure the hcloud CLI is installed and "
The template declares zh-CN and hardcodes Chinese report headings, controls, and status messages throughout the generated output. No language selection, user opt-in, or documented justification for requiring this locale is provided in this source.
L165 requires the agent to use the exact Chinese phrase "已匹配 N 条检查记录，未发现风险项" for a scoped result, regardless of the user's language. L147 similarly mandates the Chinese status label "无数据"; neither requirement offers language opt-in or provides a locale-specific justification.
L081 requires absent sources to be labeled "无数据", and L087–L088 require a Chinese sentence for matched records with no risks. These are explicit output-language requirements without user opt-in or a documented justification for requiring Chinese.
The verification criteria require the Chinese text “无数据” and “已匹配 N 条检查记录，未发现风险项” in user-facing summaries. No language choice or justification for requiring Chinese output is provided; the cloud-region constraints do not establish an output-language requirement.
The logger comment specifies that console output is uniformly in English, establishing a fixed language for user-facing progress, warnings, and errors. No language opt-in or justification for this restriction is provided.