ClawHub
Back to skill

Security audit

企业别名生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill can process Excel company lists, but it also sends company names to Baidu by default despite documentation saying network lookup is disabled.

Review this carefully before installing. Do not use it on confidential company lists unless network access is disabled or removed, the hard-coded private fallback path is removed, and the external generate_alias dependency is bundled or pinned to reviewed code.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

other

Error
Location
scripts/process_aliases_final.py:86
Finding

Undisclosed Default Transmission of Workbook Company Names to Baidu

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/process_aliases_final.py:17
Finding

Execution of an Unpackaged Module from a Hard-Coded External Directory

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/process_aliases_final.py:561
Finding

Implicit Access to a Hard-Coded Private DingTalk Inbound File

Content
View full analysis
1 else '/home/admin/.openclaw/media/dingtalk/inbound/2026-03-24/dingtalk-file-1774338167380-oyaye2.xlsx' output_file = sys.argv[2] if len(sys.argv) > 2 else None process_excel(input_file, output_file) ``` ### Technical Analysis The documented interface expects the user to supply an input workbook. However, if the script is invoked without an argument, it silently selects a specific workbook from a private DingTalk inbound directory. This violates least-privilege and explicit-input principles. A user may reasonably expect a usage error when no input is supplied, but the script instead accesses and processes an unrelated environment-specific file. The file contents may subsequently enter the default external network lookup flow described in the first finding. The path also exposes internal environment details, including the account name, messaging platform, directory layout, date, and uploaded-file identifier. ### Attack Path 1. A user, scheduler, wrapper, or agent invokes the script without a positional input argument. 2. Instead of terminating with a usage message, the script opens the hard-coded DingTalk inbound workbook. 3. Company names are read from that workbook and aliases are generated. 4. Qualifying company names may be sent to Baidu by the default lookup logic. 5. A derived output workbook is saved alongside the private input file unless a different output path is supplied. ### Impact Assessment The issue allows the script to access and process one specific file available to the invoking account without explicit selection during that invocation. It does not bypass operating-system permissions and does not independent ...[truncated 302 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:186
Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file's comments and progress messages describe processing that includes '网络查询' and imply the generated aliases include that enrichment. However, ws.cell(..., value='|'.join(final_aliases)) is executed before the subsequent web-query block mutates final_aliases, so the enriched alias is printed to console but never persisted to the workbook.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documentation advertises direct shell execution via python3 scripts/process_aliases_final.py ... and declares runtime requirements, but it does not define any explicit tool scope such as allowed tools or permissions. In an agent ecosystem, this can lead to broader-than-necessary execution capability, making accidental or unsafe command execution easier if the skill is invoked with untrusted inputs or later extended with additional shell behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file presents the skill description, usage, warnings, and FAQ only in Chinese, which effectively forces a specific language on users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified as region-specific, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description is written entirely in Chinese and presents the skill as a Chinese-language capability without any indication that users can choose another language or that the skill is intentionally limited to a Chinese-only context. This can violate language/locale policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function sends company names from the input file to Baidu without any consent, warning, or policy gate. In the context of enterprise data matching and normalization, company lists may be sensitive or proprietary, so silent transmission to a third party is a genuine privacy and data-governance risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

The code invokes curl via subprocess to perform live web requests using company names derived from the input spreadsheet. Although it does not use shell=True, it still creates an external data egress path and expands the attack surface through dependency on an external binary and remote content.

Content

Scanner excerpt · scripts/process_aliases_final.py (reported line 90)May include surrounding context.

python
try:
        # 使用百度搜索查询企业简称
        search_query = f"{company_name} 简称"
        result = subprocess.run(
            ['curl', '-s', '-A', 'Mozilla/5.0', '-L',
             f'https://www.baidu.com/s?wd={search_query}'],
            capture_output=True, text=True, timeout=10

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill advertises network querying as optional, but the implementation performs live lookups automatically for many non-listed companies when alias coverage is low. This can leak workbook contents to Baidu unexpectedly and violates least surprise for a data-processing skill that primarily appears local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The module docstring and user-facing messages are entirely in Chinese, which effectively fixes the interaction/documentation language without offering an opt-in or alternative. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy issue unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.