T08 · Insecure Dependencies
Warning
- Location
file2sum.py:9- Finding
Automatic Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
文件总结 File Summary & Analysis
Security checks for vulnerabilities and agentic risk
Overview
This local document summarizer is mostly purpose-aligned, but it needs Review because it can auto-install unpinned Python packages and may pass full document text into an LLM workflow without clear confirmation.
Install only if you are comfortable with the skill reading the documents you point it at, passing extracted text into the OpenClaw LLM summarization flow, and modifying the Python environment by installing parser packages. Prefer a version that requires explicit confirmation before reading/summarizing files and that ships pinned, reviewed dependencies installed through a controlled process.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented purpose is document summarization, but the skill behavior includes raw content extraction and automatic installation of Python packages, which are materially different and more sensitive capabilities. This mismatch can mislead users into granting trust for a low-risk summarizer while the skill modifies the environment and may expose full document contents, creating risks of data leakage and unintended code execution paths through package installation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that an LLM summarizes extracted text automatically, but it does not clearly warn users that document contents may be transmitted beyond the local file-processing step. For a tool handling potentially sensitive local documents, lack of disclosure undermines informed consent and can lead to unintentional exposure of confidential data to an external model or service.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A local document summary/reading skill should not need to mutate the runtime by installing software. Auto-installing packages extends the skill from passive file processing into code acquisition and execution, which is especially dangerous in agent contexts because it can fetch unreviewed dependencies and alter the environment without the user's informed approval.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill exposes capabilities consistent with local file reading and Python/shell execution, but it does not clearly declare a restrictive tool scope such as explicit permissions or allowed-tools. This makes the skill harder to audit and increases the chance that users or the host framework will authorize broader execution than necessary, especially since the documented workflow depends on Python execution and package installation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include common requests like '帮我总结' and activation on any local file path, which can cause the skill to run in ordinary conversation without sufficiently clear user intent. In a skill that reads local files and may forward content for summarization, overbroad activation increases the risk of accidental file access or unexpected disclosure of sensitive document contents.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's natural-language strings, including status messages, usage text, and comments, are written only in Chinese. This enforces a locale/language choice without offering user opt-in or a documented region-specific justification.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 94% confidence
- Finding
The script invokes pip through subprocess to install packages at runtime, which is an execution capability beyond simple file reading. Even though shell injection is not present because arguments are passed as a list and package names are hard-coded, this still permits network/package-execution behavior and unreviewed code installation in the agent environment, increasing supply-chain and environment-tampering risk.
- Content
python """自动安装Python包""" print_step(f"正在自动安装依赖库: {package_name}") try: subprocess.check_call([sys.executable, "-m", "pip", "install", package_name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) print(f"✅ 成功安装 {package_name}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script silently installs packages without any user confirmation or clear warning, violating the principle of informed consent for actions that change the host environment. In an agent setting, this can surprise operators, bypass change controls, and facilitate unwanted dependency retrieval or policy violations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says this skill is a document summary tool, which implies it should produce a summary or analysis result. In reality, the implementation only dispatches by file type, extracts raw text, and prints the full content, with no summarization logic present anywhere in the file.
- Content
Static analysis
No suspicious patterns detected.