Security audit

ClawVision Plus

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but its Telegram-sharing path handles bot credentials and message content in ways users should review before installing.

Review this before installing if you plan to use Telegram sharing. Prefer providing the bot token through an environment variable or secret manager, rotate any token already used on the command line, restrict the bot's channel permissions, and avoid sending summaries from untrusted sources until Telegram captions are escaped. Use a virtual environment with pinned dependency versions where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extend_visual.py:231
Finding: Telegram bot token exposed through command-line arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extend_visual.py:178
Finding: Summary content is inserted into Telegram HTML without escaping
Content: View full analysis
str: """Build a Telegram-friendly text version from the summary.""" lines = [ f"{summary.get('title', 'ClawVision summary')}", f"{summary.get('subtitle', '')}", "", f"Main takeaway: {summary.get('main_takeaway', '')}", "", "What we built:", ] for c in summary.get("checklist", []): icon = "✅" if c.get("status") == "ready" else "🕐" if c.get("status") == "pending" else "🚫" lines.append(f"{icon} {c.get('text', '')}") lines.append("") lines.append("Next steps:") for s in summary.get("next_steps", []): lines.append(f"• {s}") return "\n".join(lines) ``` The resulting content is sent with Telegram HTML parsing enabled: ```python text = caption or _html_to_text_for_telegram(summary, html_path) if len(text) > 1024: bot = telegram.Bot(token=bot_token) with open(photo_path, "rb") as photo: bot.send_photo(chat_id=chat_id, photo=photo) bot.send_message(chat_id=chat_id, text=text, parse_mode=ParseMode.HTML) else: bot = telegram.Bot(token=bot_token) with open(photo_path, "rb") as photo: bot.send_photo(chat_id=chat_id, photo=photo, caption=text, parse_mode=ParseMode.HTML) ``` ### Technical Analysis The title, subtitle, main takeaway, checklist text, and next-step entries originate in the summary JSON. These values are interpolated into a string that is interpreted by Telegram using `ParseMode.HTML`, but the values are not HTML-escaped. An attacker who can influence the summary JSON can inject Telegram-supported HTML markup. For example, an injected anchor element can display trusted-looking text while linking to an atta ...[truncated 1599 chars]
Remediation: View remediation
str: title = html.escape(str(summary.get("title", "ClawVision summary")), quote=True) subtitle = html.escape(str(summary.get("subtitle", "")), quote=True) takeaway = html.escape(str(summary.get("main_takeaway", "")), quote=True) lines = [ f"{title}", f"{subtitle}", "", f"Main takeaway: {takeaway}", "", "What we built:", ] for item in summary.get("checklist", []): status = item.get("status") icon = "✅" if status == "ready" else "🕐" if status == "pending" else "🚫" item_text = html.escape(str(item.get("text", "")), quote=True) lines.append(f"{icon} {item_text}") lines.extend(["", "Next steps:"]) for step in summary.get("next_steps", []): lines.append(f"• {html.escape(str(step), quote=True)}") return "\n".join(lines) ``` Additionally: - Escape custom captions by default, or offer a separate explicitly named option for trusted HTML captions. - Validate summary field types before formatting them. - Add tests containing `<`, `>`, `&`, quotes, malformed tags, and deceptive anchor elements. - Catch Telegram parsing errors and return a controlled error without leaking credentials. - Consider sending plain text without `ParseMode.HTML` when rich formatting is unnecessary. ]]>

T08 · Insecure Dependencies

Note

Location: references/requirements.txt:1
Finding: Third-party dependencies use open-ended version constraints without integrity verification
Content: View full analysis
=1.41.0 Pillow>=10.0.0 python-telegram-bot>=20.7 reportlab>=4.0.0 ``` The documentation also recommends unconstrained direct installation: ```text Pillow (`pip install Pillow`) reportlab (`pip install reportlab`) python-telegram-bot (only for Telegram sharing: `pip install python-telegram-bot`) ``` ### Technical Analysis All dependencies use minimum-version constraints without upper bounds, exact pins, a lockfile, or package hashes. As a result, installations performed at different times may resolve to different package versions that were not present when the skill was reviewed. The listed package names are consistent with the skill's functionality, and no typosquatted or demonstrably malicious package was identified. The risk arises from accepting future releases without review and from the absence of integrity constraints. A compromised upstream release, dependency account, or transitive dependency could therefore enter the installation automatically. ### Attack Path 1. A user or automation environment installs the requirements at a later date. 2. The package resolver selects the latest versions satisfying the open-ended `>=` constraints. 3. A selected direct or transitive package contains compromised installation or runtime code, or introduces a security regression. 4. The package executes during installation, import, browser rendering, image processing, PDF generation, or Telegram communication. 5. The compromised code runs with the same operating-system privileges as the user or service executing the skill. This path depends on an upstream compromise or unsafe future release; the audited requirements file itself does not establish that any current listed package is malicious. ### Impact Assessment A compromised depe ...[truncated 389 chars]
Remediation: View remediation
--hash=sha256: Pillow== --hash=sha256: python-telegram-bot== --hash=sha256: reportlab== --hash=sha256: ``` The concrete versions and hashes should be generated from a tested build rather than selected without validation. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with a lower-bound constraint only, which makes builds non-reproducible and allows future installs to pull in unexpected versions. While this file alone does not prove exploitation, unpinned packages increase supply-chain risk and make it harder to verify whether known-vulnerable or breaking releases will be installed.
Content: Scanner excerpt · references/requirements.txt (reported line 1)May include surrounding context.
text
playwright>=1.41.0 Pillow>=10.0.0 python-telegram-bot>=20.7 reportlab>=4.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: Pillow is unpinned and has a history of security advisories, so using only a minimum version leaves the actual installed version uncertain. If this skill processes untrusted images, a vulnerable Pillow release could expose the environment to denial of service or, in some versions, code-execution-style risks.
Content: Scanner excerpt · references/requirements.txt (reported line 2)May include surrounding context.
text
playwright>=1.41.0 Pillow>=10.0.0 python-telegram-bot>=20.7 reportlab>=4.0.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: This is a true supply-chain risk because Pillow has numerous known advisories and the manifest does not pin a version, so it is impossible to determine whether installs are safe. The skill context increases concern: image handling is central to the plugin, so a vulnerable Pillow build could be reachable through normal feature use with untrusted files.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The Telegram bot library is unpinned, creating the same reproducibility and supply-chain uncertainty issues as the other entries. There is no direct evidence in this file of a known exploitable version being selected, but broad version ranges still increase exposure to accidental upgrades or compromised releases.
Content: Scanner excerpt · references/requirements.txt (reported line 3)May include surrounding context.
text
playwright>=1.41.0 Pillow>=10.0.0 python-telegram-bot>=20.7 reportlab>=4.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: ReportLab is unpinned despite a history of serious advisories, including RCE- and SSRF-related issues in some versions. In the context of a plugin that adds PDF generation, this is more dangerous because the package is likely used on attacker-influenced content, making version uncertainty materially relevant.
Content: Scanner excerpt · references/requirements.txt (reported line 4)May include surrounding context.
text
playwright>=1.41.0 Pillow>=10.0.0 python-telegram-bot>=20.7 reportlab>=4.0.0

Unverifiable Dependency: reportlab has 8 known advisory(ies) (CVE-2023-33733 (Reportlab vulnerable to remote code execution); CVE-2020-28463 (Server-side Request Forgery (SSRF) via img tags in reportlab); CVE-2019-19450 (ReportLab vulnerable to remote code execution via paraparser) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: This is a true vulnerability because reportlab has known serious advisories and the unpinned manifest prevents verification that a patched release will be installed. Given the plugin explicitly adds PDF functionality, the dependency is likely exposed in production paths, which makes historical RCE/SSRF issues in ReportLab especially relevant and more dangerous here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.