OpenCC

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:10 AM UTC
• Version: 1.0.0

Overview

This skill coherently provides Chinese script and regional variant conversion, with only ordinary dependency and file-conversion cautions.

Install this as a focused Chinese script conversion skill. Use it on text or files you explicitly want converted, review regional terminology outputs, and prefer a locked or pinned OpenCC dependency in managed or sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: pyproject.toml:7

Finding

Unpinned Third-Party Dependency Permits Unreviewed Package Updates

Content

View full analysis

Vulnerability Details

File Location: pyproject.toml, lines 7-9
Vulnerability Type: Unpinned third-party dependency and non-reproducible installation
Risk Level: Medium

toml

dependencies = [
    "opencc>=1.2.0",
]

Technical Analysis

The project accepts any available opencc release at version 1.2.0 or later and does not include a reviewed lockfile or package integrity hashes. Consequently, two installations performed at different times may retrieve different third-party code even though the audited project files remain unchanged.

The documentation also recommends commands such as uv sync, uv add opencc, and pip install opencc, which resolve package content from an external package index at installation time. An unexpectedly incompatible or compromised future release satisfying the version constraint could therefore enter the runtime without a corresponding change to this repository.

This is a supply-chain weakness rather than evidence that the currently available OpenCC package is malicious.

Attack Path

1. An attacker compromises the configured package repository, the dependency publisher account, or a future accepted OpenCC release.
2. The attacker publishes a malicious package version satisfying opencc>=1.2.0.
3. A user follows the documented installation process or runs uv sync without a pre-existing, integrity-checked lockfile.
4. The dependency resolver selects and downloads the malicious accepted version.
5. Attacker-controlled code executes during package installation, import, or conversion operations with the privileges of the user or automation environment running the project.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the process installing or running the skill. Depending on the environment, this could expose files, environment variables, credentials, converted input data, and writable project resources ...[truncated 302 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin OpenCC to a specifically reviewed version, for example:

   toml

   dependencies = [
       "opencc==1.2.0",
   ]
   

2. Generate and commit a lockfile that records exact transitive dependency versions and integrity hashes.
3. Require locked, reproducible installation in documentation and CI, such as uv sync --frozen.
4. Replace uv add opencc in end-user installation instructions because it modifies dependency resolution state; direct users to install from the committed lockfile instead.
5. Configure package installation to use a trusted, explicitly selected index and enable hash verification where supported.
6. Review dependency updates before refreshing the lockfile, and use automated dependency scanning and provenance verification in CI.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Possible Typosquatting: 'opencc' resembles popular package 'openai'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that OpenClaw 'recognizes Chinese conversion requests' and 'trigger automatically' without clearly constraining when the skill should run. Overly broad trigger guidance can cause the agent to invoke this skill for loosely related Chinese-language tasks, increasing the chance of unintended file/script execution or inappropriate transformation of user content in automated workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents code and CLI usage that can read from input files and write to output files, but it does not declare any explicit tool scope or permissions boundary. Even though the file operations appear intended for legitimate text conversion, missing scope declarations can lead an agent framework to grant broader file access than necessary or make the skill's capabilities ambiguous during review and enforcement.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: opencc has 1 known advisory(ies) (GHSA-7fqq-q52p-2jjg (OpenCC has an Out-of-bounds read when processing truncated UTF-8 input)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency is specified as opencc>=1.2.0 without an upper bound or exact pin, so the actual installed version cannot be verified from the manifest alone. Because OpenCC has a known advisory for out-of-bounds reads on truncated UTF-8 input, leaving the version unpinned creates supply-chain uncertainty and may allow installation of an affected release depending on resolution time and environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.