Batch Compile

• Outcome: Review
• Latest audit: Jun 24, 2026 · 2:37 PM UTC
• Version: 1.1.2

Overview

The skill’s batch import workflow is mostly coherent, but it requires broad Gitea administrative authority and creates persistent control-plane state beyond a narrow import task.

Review this skill before installing in any shared or production OpenClaw environment. Use a narrowly scoped Gitea service account if possible, restrict which repositories it can read and write, protect the .env file, confirm where the system-config repository will live, and pin dependencies before processing untrusted zip, PDF, DOCX, or spreadsheet inputs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill orchestrates shell commands, reads and writes local files under /tmp, and accesses network-backed sources such as Gitea repositories, yet it declares no explicit permissions or capability boundaries. This creates a real security governance gap: reviewers and runtime policy engines cannot reliably enforce least privilege, and the skill handles untrusted repository URLs, zip uploads, and callback values that increase the risk from overbroad implicit access.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This helper can create repositories and modify collaborators, which exceeds a narrowly scoped 'batch compile existing sources' role and introduces administrative side effects. In a skill that processes imported content, these capabilities expand blast radius if the skill is misused, misconfigured, or invoked on untrusted inputs.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module is designed to use a site-admin Gitea token and exposes admin-only operations, creating unnecessary privilege for a content compilation workflow. If the skill or host is compromised, the token enables broad administrative actions across the Gitea instance rather than limiting impact to a single repository.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This module creates and maintains a persistent 'system-config' control-plane repository containing users, teams, chat bindings, permissions, sources, jobs, and task state, which materially exceeds a batch-compilation/import function. In a skill advertised for compiling/importing knowledge sources, hidden control-plane state introduces unauthorized data persistence and administrative capability that could be abused for surveillance, access control changes, or long-lived state tracking outside user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The initialization of chat binding, pending binding, event logging, and invite-code support is not necessary for batch compilation and suggests hidden identity/linking capabilities. In this context, those features enable associating chat identities with repository-side records and onboarding flows without a clear need, increasing the risk of covert user mapping or unauthorized workspace enrollment.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Managing a permissions registry inside an import/compile skill is a context mismatch and expands the blast radius from content ingestion to access-control administration. If other code trusts this repository as an authority, unauthorized or unintended writes could alter privileges or create confused-deputy behavior across the broader system.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: These functions perform remote state-changing operations—creating repositories and altering collaborator permissions—without any confirmation or visible guardrails in this module. In an agent skill context, silent side effects are risky because they can be triggered indirectly by higher-level automation or prompt-driven workflows.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The file write helpers can create or overwrite remote repository contents and include fallback logic that retries updates on existing files. In an automated skill, this can cause unintended content tampering or propagation if inputs are wrong, repos are mis-targeted, or the skill is abused.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: ensure_system_repo() performs remote repository creation and writes multiple files automatically, but the code shows no visible disclosure, confirmation, or user-facing indication that persistent remote state is being established. In a batch-import skill, silent side effects are dangerous because users may expect temporary processing rather than creation of a durable control repository containing operational metadata.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: write_json() updates remote files in the system repository without any local indication of approval, provenance, or user notification. This lack of transparency makes unauthorized state changes harder to detect and can conceal administrative or tracking behavior inside a skill that appears to only process source material.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: update_json() implements a generic read-modify-write primitive over the system control repository, enabling arbitrary mutation of persistent state with retries, but without visible disclosure or built-in policy checks. In this skill context, a generic silent mutation API is risky because it can support hidden expansion from import tracking into broader account, team, or permission management.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

_load_env()

GITEA_URL = os.environ.get("GITEA_URL", "").rstrip("/")
ADMIN_TOKEN = os.environ.get("GITEA_ADMIN_TOKEN", "")
BOT_USERNAME = os.environ.get("GITEA_BOT_USERNAME", "AIFusionBot")

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
set -e
python3 -m pip install -r requirements.txt
if [ ! -f .env ]; then cp env-example.txt .env; fi
echo "setup complete"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx

• Confidence: 95% confidence
• Finding: The dependency list is unpinned, so installs may resolve to different versions over time, including newly introduced vulnerable or incompatible releases. In a skill that batch-processes imported material from external sources, this weakens supply-chain integrity and makes builds less reproducible and harder to audit.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl

• Confidence: 95% confidence
• Finding: python-dotenv is declared without a version pin, allowing uncontrolled version drift during installation. While unpinned dependencies are often operationally convenient, they increase exposure to supply-chain compromise, regressions, and accidental adoption of vulnerable releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl
xlrd

• Confidence: 95% confidence
• Finding: PyMuPDF is unpinned, which permits future installs to fetch arbitrary newer versions that may contain exploitable flaws or breaking behavior. Because this skill appears to process document content in bulk, dependency instability in parsing libraries increases the risk surface materially.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl
xlrd

• Confidence: 97% confidence
• Finding: python-docx is unpinned, leaving the install open to version drift and potential retrieval of vulnerable releases. In a document-ingestion workflow, parser libraries are security-sensitive because they may handle attacker-controlled files, making unpinned usage more dangerous than a purely internal utility dependency.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv
pymupdf
python-docx
openpyxl
xlrd

• Confidence: 97% confidence
• Finding: openpyxl is unpinned, so installations are not reproducible and may silently pick up vulnerable or incompatible versions. Since spreadsheet files may be imported from external repositories or zip archives, reliance on an unpinned parser raises supply-chain and parser-exposure risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymupdf
python-docx
openpyxl
xlrd

• Confidence: 93% confidence
• Finding: xlrd is also unpinned, creating the same reproducibility and supply-chain risks as the other packages. Even if not currently tied to a listed advisory here, unpinned document-processing libraries can later resolve to insecure releases without code changes.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The requirements file includes requests without a version pin, and the scanner associates that package with multiple known advisories. Because no version is specified, resolution may install a vulnerable release, and in a skill that likely interacts with remote repositories or URLs, flaws such as credential leakage or TLS/session verification issues can expose secrets or enable man-in-the-middle style attacks.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 67% confidence
• Finding: The scanner reports a python-dotenv advisory related to symlink following in set_key, and the package is included without version constraints. This is only exploitable if the skill actually invokes vulnerable write/update functionality on attacker-influenced .env paths, but the unpinned requirement means a vulnerable version could be installed.

Known Vulnerable Dependency: pymupdf — 1 advisory(ies): CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)

Low

• Category: Supply Chain
• Confidence: 64% confidence
• Finding: The reported PyMuPDF issue concerns path traversal in its command-line entrypoint, and the package is present unpinned. This is somewhat context-dependent because exploitation may require use of the affected CLI path-handling behavior, but given the batch-import nature of the skill and likely file handling, a vulnerable version still represents avoidable risk.

Known Vulnerable Dependency: python-docx — 2 advisory(ies): CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: python-docx has a known XXE issue in older versions, and no safe version is pinned here. In a skill designed to import and compile material from external repositories or archives, processing attacker-supplied DOCX content with a vulnerable XML parser can lead to local file disclosure, SSRF, or parser abuse depending on runtime configuration.

Static analysis

No suspicious patterns detected.