ClawHub
Back to skill

Security audit

面试助手

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate interview and resume helper, but it needs review because it can upload sensitive documents and a token to a configurable OCR service and can auto-install packages into the system Python environment.

Install only if you are comfortable with resume or job-description files being sent to PaddleOCR for image/scanned-PDF OCR, and avoid setting PADDLEOCR_SERVER_URL unless you fully trust the destination. Prefer text PDFs, Word, TXT, or pasted text to avoid OCR upload. Run this in an isolated environment because it may install Python packages automatically.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/parse_input.py:53
Finding

Configurable OCR Endpoint Can Receive Sensitive Documents and Access Tokens

Content
View full analysis
str: """调用 PaddleOCR AIStudio API 识别图片文字。""" _require_token("图片 OCR") try: import requests except ImportError: _install("requests") import requests with open(file_path, "rb") as f: b64 = base64.b64encode(f.read()).decode("utf-8") payload = {"file": b64, "fileType": 1} headers = { "Content-Type": "application/json", "Authorization": f"token {TOKEN}", } resp = _post_with_error_handling(requests, payload, headers, timeout=60) return _extract_text_from_response(resp) ``` ```python def _parse_pdf_via_api(file_path: str) -> str: """调用 PaddleOCR PP-StructureV3 API 解析扫描版 PDF。""" _require_token("扫描版 PDF 解析") try: import requests except ImportError: _install("requests") import requests with open(file_path, "rb") as f: b64 = base64.b64encode(f.read()).decode("utf-8") payload = {"file": b64, "fileType": 0} headers = { "Content-Type": "application/json", "Authorization": f"token {TOKEN}", } resp = _post_with_error_handling(requests, payload, headers, timeout=120) return _extract_text_from_response(resp) ``` ```python resp = requests_mod.post( STRUCT_ENDPOINT, json=payload, headers=headers, timeout=timeout ) resp.raise_for_status() return resp ``` ### Technical Analysis The parser allows `PADDLEOCR_ ...[truncated 2510 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/parse_input.py:68
Finding

Unpinned Dependencies Are Installed Dynamically Into the System Environment

Content
View full analysis
None: """尝试用 uv 安装，不存在时回退到 pip。""" import subprocess print(f"[安装依赖] {pkg} ...", file=sys.stderr) try: subprocess.check_call( ["uv", "pip", "install", pkg, "--system", "-q"], stderr=subprocess.DEVNULL, ) except FileNotFoundError: print("[安装依赖] uv 未找到，改用 pip ...", file=sys.stderr) try: subprocess.check_call( [sys.executable, "-m", "pip", "install", pkg, "-q"], stderr=subprocess.DEVNULL, ) except subprocess.CalledProcessError: raise RuntimeError( f"自动安装 {pkg} 失败，请手动执行：pip install {pkg}" ) ``` The function is invoked for missing dependencies as follows: ```python try: import requests except ImportError: _install("requests") import requests ``` ```python try: import pdfplumber except ImportError: _install("pdfplumber") import pdfplumber ``` ```python try: from docx import Document except ImportError: _install("python-docx") from docx import Document ``` ### Technical Analysis The Skill installs `requests`, `pdfplumber`, and `python-docx` at runtime when imports fail. No package versions or integrity hashes are specified. Package resolution therefore depends on the package index and repository state at the time of execution. The preferred `uv` command uses `--system`, which modifies the shared Python environment rather than an isolated environment. The fallback similarly invokes the active interpreter's `pip`, which may also target a shared environment depending on deployment configuration. Altho ...[truncated 1805 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .env (reported line 2)May include surrounding context.

text
# Interview Coach 配置文件
# 复制此文件为 .env 并填入你的配置
#
# 大多数情况下无需配置，以下情况才需要填写 Token：
#   - 上传图片（JPG / PNG / WEBP）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .env (reported line 10)May include surrounding context.

text
#
# 文本 PDF、Word 文档、TXT 文件无需任何配置，可直接使用。

# 获取 Token：https://aistudio.baidu.com/paddleocr → 右上角 → Access Token
PADDLEOCR_TOKEN=

# 可选：自定义 PaddleOCR 服务地址（默认使用官方地址，一般不需要修改）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 11)May include surrounding context.

python
用法：
  python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 26)May include surrounding context.

python
用法：
  python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 29)May include surrounding context.

python
用法：
  python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 49)May include surrounding context.

python
用法：
  python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 168)May include surrounding context.

python
用法：
  python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 222)May include surrounding context.

python
用法：
  python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

获取 Token：https://aistudio.baidu.com/paddleocr → 右上角 → Access Token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

获取 Token：https://aistudio.baidu.com/paddleocr → 右上角 → Access Token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 12)May include surrounding context.

python
python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

获取 Token：https://aistudio.baidu.com/paddleocr → 右上角 → Access Token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 15)May include surrounding context.

python
python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

获取 Token：https://aistudio.baidu.com/paddleocr → 右上角 → Access Token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 167)May include surrounding context.

python
python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

获取 Token：https://aistudio.baidu.com/paddleocr → 右上角 → Access Token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 221)May include surrounding context.

python
python parse_input.py <文件路径>

环境变量（可在脚本同目录的 .env 文件中配置，也可直接设置系统环境变量）：
  PADDLEOCR_TOKEN       AIStudio Access Token（图片/扫描PDF时必填）
  PADDLEOCR_SERVER_URL  PaddleOCR 服务地址（可选，默认使用官方地址）

获取 Token：https://aistudio.baidu.com/paddleocr → 右上角 → Access Token

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 32)May include surrounding context.

python
# 同时支持 scripts/.env 和上一级目录 .env（兼容不同部署结构）
    script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),
        os.path.join(script_dir, "..", ".env"),
    ]
    for env_path in candidates:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/parse_input.py (reported line 33)May include surrounding context.

python
# 同时支持 scripts/.env 和上一级目录 .env（兼容不同部署结构）
    script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),
        os.path.join(script_dir, "..", ".env"),
    ]
    for env_path in candidates:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes local scripts, may read user-supplied files, uses environment variables, and can reach an external OCR service, but it does not declare any explicit tool or permission scope. That makes the effective capability boundary unclear to the platform and users, increasing the risk of over-broad execution, file access, or network use beyond what is expected for a resume/JD helper.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description contains broad triggers like interview prep, resume revision, and JD-based help that can match common user requests outside a narrowly defined invocation context. This can cause accidental activation and unintended access to sensitive resume, employment, or job-description content when the user did not mean to invoke this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The resume-optimization mode is entered based on ambiguous natural-language phrases without a strict confirmation or state check. In practice, this can misroute user intent and trigger analysis or transformation of sensitive resume content when the user may have wanted generic advice instead.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document is presented entirely in Chinese and gives no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and usage instructions are entirely in Chinese, and later runtime messages also appear only in Chinese. For a general-purpose file parsing script, this imposes a specific language/locale on users without opt-in or justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Auto-installing dependencies at runtime is unsafe in a skill whose purpose is parsing resumes and job descriptions. It introduces external code execution, network dependency, and environment mutation unrelated to the immediate task, increasing supply-chain and operational risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

The script performs runtime package installation by invoking an external package manager. Even though the package name is hardcoded in current call sites, executing package installation during parsing expands the attack surface, permits unreviewed code execution from package indexes, and can modify the host environment unexpectedly.

Content

Scanner excerpt · scripts/parse_input.py (reported line 73)May include surrounding context.

python
import subprocess
    print(f"[安装依赖] {pkg} ...", file=sys.stderr)
    try:
        subprocess.check_call(
            ["uv", "pip", "install", pkg, "--system", "-q"],
            stderr=subprocess.DEVNULL,
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

This fallback path invokes pip from the running interpreter to install packages dynamically. That behavior allows network-retrieved code to be introduced and executed on demand, which is risky for a document parser handling untrusted inputs and is unnecessary for normal parsing operation.

Content

Scanner excerpt · scripts/parse_input.py (reported line 80)May include surrounding context.

python
except FileNotFoundError:
        print("[安装依赖] uv 未找到，改用 pip ...", file=sys.stderr)
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", pkg, "-q"],
                stderr=subprocess.DEVNULL,
            )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction '语言跟随 JD（中文 JD 出中文题）' imposes a language policy based on document language rather than user preference. This can violate locale-choice expectations because the user is not offered an opt-in or override.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.