ClawHub
Back to skill

Security audit

造价文件诊断器

Security checks for vulnerabilities and agentic risk

Overview

The local tools fit the skill’s purpose, but its search command inspects parent and sibling folders despite promising to search only the supplied file’s folder.

Restrict export searches to the selected project folder and approve any expansion. Keep original spreadsheets and save cleaned versions separately. Treat encryption diagnoses as provisional, especially for OLE files. The optional cloud viewer requires uploading documents.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

The documented same-directory search actually recursively searches the parent directory and its entire subtree.

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The skill describes a same-directory search, but its command starts at the parent directory and recursively enumerates matching files throughout that subtree, including sibling project directories. This can expose unrelated project filenames and lead the agent to select or subsequently read confidential documents outside the intended project scope. Finding existing exports is legitimate, and the command itself neither reads file contents nor uploads data, but its unnecessarily broad scope creates a privacy and authorization risk.

Content

No source excerpt is available for this finding.

OLE containers are analyzed as raw files despite the documented requirement to unpack them first.

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The module documentation at L008–L011 explicitly requires ZIP and OLE containers to be unpacked before analyzing their contents, stating that entropy is meaningful only for non-container files. However, only ZIP receives container handling at L077–L111; recognized OLE files fall through to the 'non-container' entropy analysis and can consequently be incorrectly declared encrypted and locally unparseable at L140–L143.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.