ClawHub Retry & Fallback

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:06 AM UTC
• Version: 1.0.1

Overview

The skill mostly fits its retry and fallback purpose, but its audit export behavior, unpinned install dependencies, and unsupported security claims need review before installation.

Install only after reviewing the operational risk: use a virtual environment, pin and hash dependencies, restrict who can configure fallback tools, treat audit logs and exports as potentially sensitive, and avoid opening CSV/XLSX exports from untrusted task data until formula neutralization is added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit_logger.py:291

Finding

Spreadsheet Formula Injection in Audit Log Exports

Content

View full analysis

Remediation

View remediation

str: text = "" if value is None else str(value) effective = text.lstrip(" \t\r\n") if effective.startswith(("=", "+", "-", "@")): return "'" + text return text ``` Apply this helper to every CSV field: ```python safe_row = { key: self._spreadsheet_safe(value) for key, value in row.items() } writer.writerow(safe_row) ``` For XLSX, sanitize each string before appending and explicitly set cells to string values where practical. Do not rely solely on spreadsheet-client warnings. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unhashed Third-Party Dependencies

Content

View full analysis

=0.9.1 pyyaml>=6.0 python-json-logger>=2.0.0 ``` The documented installation command in `SKILL.md:37-40` is: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended lower-bound constraint. Consequently, two installations performed at different times may resolve to different package versions, including future releases that were not part of this audit. The dependency manifest also contains no package hashes. Package authenticity therefore depends entirely on the configured Python package index, TLS trust, and package-account integrity at installation time. No evidence was found that the currently named packages are malicious. The issue is that the effective installed code is not reproducibly constrained to reviewed artifacts. A compromised upstream release, dependency account, package index, or resolver environment could introduce unreviewed code. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` instruction. 2. Pip resolves the newest available versions satisfying the open-ended `>=` constraints. 3. An upstream package release or distribution artifact has changed since the Skill was reviewed. 4. Pip downloads and installs that unreviewed artifact without comparing it against a repository-maintained hash. 5. Package installation or subsequent import executes the dependency code with the privileges of the user or service installing and running the Skill. ### Impact Assessment The maximum impact depends on the account performing installation or executing the application. A compromised dependency could operate with that account's privileges and potentially: - Read files and environment variables accessible to the process. - Alter application behavior or d ...[truncated 376 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is presented as broad ClawHub automatic retry/fallback handling, but the behavior appears to be a generic fallback manager lacking the promised platform-specific integration and retry implementation. Such overclaiming can lead to unsafe deployment decisions, especially where operators rely on the description to understand execution scope and automation triggers.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as broad ClawHub automatic retry/fallback handling, but the behavior appears to be a generic fallback manager lacking the promised platform-specific integration and retry implementation. Such overclaiming can lead to unsafe deployment decisions, especially where operators rely on the description to understand execution scope and automation triggers.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill is presented as broad ClawHub automatic retry/fallback handling, but the behavior appears to be a generic fallback manager lacking the promised platform-specific integration and retry implementation. Such overclaiming can lead to unsafe deployment decisions, especially where operators rely on the description to understand execution scope and automation triggers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The automatic backup-tool switching feature does not warn users that the same task data and parameters may be sent to a different tool, provider, or trust boundary when fallback occurs. In an agent environment this can silently expand data exposure, create compliance issues, or violate user expectations about where inputs are processed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The audit logging and export features describe recording retry events, exceptions, task data, and parameter mappings, but do not warn that these records may contain sensitive information and may be exported to portable files like Excel or PDF. In an agent platform, this increases the risk of unintended data retention, insider exposure, and leakage through exported reports.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README claims audit logs are 'tamper-proof', but the documented implementation only shows normal local logging, querying, and export operations without integrity controls such as append-only storage, signatures, hashes, or remote write-once retention. This can create a false security assumption for operators who may rely on the logs as forensic evidence even though an attacker or insider could alter or delete them.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README asserts a built-in risk-control mechanism that blocks malicious high-frequency calls, but the described skill behavior is limited to retry, fallback, degradation, and logging. Overstating security controls is dangerous because users may assume abuse prevention exists and deploy the skill in contexts where rate limiting or anti-abuse protection is actually absent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documentation advertises capabilities that imply file access, persistent logging, and network use, but it declares no explicit tool scope or permission boundaries. In an agent setting, this weakens least-privilege controls and can cause the skill to be invoked with broader capabilities than users or reviewers expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The primary instructional content is presented in Chinese and the document does not offer a language selection or state that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

md

@handler.with_retry(max_attempts=3, backoff_strategy='exponential')
def my_api_call():
    # 你的API调用
    return requests.get('https://api.example.com/data')

# 自动重试执行
result = my_api_call()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 492)May include surrounding context.

md

@handler.with_retry(max_attempts=3, backoff_strategy='exponential')
def my_api_call():
    # 你的API调用
    return requests.get('https://api.example.com/data')

# 自动重试执行
result = my_api_call()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

@handler.with_retry(max_attempts=3, backoff_strategy='exponential')
def my_api_call():
    # 你的API调用
    return requests.get('https://api.example.com/data')

# 自动重试执行
result = my_api_call()

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains pervasive user-facing strings, comments, and console output in Chinese, including the title, example labels, status messages, and final execution output. Because the skill does not offer any user opt-in or alternative locale choice, it appears to enforce a specific language, which matches the natural-language locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring, class docstrings, comments, and user-facing labels are written in Chinese throughout, including exported Excel headers and descriptive text. This imposes a specific language/locale without any opt-in, alternative, or documented region-specific justification, which matches the policy-violation category for forced language choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The AuditLogger docstring lists '支持导出Excel/PDF格式' and '实时状态同步通知'. However, export_logs only supports json/csv/excel and raises an error for other formats, while notification callbacks are only declared and never used, so the documentation actively overstates implemented behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill for automatic retry and fallback handling of ClawHub task failures. In this file, the code adds persistent audit logging, multi-format export, and report generation capabilities, which are ancillary operational features rather than the retry/fallback handling behavior the skill claims as its core purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module title, class docstrings, and user-facing warning messages are written in Chinese, and the file provides no indication that language is selectable or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a skill for automatic retry and fallback handling of ClawHub tool-call failures, which implies managing runtime retry behavior. This file also persists configuration to disk via save_config, adding a configuration-writing capability beyond merely handling retries/fallback at execution time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file uses Chinese-only natural-language descriptions such as the module title and comments, and does not indicate that language selection is optional or limited to a region-specific use case. Under the policy rule, forcing a specific language/locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description for MEDIUM says '保留已完成结果，输出核心内容', implying the handler emits core content after degradation. In the actual logic, when a critical step fails from NONE state, the code only preserves already completed results and breaks execution at L133-L140; there is no separate behavior that identifies or outputs 'core content'.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module title and surrounding natural-language documentation are written exclusively in Chinese, and the rest of the file continues this pattern in docstrings and recommendation strings. Under the stated policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This YAML file contains user-facing descriptions and comments primarily in Chinese, such as the header comments and policy descriptions. Under the policy rule for natural-language violations, forcing a specific language without opt-in or justification can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower-bound range instead of an exact pinned version, which makes builds non-reproducible and can introduce unexpected vulnerable or incompatible releases during installation. In a retry/fallback skill, this is not directly exploitable by itself, but it increases supply-chain risk because the installed package version may vary across environments.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

retry>=0.9.1
pyyaml>=6.0
python-json-logger>=2.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

PyYAML is unpinned, so deployments may resolve to different versions, including ones with known security advisories depending on the environment and timing of installation. This is more concerning than a generic unpinned package because YAML parsers have a history of unsafe parsing issues, so version drift can materially affect exploitability if the skill ever processes untrusted YAML.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

retry>=0.9.1
pyyaml>=6.0
python-json-logger>=2.0.0

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The manifest includes PyYAML without pinning a version, while PyYAML has multiple known advisories across historical releases. Because the resolved version is unknown, there is no assurance that deployments avoid affected versions; if the skill parses attacker-controlled YAML, this could enable unsafe deserialization or other parser-related attacks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.