T08 · Insecure Dependencies
Warning
- Location
file2sum.py:19- Finding
Runtime Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
文档内容总结 Summary & Analysis txt/docx/pdf/xlsx/xls
Security checks for vulnerabilities and agentic risk
Overview
This file-summary skill is mostly purpose-aligned, but it automatically installs unpinned Python packages at runtime when processing documents.
Install only if you are comfortable with the skill reading the files you explicitly provide, sending extracted content to OpenClaw LLM for summarization, and potentially installing Python packages into the runtime environment. Prefer using it in a sandbox or after preinstalling reviewed, pinned dependencies so the auto-install path never runs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior does not match the detected capabilities and implementation notes: the skill claims summary/analysis with external LLM handling, but the implementation apparently lacks that functionality while also introducing undeclared runtime package installation. This mismatch is dangerous because users and reviewers may grant trust or permissions based on the description while the actual behavior can change the environment and operate in unexpected ways.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill modifies the host environment by installing packages, which is outside the manifest's described scope of local document summarization. This mismatch is dangerous because users may authorize a low-risk file utility while unknowingly allowing code execution and persistent environment changes.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A document summary tool should only read supported files, but this implementation silently installs Python packages during execution. That behavior exceeds the stated purpose and creates supply-chain and execution risk, since package installation can run arbitrary build/install scripts and introduce unexpected code into the environment.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises local file extraction and enables Python execution, but it does not declare a restrictive tool scope such as explicit permissions or allowed tools. In a skill that reads arbitrary local files and invokes a script, this weakens reviewability and increases the chance of unintended file access or shell-capable behavior beyond the user’s expectations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The Chinese triggers are similarly vague and broad, making accidental invocation plausible during normal requests for summarization or analysis. In the context of a file-reading skill, ambiguous activation increases the risk of processing local documents without clear, informed user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Broad English triggers like 'summarize for me' and 'analyze for me' can match ordinary conversation and invoke the skill in contexts the user did not intend. Because this skill operates on local files and may expose document contents to further processing, accidental triggering can lead to unintended file access or disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill performs automatic pip installation without prior confirmation or an upfront runtime warning at the point of action. This undermines informed consent and can lead to unexpected network access, package execution, and environment modification in contexts where the user expected only local file parsing.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 97% confidence
- Finding
The code invokes pip at runtime via subprocess to install packages into the current environment. Even though the command is not shell-injected, it still executes an environment-modifying action based on normal program flow, which is risky for a file-reading skill because it can pull and execute unreviewed package code and alter the host without explicit user consent.
- Content
python """自动安装Python包（中英双语提示）""" print_step(f"正在自动安装依赖库: {package_name}") try: subprocess.check_call([sys.executable, "-m", "pip", "install", package_name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) print(f"✅ 成功安装 {package_name} / Successfully installed {package_name}")
Static analysis
No suspicious patterns detected.