ClawHub
Back to skill

Security audit

cn-calendar

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its China calendar purpose, but it can persistently rewrite its own executable query code from externally fetched data and gives compliance-sensitive tax deadline guidance with inconsistent source controls.

Review before installing. This skill is reasonable for China holiday/workday lookup using the bundled 2025-2026 data, but avoid relying on its inferred deadline command for tax compliance and require explicit approval before any remote fetch or persistent update. Prefer a version that stores new calendar data as validated data files rather than rewriting Python source.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_holidays.py:118
Finding

Unvalidated Input Can Corrupt the Executable Query Script

Content
View full analysis
1 else "--check" if mode == "--check": result = check_local(year) if result: print(json.dumps({"status": "exists", "year": year, "path": result["path"]})) else: print(json.dumps({"status": "missing", "year": year})) elif mode == "--save": # 此模式由 Claude 在获取到官网数据后调用 # 数据通过 stdin 传入（JSON 格式） data = json.loads(sys.stdin.read()) holidays = data.get("holidays", []) extra_workdays = data.get("extra_workdays", []) md_content = data.get("md_content", "") if md_content: save_references_md(year, md_content) if holidays: update_workday_script(year, hol ...[truncated 2734 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior promises official-source retrieval and tax-deadline accuracy, but the instructions rely on local scripts, a third-party GitHub source, and contradictory logic that may not actually provide authoritative results. In a tax/calendar skill, this mismatch is security-relevant because users may trust outputs for compliance decisions while the implementation silently falls back to less trustworthy or incomplete data paths.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document simultaneously says tax filing deadlines must come from official yearly reference files and also instructs use of a deadline command that calculates them. This inconsistency can cause the agent to infer compliance-sensitive deadlines from generic workday logic rather than authoritative tax calendars, leading to incorrect legal or financial guidance.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill instructs file reads and writes but does not declare any explicit tool scope or permissions boundary. That creates an authorization gap where an agent may perform local state changes beyond what users reasonably expect, increasing the chance of unintended modification or abuse if the skill is invoked automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs writing new reference files, modifying source code, and then executing the modified script, but it does not clearly disclose to users that invoking the skill can change persistent local state. Hidden state changes are dangerous because they can permanently alter later behavior, introduce integrity issues, and make a simple informational skill behave like a self-modifying system.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs use of a broad exec capability to run code after modifying local files, even though the stated task is a calendar lookup. Allowing code execution in a content/update workflow expands the attack surface: malformed or adversarially influenced data could lead to execution of changed code, and the capability exceeds what is necessary for answering user queries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The text states that Beijing 12366 data (ssjg=111000000) is used as the national unified standard reference. This imposes a specific regional locale on all users without offering a choice or documenting why this locale is universally appropriate for every query.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tax-filing-calendar-2026.md (reported line 61)May include surrounding context.

接口：POST https://12366.chinatax.gov.cn/bsfw/calendar/getCalendarListForMonth

参数：ssjg=111000000（北京市）&bssj=YYYY-MM

示例：查询2027年1月

curl -X POST https://12366.chinatax.gov.cn/bsfw/calendar/getCalendarListForMonth
-d "ssjg=111000000&bssj=2027-01"

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill file is written as a Chinese-language reference and does not indicate that language selection is optional or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring says this script '从国务院官网抓取指定年份的法定节假日通知，解析后' and its usage examples describe a fetch operation. However, the implementation only checks for local files, reads JSON from stdin, writes a markdown reference file, and edits another local Python file; there is no HTTP client, request logic, or HTML parsing anywhere in the file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This script rewrites another Python source file using externally supplied holiday/workday data, effectively turning untrusted input into code edits. Even though the values are expected to be dates, there is no strict schema validation, no transactional safeguards, and no confirmation step, so malformed or adversarial input can corrupt repository code or introduce persistent unsafe behavior in the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

In --save mode, the script accepts JSON from stdin and uses it to write repository files, including markdown content and generated Python data blocks, without authentication, provenance checks, or user confirmation. In this skill context, where an agent may process remotely sourced content, this increases the risk of supply-chain style tampering, persistent data corruption, or poisoning of future query results.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation claims tax filing calendar support from the State Taxation Administration, but the code contains no tax-calendar source data and simply rolls a provided date forward to the next workday. In a tax-deadline use case, this can misstate actual statutory deadlines, extensions, or filing-calendar rules and mislead users into noncompliant actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata promises that out-of-range years are automatically fetched from official sources and persisted, but the implementation only prints a warning and exits. In a calendar/compliance tool, this mismatch can cause users or upstream agents to assume fresh authoritative data exists when it does not, leading to incorrect workday or filing-date decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill says it will fetch holiday data from GitHub and, elsewhere, tax calendar data from the 12366 API when local data is unavailable. Although this is part of the workflow, the markdown does not plainly disclose to users that their request may trigger outbound network access to third-party or government services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file is entirely written in Chinese and scoped to mainland China holidays, with no indication that language or locale is optional. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function docstring states '从本地 references/holidays-YYYY.md 解析出假期数据', suggesting it extracts holiday data from the markdown file. In reality, the implementation explicitly returns only the file path and year, and the inline comment says Claude will read and parse it instead, which contradicts the stated function behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module description and command help are entirely in Chinese, and later user-facing output strings are also fixed to Chinese. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The weekday labels and all printed status messages are hard-coded in Chinese, so the tool enforces one language at runtime. Because there is no language choice or explicit opt-in, this matches the language/locale policy concern for natural-language content in code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.