ClawHub
Back to skill

Security audit

一个万无一失的EPUB繁简转换技能，可以将繁体中文电子书转换为简体中文，或反向转换。

Security checks for vulnerabilities and agentic risk

Overview

This EPUB Chinese-conversion skill is mostly coherent, but it automatically installs unpinned Python packages into a persistent local environment and includes guidance to remove DRM before conversion.

Review this before installing. Use it only for EPUB files you are authorized to convert, keep originals backed up, and avoid following the DRM-removal guidance. Prefer installing dependencies yourself from pinned, trusted versions or running the tool in an isolated environment, because the skill's first run may fetch and reuse unpinned Python packages under your home directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/convert_epub.py:37
Finding

Automatic Installation of Unpinned Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: scripts/convert_epub.py:37-38
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

python
# Install dependencies
pip_path = venv_path / "bin" / "pip"
subprocess.run(
    [str(pip_path), "install", "ebooklib", "opencc-python-reimplemented"],
    check=True
)

Technical Analysis

When required modules are unavailable, the script automatically invokes pip to install ebooklib and opencc-python-reimplemented. Neither package is pinned to a reviewed version, and no lockfile, package hashes, trusted index restriction, or integrity verification is used.

Consequently, the code installed during each initial setup depends on the mutable state of the configured Python package index and its transitive dependency graph. The virtual environment is retained at ~/.openclaw/epub_venv, and its site-packages directory is subsequently inserted at the beginning of sys.path. Installed package code is therefore imported and executed with the privileges of the user running the converter.

The same unpinned installation command is also recommended in SKILL.md:78 and README.md:81, reinforcing the unsafe installation practice.

Attack Path

  1. An attacker compromises a direct dependency, one of its transitive dependencies, or the package index configured in the execution environment.
  2. A user runs the EPUB converter on a system where the required modules or virtual environment are absent.
  3. check_dependencies() creates or reuses ~/.openclaw/epub_venv.
  4. The script invokes pip install without version or hash constraints.
  5. pip resolves and installs the attacker-controlled package release.
  6. The installed package is imported by the converter, causing attacker-controlled Python initialization code to execute.
  7. The compromised package remains in the persistent virtual environment and can execute again during subsequent conversions.

...[truncated 714 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic dependency installation from the normal EPUB conversion path. Provide a separate, explicit installation step requiring user approval.
  2. Pin all direct and transitive dependencies to reviewed versions in a lockfile.
  3. Record and verify package hashes, and install with pip install --require-hashes.
  4. Configure an explicitly trusted package index rather than relying on ambient user or system pip configuration.
  5. Build and distribute a reviewed environment or reproducible package artifact where practical.
  6. Before reusing ~/.openclaw/epub_venv, verify that the directory and its contents are owned by the expected user and are not writable by untrusted principals.
  7. Do not prepend an unverified environment to sys.path; validate the environment before importing from it.
  8. Update SKILL.md and README.md so their manual installation instructions use the same pinned, hash-verified dependency set.
  9. Periodically review dependency advisories and regenerate the lockfile through a controlled update process.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file presents all user-facing instructions, examples, and guidance exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Ssd 2

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The examples explicitly advise users to remove DRM with third-party tools as a prerequisite for conversion. Even though framed as troubleshooting, this normalizes bypassing access controls and can facilitate copyright circumvention or unsafe acquisition/use of DRM-stripping tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. The natural-language example instructs the user to interact in Chinese and the document does not indicate that other languages are supported or that the Chinese-only interaction is an intentional, justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README presents the skill as an EPUB Chinese converter specifically for Traditional/Simplified Chinese, and the example invocations direct conversion into a fixed Chinese variant. Because the policy applies to natural-language constraints in all file types, this can be a locale/language restriction unless it is explicitly framed as an opt-in, region-specific tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger keyword "EPUB转换" is broad enough to match requests unrelated to Chinese script conversion, which can cause the skill to activate unexpectedly on generic EPUB-processing tasks. In an agent environment, unintended activation can lead to unnecessary file handling, dependency installation, or execution of conversion logic on user content without clear intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description and all user-facing messages are written only in Chinese, and the tool is explicitly scoped to Chinese script conversion without offering any language or locale choice for interaction. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The tool's purpose is EPUB text conversion, but it silently adds package installation capability by creating a venv and invoking pip. That mismatch makes the skill more dangerous in context because users may not expect network access, dependency resolution, or code execution from third-party packages when running a local document converter.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/convert_epub.py (reported line 34)May include surrounding context.

python
# 创建虚拟环境
        if not venv_path.exists():
            print(f"创建虚拟环境: {venv_path}")
            subprocess.run([sys.executable, "-m", "venv", str(venv_path)], check=True)
        
        # 安装依赖
        pip_path = venv_path / "bin" / "pip"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

The script invokes pip automatically at runtime, which introduces package installation and network-fetch behavior into a file conversion utility. This expands the trust boundary significantly: if package indexes, dependency resolution, or the local pip configuration are compromised, the tool may execute untrusted code during installation.

Content

Scanner excerpt · scripts/convert_epub.py (reported line 38)May include surrounding context.

python
# 安装依赖
        pip_path = venv_path / "bin" / "pip"
        subprocess.run([str(pip_path), "install", "ebooklib", "opencc-python-reimplemented"], check=True)
        
        print("✅ 依赖安装完成")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's comments and user-visible messages are written in Chinese throughout, which imposes a specific language on users without offering a choice or documenting a justified locale constraint. This can violate language or locale policy when the skill is expected to support broader audiences or provide opt-in language selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This is a markdown file, so SQP-2 applies to missing warnings in the skill description. The document notes that first run will create a virtual environment and install dependencies, but presents the immediate-use command before clearly warning the user about those system-changing actions; a clearer upfront disclosure would better inform users about filesystem and package changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file explains that the skill reads EPUBs, converts all text and metadata, repairs structure, and saves a new EPUB, but it does not include any user-facing warning about the effects on book content/metadata or the need to verify the output before replacing originals. For markdown files, user-impacting file modifications should be disclosed when they may affect user data or document integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

SQP-3 applies to all file types and covers language/locale policy issues in natural-language content. The document consistently forces Chinese-language presentation and examples, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This shell script automatically runs chmod +x scripts/convert_epub.py, which changes the filesystem state. Although it logs the action at runtime, there is no upfront warning or comment near the script header explaining that the test will modify file permissions, so users may not expect the side effect before execution.

Content

No source excerpt is available for this finding.