ClawHub
Back to skill

Security audit

Matlab Bridge

Security checks for vulnerabilities and agentic risk

Overview

This MATLAB bridge does what it says, but it gives broad local code-execution and file-write power without enough scoping or guardrails.

Install only if you trust the users and inputs that will reach this skill. Run it in a low-privilege environment with a dedicated input/output directory, avoid passing untrusted file names, labels, template parameters, or script arguments, and review generated .mat, JSON, CSV, and plot outputs because sensitive workspace data may be saved by default.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
matlab_bridge.py:233
Finding

MATLAB Command Injection Through Unescaped Script Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
templates.py:154
Finding

MATLAB Code Injection Through Unsanitized Template Parameters

Content
View full analysis
%s\\n', filename, output_name); end disp('Batch processing complete'); """ return code.strip() ``` The same unsafe pattern is also used by other methods in `templates.py`, including direct interpolation into constructs such as: ```python title('{title}'); ``` ```python if strcmp('{ftype}', 'low') ``` ```python plot({t}, {y}, 'LineWidth', 1.2); ``` ### Technical Analysis The template library inserts caller-provided parameters directly into executable MATLAB source. It does not distinguish between trusted MATLAB expressions and ordinary data. In `batch_process_csv`: - `file_pattern` is inserted inside a quoted MATLAB character vector without escaping single quotes. - `operation` is inserted into comments and variable identifiers without identifier validation. - The resulting string is intended to be passed to the arbitrary MATLAB execution interface. Other templates apply the same pattern to titles, labels, signal names, sampling parameters, plotting expressions, and filter types. String parameters can terminate quoted MATLAB values, while expression or identifier parameters can introduce additional syntax directly. This is distinct from the intentionally ...[truncated 1991 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises direct MATLAB code execution, running .m scripts, file I/O, and command-line invocation, yet it declares no explicit tool scope or permission boundaries. That creates an unsafe mismatch between documented capabilities and governance, increasing the chance the agent can read, write, or execute beyond user expectations, especially because MATLAB execution can trigger arbitrary file access and shell-like side effects through the host environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill states that charts and data are automatically saved to a default local directory, but it does not prominently warn that invoking the skill causes filesystem writes. This can surprise users, overwrite prior results, leak sensitive processed data to disk, or leave artifacts on shared machines, which is especially relevant for research and engineering datasets.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · STATUS.md (reported line 7)May include surrounding context.

md
| 文件 | 路径 | 说明 |
|------|------|------|
| 技能文档 | `skills/matlab-bridge/SKILL.md` | 完整使用说明 |
| 主脚本 | `skills/matlab-bridge/matlab_bridge.py` | MATLAB桥接核心类 |
| 模板库 | `skills/matlab-bridge/templates.py` | 常用MATLAB代码模板 |
| 快速执行 | `skills/matlab-bridge/matlab_quick.py` | 命令行快速调用 |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example trigger phrases are very broad and read like natural requests to the agent, without clear activation boundaries or confirmation requirements. In a skill that can execute MATLAB code and scripts, this increases the chance of unintended invocation or prompt-based routing into code execution workflows from ordinary user phrasing.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · matlab_bridge.py (reported line 78)May include surrounding context.

python
"""检查MATLAB是否可用"""
        try:
            cmd = [self.matlab_path, '-batch', "disp('OK')"]
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
            return 'OK' in result.stdout or result.returncode == 0
        except:
            return False

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is explicitly designed to execute arbitrary MATLAB code provided by the caller, but it does so without any safety interlocks, trust checks, or user-facing warning about the consequences. In this context, the danger is elevated because MATLAB is a powerful execution environment that can read/write files, invoke system commands, process sensitive data, and create persistent artifacts on the host.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

This call launches MATLAB to execute code derived from untrusted input via execute(code: str), which writes attacker-supplied MATLAB code into a temporary .m file and runs it. In skill context, this is the core feature, but it still enables arbitrary code execution inside the MATLAB environment, including filesystem access, external command execution, network operations, and abuse of licensed local resources.

Content

Scanner excerpt · matlab_bridge.py (reported line 121)May include surrounding context.

python
f"cd('{temp_dir}'); {temp_name}"
            ]
            
            result = subprocess.run(
                cmd, 
                capture_output=capture_output, 
                text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The bridge persists result JSON and, by default, the entire MATLAB workspace to disk in a shared output directory without clear disclosure or retention controls. This can unintentionally store sensitive input data, derived results, credentials loaded into the workspace, or proprietary models, increasing the risk of data leakage and cross-run exposure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

This subprocess call runs MATLAB with a command string assembled from script_path and args, both of which may be user-controlled. Although Python is not invoking a shell, the MATLAB -batch command string can still be syntactically broken or extended through unsafely embedded values, especially string arguments and directory/script names containing quotes, enabling arbitrary MATLAB command injection and execution.

Content

Scanner excerpt · matlab_bridge.py (reported line 270)May include surrounding context.

python
]
        
        try:
            result = subprocess.run(
                full_cmd,
                capture_output=True,
                text=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file's natural-language title, comments, and docstrings are presented exclusively in Chinese, indicating a fixed language/locale choice. There is no indication that users can opt into another language or that the locale restriction is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains natural-language descriptions, prompts, and help text in Chinese, beginning with the module docstring and continuing throughout user-facing output. Because the skill forces a specific language without user opt-in or a documented justification that it is region-specific, it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_matlab.py (reported line 26)May include surrounding context.

python
# 尝试执行 matlab 命令
    try:
        result = subprocess.run(
            ["matlab", "-batch", "disp('MATLAB_IS_AVAILABLE')"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_matlab.py (reported line 37)May include surrounding context.

python
print("   状态: ✓ MATLAB 命令可用")
            
            # 获取版本信息
            version_result = subprocess.run(
                ["matlab", "-batch", "disp(version)"],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_matlab.py (reported line 70)May include surrounding context.

python
print(f"\n2. 许可证检查")
    
    try:
        result = subprocess.run(
            ["matlab", "-batch", "license('test', 'MATLAB')"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_matlab.py (reported line 102)May include surrounding context.

python
"""
    
    try:
        result = subprocess.run(
            ["matlab", "-batch", test_code],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_matlab.py (reported line 203)May include surrounding context.

python
"""
    
    try:
        result = subprocess.run(
            ["matlab", "-batch", test_code],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_matlab.py (reported line 148)May include surrounding context.

python
"""
    
    try:
        result = subprocess.run(
            ["matlab", "-batch", test_code],
            capture_output=True,
            text=True,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The markdown explicitly states that all generated charts and data are saved under D:\Personal\OpenClaw\matlab-outputs\, including images, .mat files, and JSON results. This is a user-data and filesystem-impacting behavior, but the README does not include any caution or disclosure about automatic file creation, persistence, or potential overwriting/accumulation of outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description text is entirely in Chinese and does not indicate that other languages are supported or that Chinese is a justified region-specific requirement. Per the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

All user-facing instructions and invocation examples in this file are presented only in Chinese, including the directive for how to address the system. That can constitute a language/locale policy issue when no user opt-in or alternative language choice is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

Natural-language strings throughout the file, including the module description and CLI help, are presented in Chinese only. This imposes a specific language on users without opt-in or explanation, which fits the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

This Python skill presents its description, usage instructions, and runtime status messages entirely in Chinese, with no indication that the user can choose another language. That creates a natural-language locale policy issue because the skill imposes a specific language experience without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script writes a generated plot to a fixed absolute path on the local filesystem, which can create unintended side effects outside the immediate test context. Hardcoded output locations may overwrite existing files, leak artifacts into sensitive directories, or fail unpredictably across environments, especially when the skill is run with elevated privileges or on multi-user systems.

Content

No source excerpt is available for this finding.