Security audit

Chinese Workdays

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate purpose, but it can silently invent and save holiday calendars while presenting calculations as official, and its pricing/subscription information is inconsistent.

Review this carefully before installing. It may be useful for China workday estimates, but do not rely on unsupported or future-year results as official unless you verify the YAML data yourself. Also confirm the actual billing terms because the included subscription metadata conflicts with the publish notes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: PUBLISH.md:55
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` 3. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a lock file that records transitive dependencies and artifact hashes. 5. Explicitly document the trusted package index and disable unintended extra indexes where practical. 6. Regularly scan pinned dependencies for disclosed vulnerabilities before updating them. 7. Perform dependency installation in an isolated virtual environment under a non-privileged account. 8. Apply equivalent version and integrity controls to the documented `clawhub` package installation process where supported. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: chinese_workdays.py:133
Finding: Unsupported Years Silently Generate and Persist Unverified Holiday Schedules
Content: View full analysis
Dict: """Get holiday schedule for a specific year""" if year not in self.holiday_schedules: # Try to create example schedule self._create_example_schedule(year) return self.holiday_schedules.get(year, {}) ``` The generated holiday dates are a fixed example pattern rather than data retrieved from or validated against an official government schedule. Neve ...[truncated 1822 chars]
Remediation: View remediation
Dict: if year not in self.holiday_schedules: raise ValueError(f"No verified holiday schedule is available for {year}") return self.holiday_schedules[year] ``` 2. Remove automatic calls to `_create_example_schedule()` from normal initialization and calculation paths. 3. Keep templates outside the authoritative data directory and name them clearly, such as `example-template.yaml`. 4. Require an explicit administrative command to add a new calendar. 5. Validate imported schedules before activation, including the declared year, date formats, date ranges, duplicate entries, and conflicts between `days_off` and `makeup_workdays`. 6. Record provenance metadata and distinguish verified official schedules from drafts or templates. 7. Open the packaged calendar directory as read-only during routine execution where deployment permits. 8. If persistence is required, write atomically to a dedicated application-data directory rather than modifying packaged resources. 9. Add tests confirming that unsupported years raise an error and do not create files. 10. Update the documentation to state precisely which years are verified and supported. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module documentation claims the calculator is based on official Chinese government holiday schedules, but the implementation falls back to internally fabricated example data. This mismatch is dangerous because downstream users and agents may trust outputs as authoritative, leading to silent integrity failures in business processes that depend on legal workday calculations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: When a requested year is missing, the code silently fabricates and persists an example holiday schedule, despite the skill claiming to use official State Council schedules. This can produce materially incorrect results for payroll, compliance, scheduling, or HR workflows, and the persisted fake data may be reused later as if it were authoritative.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The line explicitly promises 'automatic' annual updates through a scheduled task. In the provided file, the described operational flow is entirely manual CLI-based publishing, so the documentation overstates implemented behavior rather than merely omitting detail.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation describes capabilities that read holiday YAML files and update them manually, and the static analysis detected file_read/file_write behavior, but the manifest declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent runtime may grant broader filesystem access than users expect, increasing the risk of unintended file access or modification beyond the holiday data directory.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill creates directories and writes YAML schedule files as a side effect of initialization, even though its stated purpose is only to calculate workdays. Unexpected local file writes expand the attack surface, can violate least-privilege expectations, and make behavior harder to reason about in sandboxed or sensitive environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document presents core usage and publishing instructions partly in Chinese and partly in English, which effectively imposes a language assumption on readers without explicit opt-in. The policy requires avoiding forced language choices unless the skill offers a language option or clearly justifies the constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The YAML values and comments are entirely in Chinese, including holiday names and explanatory notes, with no indication that the skill is region-specific or that users can opt into this locale. Under the stated policy, a forced language/locale can be a natural-language policy violation unless it is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This YAML file contains user-facing natural-language content entirely in Chinese, including holiday names, notes, and comments, but does not document that the skill is specifically intended for a China/Chinese locale context. Under the policy rule for language or locale constraints, this can be read as enforcing a specific language without an explicit opt-in or justification in the file itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file uses Chinese-specific locale content throughout, including country designation and holiday notes entirely in Chinese, without any indication that this dataset is intentionally region-scoped or that alternative locales are supported. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This YAML file contains holiday data exclusively for China and uses Chinese-language note fields and comments throughout. Under the stated policy, locale-specific content can be a violation when it imposes a specific language or locale without user opt-in or an explicit justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This YAML file contains holiday names, notes, and metadata entirely in Chinese and is scoped to China, but it does not document that the skill is region-specific or provide any user opt-in for language/locale. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This YAML file contains holiday names, notes, and comments entirely in Chinese and is explicitly scoped to China, but it does not document that the locale/language is intentionally region-specific or provide any user opt-in. Under the stated policy, language or locale restrictions should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file is entirely scoped to China and uses Chinese-language values and comments throughout, with no indication that this locale restriction is optional or user-selectable. Under the stated policy, locale-specific behavior can be a violation when it is imposed without opt-in or justification in the file itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This manifest-like YAML file contains user-facing natural-language content entirely in Chinese and fixes the locale context to China, with no indication that alternative language or locale options are supported. Under the stated policy, forcing a specific language/locale without user opt-in can be a policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This YAML file stores holiday names, notes, and metadata entirely for China and uses Chinese-language text throughout, but the file itself does not explicitly document that it is a region-specific dataset or offer any locale choice. Under the stated policy, forcing a specific language/locale without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This YAML file contains holiday names, notes, and comments in Chinese and is scoped to China, but there is no natural-language indication that the locale/language is optional or user-selectable. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The dataset is explicitly scoped to China and contains Chinese-language names and notes throughout, with no accompanying indication that the locale is optional or intentionally limited for a region-specific skill. Under the policy rule for natural-language locale constraints, this can be read as a fixed locale assumption rather than a user-selectable setting.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This YAML file is clearly scoped to China and contains Chinese-language values and comments throughout, but it does not indicate that the locale is optional or user-selected. Under the policy rule for language/locale constraints, a file that hard-codes a specific locale without opt-in can be considered a natural-language policy concern unless the region-specific limitation is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This YAML file contains natural-language fields and comments in Chinese, including holiday names and notes, but does not indicate that the locale/language is optional or user-selectable. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This YAML file encodes holiday names, notes, and metadata entirely for China and in Chinese text, including official notice references and comments. Under the stated policy, locale-specific language constraints should either offer user choice or be clearly documented as a justified region-specific dataset; this file provides no explicit opt-in or justification within the file itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This YAML file is structured specifically for China and includes holiday names and notes only in Chinese, which reflects a fixed locale without any indication of user choice or documented regional scope in the file itself. Under the stated policy, locale-specific content should either be explicitly justified as region-specific or offer an opt-in/choice mechanism.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code presents its description and all user-facing output in Chinese, including usage text, formatted results, and error messages. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is clearly justified, which is not stated in the file.
Content: No source excerpt is available for this finding.