ClawHub
Back to skill

Security audit

腾讯会议议章程管理&沉淀

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent meeting-charter helper that saves user-approved meeting notes and optional reminders, with a filename-safety caveat to watch for.

Before installing, understand that saved charters may contain sensitive meeting material in your workspace and reminders may later reread those files. Use filename-safe meeting titles or ensure your agent sanitizes meeting codes/topics so paths cannot escape meeting-charters/.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:65
Finding

Path Traversal Through Unsanitized Charter Filename Components

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65–72
Vulnerability Type: Path traversal and unsafe file-path construction
Risk Level: Medium

Vulnerable Code Snippet:

text
meeting-charters/
└── <meeting-code>-<topic>.md
text
没有会议号时使用 <YYYY-MM-DD>-<topic>.md。

Technical Analysis

The skill instructs the agent to construct a persistent charter filename directly from the meeting code and topic. These values may originate from user-provided content or external meeting metadata, but the instructions do not require sanitization, canonicalization, rejection of path separators, or verification that the resolved destination remains inside the intended meeting-charters/ directory.

If an implementation follows this filename template literally, crafted values containing path separators or traversal components such as ../ could escape the intended storage directory. This conflicts with the stated requirement to save charters only in the current workspace's meeting-charters/ directory.

Attack Path

  1. An attacker supplies a crafted meeting code or topic containing traversal components or path separators.
  2. The attacker asks the agent to save the resulting meeting charter.
  3. The agent interpolates the untrusted value into meeting-charters/<meeting-code>-<topic>.md without sanitization.
  4. Path resolution escapes the intended meeting-charters/ directory.
  5. The agent creates or overwrites an accessible Markdown file elsewhere in the workspace or filesystem, subject to its existing file permissions.
  6. If a reminder is requested, the escaped absolute path may also be associated with the scheduled reminder and read again when it triggers.

Impact Assessment

Successful exploitation could permit creation or overwrite of files outside the intended charter directory wherever the agent already has write access. It does not grant additio ...[truncated 284 chars]

Remediation
View remediation

Remediation Suggestions

  • Convert the meeting code and topic into strictly validated filename-safe slugs.
  • Allow only a conservative character set, such as ASCII letters, digits, hyphens, and underscores.
  • Reject or replace /, \, .., absolute-path prefixes, control characters, and platform-specific reserved characters.
  • Enforce a reasonable maximum filename length.
  • Resolve and canonicalize the destination path before writing.
  • Verify that the canonical destination remains beneath the canonical meeting-charters/ directory.
  • Refuse the operation if containment validation fails.
  • Avoid overwriting an existing file unless it is the confirmed charter for the same meeting or the user explicitly approves the overwrite.
  • Apply the same containment check before storing the charter path in a reminder and again before reading it when the reminder triggers.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.