CivilLabClaw AI

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:07 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a civil-engineering AI helper that processes user-provided images and sensor data and writes analysis outputs, with no evidence of hidden theft, destruction, or deceptive behavior.

Install only in a controlled Python environment, use trusted input files and telemetry sources, and avoid uploading confidential infrastructure data unless you are comfortable with local analysis outputs being written to the configured output directory. Pin or lock dependencies before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill clearly describes writing outputs to disk via configurable output directories and explicit result files, yet it declares no permissions. That mismatch can bypass user/operator expectations and weaken sandbox or consent controls, especially because uploaded data, reports, and model artifacts may be persisted automatically.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The invocation examples include broad natural-language activation phrases such as '帮我分析这张裂缝图片' and '激活 CivilLabClaw-AI 技能', which can match ordinary user conversation rather than an explicit, tightly scoped command. In an agent environment, overly permissive triggers can cause unintended skill execution on user-provided files or data, increasing the chance of unsafe actions or privacy-impacting processing without clear consent.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README states that the skill will process structural images, videos, and sensor data and automatically generate output files, but it does not disclose privacy implications, local file writes, retention, or possible effects on sensitive engineering datasets. In a civil/monitoring context, these inputs may contain confidential infrastructure information or experiment data, so lack of transparency can lead to unsafe handling and unintentional disclosure.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The natural-language activation phrases are broad enough that ordinary conversation like '分析监测数据' or '帮我建立数字孪生模型' could unintentionally trigger the skill. Accidental invocation can cause unexpected processing of sensitive files or sensor data and may chain into file writes or network-connected workflows without clear user intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The summary table includes generic module triggers such as '损伤识别', '裂缝检测', '数字孪生', and '传感器数据', which are common domain terms rather than unambiguous activation commands. In a technical assistant used for civil engineering tasks, this makes unintended activation more likely because these phrases naturally appear in normal user requests and discussion.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents persistent output directories and named result files for predictions, detections, processed data, and reports, but does not warn users that uploaded images, sensor data, and derived artifacts may be stored on disk. This creates a privacy and data-governance risk, especially in research or infrastructure contexts where files may contain sensitive operational or proprietary information.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill supports real-time sensor ingestion over OPC UA, MQTT, and HTTP but provides no warning about confidentiality, integrity, authentication, or trust boundaries for network data sources. In this context, untrusted or tampered telemetry could mislead analyses and health assessments, and unsecured transport may expose sensitive monitoring data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
# 核心科学计算
# ============================================
numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0

• Confidence: 95% confidence
• Finding: Using a lower-bound specifier like `numpy>=1.21.0` allows installation of a wide range of versions, reducing build reproducibility and increasing supply-chain risk if a later incompatible or vulnerable release is resolved. In ML/scientific stacks, this can also cause silent breakage due to binary/API changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心科学计算
# ============================================
numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0

# ============================================

• Confidence: 95% confidence
• Finding: Using `pandas>=1.3.0` leaves dependency resolution open-ended, which can pull in unreviewed releases and undermine reproducibility. This increases the chance of introducing vulnerable or behavior-changing versions into deployments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0

# ============================================
# 机器学习

• Confidence: 95% confidence
• Finding: An unbounded `scipy>=1.7.0` requirement permits future versions without review, creating supply-chain and compatibility risk. Scientific packages often have compiled components, making uncontrolled upgrades especially risky in production or research pipelines.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
# 机器学习
# ============================================
scikit-learn>=1.0.0
xgboost>=1.5.0
lightgbm>=3.3.0
gpytorch>=1.8.0

• Confidence: 95% confidence
• Finding: `scikit-learn>=1.0.0` is not reproducible and may resolve to versions with security defects or breaking changes. For ML workflows that may process untrusted models or datasets, unreviewed upgrades expand exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 机器学习
# ============================================
scikit-learn>=1.0.0
xgboost>=1.5.0
lightgbm>=3.3.0
gpytorch>=1.8.0
# 可选：贝叶斯优化

• Confidence: 94% confidence
• Finding: `xgboost>=1.5.0` allows arbitrary newer versions to be installed, increasing the risk of pulling in vulnerable or unstable releases. This weakens software supply-chain control and environment reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
scikit-learn>=1.0.0
xgboost>=1.5.0
lightgbm>=3.3.0
gpytorch>=1.8.0
# 可选：贝叶斯优化
optuna>=3.0.0

• Confidence: 95% confidence
• Finding: `lightgbm>=3.3.0` leaves the package version open-ended, which can result in installing a release with known vulnerabilities or unexpected behavior changes. In an AI skill, that makes deployments less predictable and harder to secure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

scikit-learn>=1.0.0
xgboost>=1.5.0
lightgbm>=3.3.0
gpytorch>=1.8.0
# 可选：贝叶斯优化
optuna>=3.0.0

• Confidence: 93% confidence
• Finding: `gpytorch>=1.8.0` is unpinned, so builds may drift over time and introduce unreviewed code into the environment. This is primarily a supply-chain hygiene weakness rather than an immediate exploit by itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

lightgbm>=3.3.0
gpytorch>=1.8.0
# 可选：贝叶斯优化
optuna>=3.0.0

# ============================================
# 深度学习

• Confidence: 93% confidence
• Finding: `optuna>=3.0.0` permits future versions without review, increasing the chance of vulnerable or incompatible dependencies entering the environment. This undermines reproducibility and complicates incident response.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
# 深度学习
# ============================================
torch>=1.10.0
torchvision>=0.11.0
# 可选：TensorFlow 后端
# tensorflow>=2.8.0

• Confidence: 96% confidence
• Finding: `torch>=1.10.0` is especially risky because PyTorch is a large, security-sensitive package frequently used with model loading and native extensions. Unbounded upgrades can introduce severe vulnerabilities or binary incompatibilities into AI workflows.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 深度学习
# ============================================
torch>=1.10.0
torchvision>=0.11.0
# 可选：TensorFlow 后端
# tensorflow>=2.8.0

• Confidence: 94% confidence
• Finding: `torchvision>=0.11.0` is unpinned and may resolve to versions incompatible with the selected PyTorch build or containing unreviewed code. In vision pipelines, this can affect both stability and security posture.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
# 计算机视觉
# ============================================
opencv-python>=4.5.0
opencv-contrib-python>=4.5.0
pillow>=9.0.0
# 可选：图像增强

• Confidence: 95% confidence
• Finding: `opencv-python>=4.5.0` allows uncontrolled upgrades of a complex native image-processing library. Since OpenCV often parses untrusted media files, unreviewed versions can materially increase exposure to memory-safety issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 计算机视觉
# ============================================
opencv-python>=4.5.0
opencv-contrib-python>=4.5.0
pillow>=9.0.0
# 可选：图像增强
albumentations>=1.0.0

• Confidence: 95% confidence
• Finding: `opencv-contrib-python>=4.5.0` expands the attack surface further because contrib modules add more native parsing and processing code. An open-ended range increases the risk of pulling in vulnerable builds.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
opencv-python>=4.5.0
opencv-contrib-python>=4.5.0
pillow>=9.0.0
# 可选：图像增强
albumentations>=1.0.0

• Confidence: 95% confidence
• Finding: `pillow>=9.0.0` leaves image parsing functionality open to future unreviewed releases. Because Pillow often handles untrusted image content, dependency drift can expose the environment to decoder vulnerabilities.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

opencv-contrib-python>=4.5.0
pillow>=9.0.0
# 可选：图像增强
albumentations>=1.0.0

# ============================================
# 信号处理

• Confidence: 93% confidence
• Finding: `albumentations>=1.0.0` is unpinned, weakening reproducibility and supply-chain control. While not always directly exposed to attackers, unreviewed upgrades can still introduce vulnerable code or incompatible behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
# 可视化
# ============================================
matplotlib>=3.5.0
plotly>=5.5.0
seaborn>=0.11.0

• Confidence: 92% confidence
• Finding: `matplotlib>=3.5.0` is unpinned, which affects deterministic builds and may introduce unreviewed changes. The security impact is usually lower than parser-heavy libraries, but the supply-chain concern remains valid.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 可视化
# ============================================
matplotlib>=3.5.0
plotly>=5.5.0
seaborn>=0.11.0

# ============================================

• Confidence: 92% confidence
• Finding: `plotly>=5.5.0` allows future releases without review, reducing reproducibility and potentially introducing vulnerable code paths. The primary issue is dependency governance rather than a guaranteed exploit.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
matplotlib>=3.5.0
plotly>=5.5.0
seaborn>=0.11.0

# ============================================
# 数据格式

• Confidence: 92% confidence
• Finding: `seaborn>=0.11.0` is open-ended and can lead to environment drift over time. This is a low-severity supply-chain hygiene weakness rather than a direct exploit vector.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# ============================================
# 数据格式
# ============================================
h5py>=3.6.0
hdf5storage>=0.1.18
openpyxl>=3.0.0  # Excel 读写

• Confidence: 94% confidence
• Finding: `h5py>=3.6.0` is unpinned even though HDF5-related libraries often parse complex binary formats. Open-ended dependency resolution can introduce vulnerable or incompatible builds into data-processing pipelines.

Static analysis

No suspicious patterns detected.