ClawHub
Back to skill

Security audit

Excel数据求和工具

Security checks for vulnerabilities and agentic risk

Overview

This skill only reads a user-provided Excel file to sum numbers in the first column, with minor usability and dependency-integrity caveats.

Install in a virtual environment and consider pinning openpyxl to a reviewed version. Users who do not read Chinese should review the behavior first, since the instructions and script output are Chinese-only.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:51
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:51-54; also declared without a version constraint in skill.json:27-29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code

SKILL.md:51-54:

bash
pip install openpyxl

skill.json:27-29:

json
"requirements": [
  "python>=3.7",
  "openpyxl"
]

Technical Analysis

The project instructs users to install openpyxl without pinning a reviewed version or verifying an artifact hash. The package declaration in skill.json is similarly unconstrained.

Consequently, installations are not reproducible and will resolve whichever compatible release the configured package index serves at installation time. A future compromised, malicious, or unexpectedly incompatible release could therefore enter the execution environment without a corresponding change to the audited project.

No evidence was found that the skill uses a typosquatted package, an untrusted package index, or automatic remote payload execution. The issue is limited to insufficient dependency integrity controls.

Attack Path

  1. An operator follows the documented pip install openpyxl instruction or an integration processes the unconstrained requirement.
  2. pip queries the environment's configured package index and selects the latest matching release.
  3. An attacker must first compromise the package distribution channel, a package release, index configuration, or another relevant supply-chain component.
  4. The installer downloads and installs the substituted or compromised artifact without validating it against a project-maintained hash.
  5. Malicious package installation logic or imported package code can execute with the permissions of the Python environment or process.

Impact Assessment

Successful exploitation requires an upstream or package-index compromise and is not directly achievable through an Excel input file. If that p ...[truncated 369 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin openpyxl to a reviewed exact version in both the documentation and machine-readable requirements, for example openpyxl==X.Y.Z.
  • Maintain a lock file or hash-locked requirements file generated from reviewed artifacts.
  • Install with hash verification, such as pip install --require-hashes -r requirements.txt.
  • Obtain packages only from a trusted, explicitly configured index or internal mirror.
  • Review and update pinned dependencies through a controlled process that includes vulnerability and provenance checks.
  • Run dependency installation and workbook processing as an unprivileged account inside an isolated virtual environment or container.
  • Keep the version declaration in skill.json synchronized with the locked dependency specification.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The phrase 'or similar operations' makes the skill invocation boundary ambiguous, which can cause an agent to select this skill for requests outside its narrowly intended purpose. Overly broad routing language increases the chance of unintended file access or misuse in workflows that automatically choose tools based on natural-language descriptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest text is entirely in Chinese and does not indicate that language choice is optional or region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s user-facing description and instructions are entirely in Chinese, which can impose a language constraint on users without any stated opt-in or justification. The policy requires flagging language or locale restrictions when the skill forces a specific language without offering user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and all command-line output are written only in Chinese, which imposes a specific language on users without any opt-in or explanation. The policy explicitly calls out forced language or locale as a natural-language violation unless choice or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.