ClawHub
Back to skill

Security audit

Gongwen 公文生成

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Chinese official-document DOCX generator with disclosed local formatting and font-checking steps, with some installation and trigger-scope cautions but no evidence of malicious behavior.

Install only from a pinned commit or trusted release and consider pinning python-docx in a virtual environment. Expect the skill to inspect local installed fonts and create DOCX files; use it when you specifically want Chinese official-document formatting, and be aware its trigger wording is broader than ideal.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:24
Finding

Unpinned Third-Party Installation Sources Permit Supply-Chain Substitution

Content
View full analysis

Vulnerability Details

File Location: README.md:24-32; SKILL.md:83
Vulnerability Type: Unpinned executable dependencies and mutable installation sources
Risk Level: Medium

Vulnerable Code

README.md:24-32:

bash
# Installation method 1: skills.sh
npx skills add maoningwood/gongwen

# Installation method 2: Git clone
git clone https://github.com/maoningwood/gongwen.git ~/.agents/skills/gongwen
# Alternatively, clone it into <project>/.agents/skills/gongwen

pip3 install --user python-docx

SKILL.md:83:

text
Dependency: `python-docx` (`pip3 install --user python-docx`).

Technical Analysis

The documented installation procedure resolves third-party components without an exact version, immutable commit, lockfile, or integrity hash.

The npx command may retrieve and execute the currently resolved release of the skills package. npm packages can contain lifecycle scripts and executable entry points, so a compromised or unexpectedly changed upstream release can execute code during installation.

The pip3 install --user python-docx command similarly resolves the current compatible package release. Depending on the selected distribution and environment, pip may invoke package build backends or installation logic. No hash checking or reviewed version constraint ensures that the installed artifact is the one expected by the audited project.

The Git clone command tracks a mutable repository branch rather than an immutable commit or signed release. Consequently, the installed Skill content may differ from the version covered by this audit.

This is a supply-chain weakness rather than evidence that the currently audited dependencies are malicious.

Attack Path

  1. An attacker compromises an upstream package registry account, repository account, release process, or another relevant distribution channel.
  2. The attacker publishes a modified release or changes the r ...[truncated 1162 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every package to a reviewed exact version instead of resolving the latest release.
  2. Pin the Skill repository to an immutable commit or a signed, immutable release tag.
  3. Supply and verify cryptographic hashes for downloaded artifacts. For pip, use a requirements file with exact versions and hashes, then install with --require-hashes.
  4. Pin the npm installer package explicitly and use a committed lockfile where applicable.
  5. Install Python dependencies in a dedicated virtual environment rather than the user-wide Python environment.
  6. Prefer prebuilt, verified wheels from trusted indexes and review any dependency requiring a source build.
  7. Document the expected commit, package versions, artifact hashes, and verification procedure so users can reproduce the audited installation.
  8. Use signed releases or provenance attestations where supported, and periodically review pinned dependencies for security updates.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The invocation rule is excessively broad: it says to activate even when the user only briefly mentions 公文 or says something generic like '写个通知'. Over-broad matching can cause the skill to trigger on ordinary conversations and then perform file creation, shell-based checks, or formatting workflows the user did not clearly request, which is a scope-hijacking and unintended-action risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises very broad trigger phrases such as "写个通知" and activating even when users merely mention 公文 in passing. Overbroad triggers can cause the agent to invoke this skill unexpectedly on ordinary writing or formatting requests, which increases the chance of unintended behavior, context hijacking, and application of specialized instructions where they were not requested.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs the agent to run local Python scripts, read from the skill directory, and invoke shell commands, but it does not declare any explicit tool scope or permission boundaries. This creates an implicit capability expansion risk: an agent may execute commands or access files without a clearly constrained policy, increasing the chance of unintended file access, command misuse, or environment disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file presents the skill as a Chinese official-document generator with mandatory Chinese机关 formatting rules, but it does not explicitly state that this locale restriction is optional, user-selected, or limited to a region-specific compliance use case. Because the instructions are framed as prescriptive defaults, this can be interpreted as forcing a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_fonts.py (reported line 97)May include surrounding context.

python
def fc_list_families():
    """Linux/装有 fontconfig 的机器上用 fc-list 兜底，覆盖任意自定义字体路径。"""
    try:
        out = subprocess.run(['fc-list', ':', 'family'], capture_output=True,
                             text=True, timeout=60).stdout
    except Exception:
        return set()

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file contains user-facing natural language entirely in Chinese, including the module docstring and CLI output description, which effectively forces a specific language/locale experience. The policy allows this only when the locale constraint is explicitly justified or when the user is given a language choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.