ClawHub
Back to skill

Security audit

蜀宁 OA 工时管理

Security checks across malware telemetry and agentic risk

Overview

This OA timesheet helper is purpose-aligned, but it can log in with stored credentials and change or delete business records without strong confirmation or secret-handling safeguards.

Install only if you trust the publisher and need an agent to operate your OA account. Use encrypted credentials, protect OA_ENC_KEY and any local key cache, avoid saving printed tokens, verify the base URL, and require explicit confirmation before submit, update, batch, or delete actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

eval() call detected

High
Category
Dangerous Code Execution
Content
if not expr:
            return None
        try:
            return str(int(eval(expr)))
        except Exception:
            pass
        expr = expr.rstrip("+-*/")
Confidence
98% confidence
Finding
return str(int(eval(expr)))

eval() call detected

High
Category
Dangerous Code Execution
Content
pass
        expr = expr.rstrip("+-*/")
        try:
            return str(int(eval(expr)))
        except Exception:
            return None
Confidence
98% confidence
Finding
return str(int(eval(expr)))

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
if _has_modules(candidate, required_modules):
            new_env = os.environ.copy()
            new_env[ENV_GUARD] = "1"
            os.execve(candidate, [candidate, *sys.argv], new_env)

    missing = ", ".join(required_modules)
    raise RuntimeError(
Confidence
79% confidence
Finding
os.execve(candidate, [candidate, *sys.argv], new_env)

Tainted flow: 'key' from os.environ.get (line 47, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
key = f.read().strip()
    if not key:
        raise ValueError(f"找不到解密密钥（环境变量 OA_ENC_KEY 或 {key_file}）")
    result = subprocess.run(
        ["openssl", "aes-256-cbc", "-d", "-a", "-pbkdf2", "-pass", f"pass:{key}", "-in", enc_path],
        capture_output=True,
        timeout=10,
Confidence
84% confidence
Finding
result = subprocess.run( ["openssl", "aes-256-cbc", "-d", "-a", "-pbkdf2", "-pass", f"pass:{key}", "-in", enc_path], capture_output=True, timeout=10, )

Vague Triggers

Medium
Confidence
90% confidence
Finding
The natural-language examples are broad enough that an agent could activate this skill from ordinary conversation such as '今天填了工时' or '查一下今天的工时状态' without a strong confirmation boundary. Because the skill can submit, modify, and delete OA work records, ambiguous triggering can lead to unintended actions against a live enterprise system.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation includes a deletion path ('--delete') but does not present a prominent warning or confirmation requirement about its destructive effect. In an agent setting, this increases the chance of accidental or misunderstood deletion of work records, especially when combined with broad trigger phrasing and hidden internal IDs.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The credential instructions tell users to store account and password data in a local markdown file, with encryption only described as supported rather than required, and without strong handling warnings. This creates a realistic risk of plaintext credential exposure, accidental check-in, improper file permissions, or weak operational practices around enterprise OA access.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation explicitly supports storing account credentials in a plaintext Markdown file, including username, password, and base URL, without a strong warning or secure-default guidance. In an agent/workspace setting, plaintext secrets are easily exposed through accidental commits, logs, backups, other tools reading the workspace, or local compromise, which can lead to unauthorized access to the OA system.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/oa_utils.py:126