ClawHub
Back to skill

Security audit

OpenAI Ban Risk Tracker

Security checks for vulnerabilities and agentic risk

Overview

The tool’s reviewed code matches its stated purpose, but its install instructions fetch executable code from an unpinned GitHub repository, so users may not install the reviewed version.

Review before installing. Prefer an immutable release or a full pinned commit SHA instead of the documented unpinned GitHub pip command. Running risk-check stays local, while scan contacts V2EX and appeal --output writes or overwrites the path you provide.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Installation Instructions Use an Unpinned Mutable Git Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:26 and README.md:10
Vulnerability Type: Supply-chain exposure through an unpinned VCS dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:26:

bash
pip install git+https://github.com/minirr890112-byte/openai-ban-tracker.git

README.md:10:

bash
pip install git+https://github.com/minirr890112-byte/openai-ban-tracker.git

Technical Analysis

The documented installation command retrieves the current default branch from a remote Git repository without pinning it to an immutable commit hash or verifying the integrity of the downloaded source.

A source installation performed by pip invokes the package's configured build backend. Consequently, if the repository is compromised or its default branch is changed after this audit, the effective installation payload can differ from the reviewed code. Users following the documentation would have no cryptographic assurance that they are installing the audited revision.

The project also declares third-party dependencies using open-ended minimum versions, but no malicious or typosquatted package was identified in the reviewed files. The confirmed issue is specifically the mutable Git installation source.

Attack Path

  1. An attacker compromises the referenced GitHub account or repository, or otherwise gains permission to modify its default branch.
  2. The attacker adds malicious package initialization, build-backend behavior, or runtime code to the repository.
  3. A user or automated environment follows the documented pip install git+https://... command.
  4. pip retrieves the attacker-controlled current repository state rather than the revision covered by this audit.
  5. Malicious build or installation behavior executes with the privileges of the user running pip. Malicious runtime behavior may subsequently execute whenever the installed CLI is invoked.

Impact Assessment

...[truncated 639 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin VCS installations to a reviewed full commit SHA:

    bash
    pip install "git+https://github.com/minirr890112-byte/openai-ban-tracker.git@FULL_COMMIT_SHA"

  2. Prefer publishing versioned, immutable releases to a trusted package registry.

  3. Provide a locked dependency file with reviewed versions rather than relying only on unrestricted minimum versions.

  4. For registry-based distribution, publish hashes and instruct users or CI systems to install with hash verification, such as pip install --require-hashes.

  5. Protect the source repository with mandatory multi-factor authentication, branch protection, required reviews, and signed release tags.

  6. Update both SKILL.md and README.md so that all documented installation paths refer to the same immutable, reviewed release.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (15)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
88% confidence
Finding

The README instructs users to install directly from a GitHub repository via pip install git+https://..., which bypasses curated package distribution safeguards and encourages execution of whatever code is present at the referenced repo state. If the repository is compromised, force-pushed, or replaced with malicious install hooks, users could execute attacker-controlled code during installation.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

🔍 openai-ban-tracker

OpenAI 封号风险检测与解封追踪 CLI 工具。

背景: 2026年6月，OpenAI 再次大规模封号，V2EX 社区 24 小时内出现 23 回复 + 18 回复两个热帖。用户困惑于为什么被封、如何申诉、是否会解封。

安装

bash
pip install git+https://github.com/minirr890112-byte/openai-ban-tracker.git

快速开始

bash
# 1. 查看社区最新动态
openai-ban-tracker status

# 2. 检测你的账号风险
openai-ban-tracker risk-check

# 3. 了解常见封号原因
openai-ban-tracker ban-reasons

# 4. 生成申诉邮件模板
openai-ban-tracker appeal --lang zh
openai-ban-tracker appeal --lang en --output appeal.txt

# 5. 实时扫描社区信号
openai-ban-tracker scan

🌐 生态系统

ToolDescription
cursor-doctorCursor

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
94% confidence
Finding

The quick-start instructs users to install directly from a remote GitHub repository using pip install git+https://..., which executes setup/build/install code from the remote source without pinning a reviewed release. This creates a supply-chain risk: if the repository, dependency chain, or referenced revision is compromised, users may run attacker-controlled code during installation.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

sk, why people get banned, or how to appeal. Your API key stops working and your ChatGPT is gone.

The solution: 9-question interactive risk assessment gives you a 0-100 ban risk score. 8 confirmed ban reasons with real patterns, prevention tips, and appeal success rates. Chinese and English appeal email templates with proven strategies. Real-time V2EX signal scanner.

Quick Start

bash
pip install git+https://github.com/minirr890112-byte/openai-ban-tracker.git

openai-ban-tracker risk-check     # 9-question risk assessment
openai-ban-tracker ban-reasons    # 8 known ban causes
openai-ban-tracker appeal --lang zh  # Chinese appeal template
openai-ban-tracker appeal --lang en  # English appeal template
openai-ban-tracker status         # Community ban/unban signals
openai-ban-tracker scan           # Real-time V2EX scan

Real Output

text
$ openai-ban-tracker risk-check

⚠️  OpenAI Ban Risk Assessment
──────────────────────

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language content of the skill documentation is almost entirely in Chinese, including installation guidance, command explanations, and privacy notes. The policy only permits a fixed language when there is user opt-in or a clearly justified region-specific constraint, neither of which is stated here.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises capabilities that imply network access and possible file writing, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem this weakens least-privilege controls, making it harder for reviewers and runtime policy to constrain what the skill may do if installed or invoked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module description and nearly all user-facing CLI text are in Chinese, and the appeal command defaults --lang to zh. This imposes a specific language/locale by default rather than offering a neutral or explicitly user-chosen language experience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The primary command description and interactive guidance are presented in Chinese, with no global locale selection for the CLI itself. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The scan command makes live outbound HTTP requests to V2EX without a clear upfront warning that running the command will contact a third-party service and disclose the user's IP address and request metadata. While this is expected for a networked scanner, the missing disclosure creates a privacy and transparency issue, especially in a security-sensitive CLI where users may assume all processing is local based on nearby messaging elsewhere in the tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The RiskLevel labels are defined only in Chinese string literals, which imposes a specific locale in user-facing output. Under the stated policy, forcing a language without user choice is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

All questions in RISK_QUESTIONS are Chinese-only and appear intended for direct user interaction. Because the file does not offer an English or configurable alternative for these prompts, it violates the language/locale policy for all file types.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description explicitly states 'Chinese/English appeal templates,' which constrains output languages to two specific locales. Under the policy, locale restrictions should either offer user choice more generally or be clearly justified as region-specific; no such justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The top-level natural-language description is entirely in Chinese and does not indicate that language selection is optional. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The appeal command accepts --output and writes content directly with open(output, "w"), which can overwrite an existing file. While the success message appears after writing, there is no prior warning, confirmation, or comment/docstring alerting the user that a local file will be created or replaced.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language description is written only in Chinese ("OpenAI 封号风险检测与解封追踪 CLI") with no indication that users can choose another language or that the package is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: click has 1 known advisory(ies) (CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.