ClawHub
Back to skill

Security audit

AIOS Chart Image

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to render chart images, but its file path handling can exceed the workspace boundaries it promises to enforce.

Review before installing. The skill has a legitimate chart-rendering purpose, but it should reject symlinked paths, enforce the documented upload/download/generated input allowlist, keep outputs inside generated using canonical path checks, and update the flagged sharp dependency before use in a shared or multi-sender environment.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/make_chart_image.mjs:199
Finding

Symbolic Links Bypass Sender Filesystem Isolation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/make_chart_image.mjs:223
Finding

Input Validation Does Not Enforce the Documented Directory Allowlist

Content
View full analysis
` directory's `upload`, `download`, or `generated`, or be provided through stdin / `--data`; reading other `senderId` directories is prohibited. ``` The implementation only checks whether the path is somewhere beneath the sender root: ```js function resolveInputFilePath(rawInput, context) { const candidate = path.isAbsolute(rawInput) ? path.resolve(rawInput) : path.resolve(context.workspace, rawInput); return assertPathInside(context.senderRoot, candidate, "--input"); } ``` ### Technical Analysis The authorization boundary implemented by `resolveInputFilePath()` is broader than the boundary defined in `SKILL.md`. Any path beneath `context.senderRoot` is accepted, even when it is outside the permitted `upload`, `download`, and `generated` subdirectories. This is an access-control weakness because files placed in other sender subdirectories may have been intentionally excluded from processing by this Skill. The code validates sender-level containment but does not validate membership in the explicit directory allowlist. This issue is independent of the symbolic-link vulnerability: even a normal, non-symbolic path beneath an unapproved sender subdirectory is accepted. ### Attack Path 1. A sensitive or internal JSON or Markdown file exists beneath the current sender directory but outside `upload`, `download`, and `generated`, for example `/private/internal.json`. 2. The attacker invokes the script with: `--input /private/internal.json` 3. `resolveInputFilePath()` resolves the path beneath `senderRoot`. 4. `assertPathInside()` accepts the path because it does ...[truncated 861 chars]
Remediation
View remediation
/upload` - `/download` - `/generated` 2. Resolve the requested input path and require it to be contained within at least one of those roots. 3. Combine the allowlist validation with canonical-path and symbolic-link protections; lexical containment alone is insufficient. 4. Reject the sender root itself and all non-allowlisted sender subdirectories. 5. Keep stdin and `--data` as separate input modes that do not require file-path authorization. 6. Return a clear error identifying the permitted input directories without disclosing unrelated filesystem paths. 7. Add tests confirming rejection of files under paths such as `/private`, `/config`, and the sender root itself. ]]>

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
本技能用于把结构化数据生成 ECharts 图表，并导出为图片文件。优先使用内置脚本 `scripts/make_chart_image.mjs`，不要在对话中临时拼一个替代渲染脚本。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
本技能用于把结构化数据生成 ECharts 图表，并导出为图片文件。优先使用内置脚本 `scripts/make_chart_image.mjs`，不要在对话中临时拼一个替代渲染脚本。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
本技能用于把结构化数据生成 ECharts 图表，并导出为图片文件。优先使用内置脚本 `scripts/make_chart_image.mjs`，不要在对话中临时拼一个替代渲染脚本。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
本技能用于把结构化数据生成 ECharts 图表，并导出为图片文件。优先使用内置脚本 `scripts/make_chart_image.mjs`，不要在对话中临时拼一个替代渲染脚本。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
本技能用于把结构化数据生成 ECharts 图表，并导出为图片文件。优先使用内置脚本 `scripts/make_chart_image.mjs`，不要在对话中临时拼一个替代渲染脚本。

Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High
Category
Supply Chain
Confidence
96% confidence
Finding

The lockfile pins sharp to 0.34.5, and the provided advisory metadata indicates known inherited vulnerabilities in bundled/native image-processing components such as libvips and libheif. In this skill’s context, the dependency is directly used to process attacker-controlled chart/image inputs, which makes image parsing a high-risk attack surface and increases the chance of denial of service, memory corruption, or potential native-code exploitation if a crafted file or payload reaches the vulnerable codec path.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High
Category
Supply Chain
Confidence
98% confidence
Finding

The manifest includes sharp 0.34.5, which is flagged as carrying known vulnerabilities through bundled/native image codec libraries such as libvips and libheif. In this skill's context, the package renders and exports chart images, so it likely processes attacker-influenced image content or formats; vulnerable native parsers can enable memory corruption, crashes, or potentially code execution/denial of service when handling crafted inputs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill's natural-language documentation is entirely in Chinese and repeatedly uses mandatory wording, but it does not indicate that language choice is optional or constrained by a justified region-specific requirement. This can violate language/locale policy because it implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enables implicit invocation without defining clear trigger constraints, so an agent may auto-select and run it whenever it loosely matches charting-related content. Because this skill can transform current conversation data into generated files, broad auto-invocation increases the risk of unintended data processing, surprise side effects, or misuse in contexts where explicit user consent or tighter scoping would be safer.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 6)May include surrounding context.

json
"private": true,
  "type": "module",
  "dependencies": {
    "dayjs": "^1.11.21",
    "echarts": "^6.0.0",
    "pino": "^10.3.1",
    "sharp": "^0.34.5"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"type": "module",
  "dependencies": {
    "dayjs": "^1.11.21",
    "echarts": "^6.0.0",
    "pino": "^10.3.1",
    "sharp": "^0.34.5"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"dependencies": {
    "dayjs": "^1.11.21",
    "echarts": "^6.0.0",
    "pino": "^10.3.1",
    "sharp": "^0.34.5"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json
"dayjs": "^1.11.21",
    "echarts": "^6.0.0",
    "pino": "^10.3.1",
    "sharp": "^0.34.5"
  }
}

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script reads AIOS_* environment variables to derive a log directory and then creates/appends daily log files outside the sender-scoped generated output area. For a chart-rendering skill, this expands filesystem write scope beyond the declared purpose and can leak operational metadata or user-controlled error content into shared logs, weakening tenant isolation and least-privilege assumptions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.