T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lake/lake_setup.py:280- Finding
Unsafe YAML Deserialization Enables Arbitrary Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Lakebook To Md
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Lakebook conversion skill, but it handles untrusted archives and URLs in ways that could overwrite files, execute unsafe YAML payloads, make unexpected network requests, or mutate the Python environment.
Install or run this only in a disposable, sandboxed environment and only on lakebook files you trust. Disable downloads unless you need them, avoid running it from directories containing important temp data, and prefer a reviewed fork that uses safe tar extraction, yaml.safe_load, contained filenames, URL allowlisting, size limits, and explicit dependency installation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lake/lake_reader.py:7- Finding
Lakebook Archive Path Traversal During Tar Extraction
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lake/lake_handle.py:224- Finding
Attachment Filename Traversal Permits Arbitrary File Writes
- Content
View full analysis
:"|?*]', "_", file_name) local_path = os.path.join(local_dir, safe_name) # 检查是否已存在 if context1.skip_existing and os.path.exists(local_path): rel_path = os.path.relpath(local_path, context1.image_target) context1.add_downloaded_file(file_name, download_src, rel_path) return f"\n[{file_name}]({rel_path}) ({size_str})\n" # 下载文件 time.sleep(0.5) resp = requests.get(download_src, timeout=30) if resp.status_code == 200: with open(local_path, "wb") as f: f.write(resp.content) ``` ### Technical Analysis The attachment name is controlled by the lakebook's `localdoc` card. Sanitization removes a limited set of characters but does not remove `/`, backslashes, `..` path components, or absolute-path semantics. `os.path.join(local_dir, safe_name)` therefore does not guarantee containment under `local_dir`. A crafted filename can escape the attachment directory, while the downloaded response body supplies the file content. ### Attack Path 1. The attacker creates a lakebook containing a `localdoc` card. 2. The card uses a traversal filename such as `../../target-file` and an attacker-controlled `downloadSrc`. 3. The victim converts the lakebook with downloads enabled. 4. The converter downloads the attacker's content. 5. `open(local_path, "wb")` writes that content outside the intended output directory. ### Impact Assessment An attacker can create or overwrite files at locations writable by the converter user. This can corrupt user data or application configuration and may lead to code execution if the attacker targets a script, module, shell initialization file, or another file ...[truncated 28 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lake/lake_handle.py:232- Finding
Unrestricted Resource Downloads Enable SSRF and Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
MAX_RESOURCE_SIZE: raise ValueError("Resource exceeds size limit") output.write(chunk) ``` ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lake/lake_setup.py:738- Finding
Predictable Temporary Directory Can Cause Unrelated Data Deletion
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/startup.py:8- Finding
Automatic Installation of Unpinned Runtime Dependencies
- Content
View full analysis
=4.12.0 PyYAML>=6.0 Requests>=2.31.0 openpyxl>=3.1.0 ``` ### Technical Analysis Normal program execution invokes `pip install` automatically when an import is missing. The dependency declarations specify only lower bounds and provide no hashes, allowing future releases to be selected at runtime. Installation sources also depend on the user's pip configuration and environment. A compromised package release, package index, mirror, or configuration can therefore introduce code that was not part of the audited Skill. Python packages may execute code during build, installation, or import. Additionally, `ensure_deps()` does not test for `openpyxl`, although the program depends on it, making dependency behavior inconsistent. ### Attack Path 1. A required module is absent from the runtime environment. 2. Starting the converter invokes pip automatically. 3. Pip resolves mutable dependency versions from the configured package index or mirror. 4. A compromised or otherwise unreviewed package artifact is downloaded and installed. 5. Package-controlled code executes during installation, build, or subsequent import with the converter user's privileges. ### Impact Assessment If the dependency source or selected artifact is compromised, arbitrary code can execute as the user running the converter. This could expose files and credentials available to that user, modify the Python environment, or persist through installed packages. Expl ...[truncated 121 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (38)
YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]
High
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
�量、类型分布 2. 成功转换的文档 - 列出所有成功转换的文件 3. 转换失败的文档 - 列出失败原因 4. 图片下载统计 - 成功/失败的图片 5. 附件下载统计 - 成功/失败的附件 6. 过期链接 - 无法下载的资源 7. 需要手动处理的内容 - 汇总需要人工介入的项目
安装
方式一：pip 安装
bash pip install git+https://github.com/luhuiwang/lakebook-to-md.git方式二：克隆使用
bash git clone https://github.com/luhuiwang/lakebook-to-md.git cd lakebook-to-md/scripts pip install -r requirements.txt方式三：AionUi Skill
将本仓库克隆到 AionUi 的 skills 目录：
bash git clone https://github.com/luhuiwang/lakebook-to-md.git \ ~/.config/AionUi/config/skills/lakebook-to-md使用方法
命令行
bash # 基本转换 python scripts/startup.py -l 你的导出文件.lakebook -o 输出文件夹 # 或者 pip 安装后直接使用 lak
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises behavior that reads and writes local files, downloads remote resources, and invokes a Python entrypoint, but it does not declare any explicit tool scope or permissions. This creates a trust and review gap: an operator may invoke the skill without realizing it can access the filesystem, make network requests, and execute shell/Python commands, increasing the chance of unintended data exposure or unsafe execution in permissive environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill states that it automatically downloads images and attachments, but it does not prominently warn that running the conversion will initiate outbound network requests and persist remote content from the exported document onto local disk. Because lakebook content may contain untrusted or expired signed URLs, this can cause unexpected data egress, retrieval from attacker-controlled endpoints, and storage of untrusted files in the output directory.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The parser downloads URLs embedded in the input document via requests.get(download_src), so an attacker controlling the .lakebook content can trigger arbitrary outbound HTTP requests during conversion. This is a classic SSRF-style behavior and also enables unexpected data egress, internal service probing, or retrieval of untrusted content, even though the feature is intended to fetch attachments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code automatically fetches attachment content from remote URLs and writes the results to local disk, but there is no confirmation prompt and no user-facing disclosure at the point of execution. The only visible handling is internal bookkeeping and error reporting, which does not warn the user that external resources will be downloaded and saved locally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Image/resource handling also performs automatic requests.get(src) based on document-controlled src values, which expands the attack surface beyond pure file conversion. A crafted document can cause the converter to contact arbitrary remote endpoints and save attacker-chosen content locally, creating SSRF and untrusted file ingestion risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function retrieves remote resources with requests.get and saves them to local paths, but it provides no user-facing disclosure before performing the network access and file write. The failure print at L300 only appears on error and does not inform the user that the skill will contact remote URLs and persist files when successful.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code uses tarfile.extractall() on an attacker-controlled .lakebook archive without validating member paths. This is a classic path traversal issue: crafted tar entries containing absolute paths or '../' can write outside the intended extraction directory, potentially overwriting arbitrary files on the host. In a conversion skill that processes imported user files, this context makes the issue more dangerous because untrusted archives are expected input.
- Content
Insecure deserialization: yaml.load() without SafeLoader
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The code parses YAML from metadata using yaml.load(..., yaml.Loader), which can construct arbitrary Python objects from attacker-controlled YAML. Because the skill processes imported .lakebook content and explicitly treats embedded metadata as input, a malicious archive could trigger unsafe deserialization during conversion, potentially leading to code execution or other unsafe object instantiation.
- Content
python meta = json_obj["meta"] meta_obj = json.loads(meta) book_yml = meta_obj["book"]["tocYml"] books = yaml.load(book_yml, yaml.Loader) for book in books: if book.get("uuid"): global_context.id_and_book[book["uuid"]] = book
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 75% confidence
- Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Content
python # 自动调整列宽 for col in ws.columns: max_length = 0 column = col[0].column_letter for cell in col: try:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This script writes converted Markdown, Excel, and report files to disk and also deletes the temporary directory with shutil.rmtree, but the code provides no explicit warning or confirmation about these filesystem changes beyond generic progress messages. Under SQP-2 for code files, safety-relevant file writes/deletions should have some visible disclosure when the code itself performs them.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A document-conversion startup script should not need to modify the Python environment during normal execution, yet this code installs dependencies automatically if imports fail. That behavior gives the skill unexpected package-management capability and can trigger execution of third-party installer code, making the converter more dangerous than its stated purpose suggests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script silently performs pip installation when imports are missing, without warning, confirmation, or meaningful audit visibility. Silent dependency installation is risky because users may unknowingly permit network access and execution of package installation hooks, which is especially inappropriate for a file-conversion utility handling untrusted content.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 88% confidence
- Finding
The script executes a subprocess to run pip and install dependencies at runtime from a local requirements.txt file. While the command is not obviously user-injection prone, invoking package installation during startup expands the skill's execution capability, can pull and execute arbitrary package install code from the Python packaging ecosystem, and creates supply-chain risk if requirements are tampered with or unpinned.
- Content
python req = os.path.join( os.path.dirname(os.path.abspath(__file__)), "requirements.txt" ) subprocess.check_call([sys.executable, "-m", "pip", "install", "-r", req, "-q"]) def main():
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language documentation is entirely presented in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional and justified. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file states that the tool automatically downloads attachments and generates output files, which affects user data and performs network activity. While the behavior is described functionally, there is no clear cautionary warning that running the conversion will fetch remote resources and write them to disk unless disabled.
- Content
Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language description is written only in Chinese, which can impose a language expectation without offering users a language or locale choice. Under the policy, language-specific behavior or presentation should either be optional or clearly justified as region-specific.
- Content
Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
PyYAML is specified with only a minimum version, so installs may resolve to versions with known security issues depending on the environment or mirror state. In a tool that converts exported content and may process untrusted data, dependency ambiguity increases supply-chain and parser-risk exposure, especially if unsafe YAML loading is used elsewhere in the project.
- Content
Unverifiable Dependency: Requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
Requests is not pinned to a specific safe release, so deployments may pick up versions affected by published advisories. Because this skill explicitly supports automatic attachment downloads, an HTTP client dependency with uncertain patch level is more security-relevant than in an offline-only tool and could expose users to credential leakage, TLS, redirect, or request-handling flaws.
- Content
Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
openpyxl is not pinned, leaving the installed version unverifiable against known XML-related issues. Since this skill generates Excel output from imported document content, using an unpinned spreadsheet library can increase exposure to parser or workbook-generation vulnerabilities in some environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function prints user-facing messages only in Chinese ("无下载失败项" and "共 ... 个下载失败项"). This imposes a specific language on all users without any opt-in or localization mechanism, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The docstring is written only in Chinese, which imposes a language choice in user- or developer-facing natural language without offering an alternative or opt-in. Under the stated policy, locale or language constraints should be optional or clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This returned message is hard-coded in Chinese and would be shown in output regardless of user language preference. That creates a language-policy issue because the skill forces a specific locale without explicit opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.