ClawHub
Back to skill

Security audit

06 AI总结

Security checks for vulnerabilities and agentic risk

Overview

This AI summarization skill is mostly aligned with its purpose, but it has review-worthy privacy and supply-chain risks around unreviewed code imports, external AI provider use, and local plaintext retention of submitted content.

Review this skill before installing. It may send your submitted content to configured AI providers, stores full input text locally in a plaintext SQLite database at ~/.ai_summary.db during normal use, and relies on a parent-directory llm_client module that is not included in the reviewed artifact. Use it only with content you are allowed to share with those providers, install it in an isolated Python environment, and verify the llm_client source before entering API keys or confidential material.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T07 · Tool Hijacking and Spoofing

Error
Location
summary_review_llm.py:14
Finding

Untrusted Parent-Directory Module Import Enables Local Tool Hijacking

Content
View full analysis

Vulnerability Details

File Location: summary_review_llm.py:14-17
Vulnerability Type: Untrusted Python import path manipulation
Risk Level: High

Vulnerable Code

python
import sys

# Import the universal LLM client
sys.path.insert(0, str(Path(__file__).parent.parent))
from llm_client import UniversalLLMClient

Technical Analysis

The script prepends its parent directory to sys.path before importing llm_client. The llm_client module is not included in the audited project and is not declared as an installed dependency.

Because the parent directory is placed first in Python's module search path, any llm_client.py file or llm_client package located there will be imported and its module-level code executed. The Skill therefore delegates critical network and credential handling to unreviewed code outside its package boundary.

This also prevents verification of the external LLM endpoints, TLS configuration, API-key handling, and content-transmission behavior identified by the static pre-scan.

Attack Path

  1. An attacker, compromised installer, or another package gains the ability to place files in the parent directory of the Skill.
  2. The attacker creates a malicious llm_client.py or llm_client package in that directory.
  3. A user launches summary_review_llm.py.
  4. The script inserts the parent directory at the beginning of sys.path.
  5. Python imports and executes the attacker's module as llm_client.
  6. The malicious module can capture API keys and summarized content or run arbitrary commands with the invoking user's privileges.

Impact Assessment

Successful exploitation provides arbitrary Python code execution under the account running the Skill. The malicious module can access files and environment variables available to that account, including configured LLM API keys, intercept content submitted for summarization, modify generated output, and initiate unauth ...[truncated 164 chars]

Remediation
View remediation

Remediation Suggestions

  • Package the reviewed LLM client inside the Skill and use an explicit package-relative import.
  • Remove the sys.path.insert modification.
  • Declare the client as a version-locked dependency if it must remain a separate package.
  • Verify dependency provenance and integrity with hashes.
  • Fail safely when the expected client is unavailable rather than searching an uncontrolled parent directory.
  • Apply an allowlist to supported providers and network destinations.
  • Add tests that verify the resolved module path is inside the expected package or virtual environment.

T09 · Insecure Skill Coding Practices

Warning
Location
summary_review_llm.py:254
Finding

Potentially Sensitive Source Content Is Persisted in a Plaintext SQLite Database

Content
View full analysis

Vulnerability Details

File Location: summary_review_llm.py:254-300, 418-421
Vulnerability Type: Undisclosed plaintext storage of user content
Risk Level: Medium

Vulnerable Code

python
def __init__(self, db_path: str = None):
    if db_path is None:
        db_path = Path.home() / ".ai_summary.db"

    self.db_path = Path(db_path)
    self._init_db()

def _init_db(self):
    """Initialize database"""
    conn = sqlite3.connect(self.db_path)
    cursor = conn.cursor()

    cursor.execute('''
        CREATE TABLE IF NOT EXISTS summaries (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            title TEXT,
            type TEXT,
            content TEXT NOT NULL,
            summary_data TEXT NOT NULL,
            provider TEXT,
            created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
        )
    ''')

    cursor.execute('CREATE INDEX IF NOT EXISTS idx_type ON summaries(type)')
    cursor.execute('CREATE INDEX IF NOT EXISTS idx_created_at ON summaries(created_at)')

    conn.commit()
    conn.close()

def save(self, title: str, content: str, summary_data: Dict, provider: str = None) -> int:
    """Save summary"""
    conn = sqlite3.connect(self.db_path)
    cursor = conn.cursor()

    summary_data['provider'] = provider or summary_data.get('provider', 'unknown')

    cursor.execute('''
        INSERT INTO summaries (title, type, content, summary_data, provider)
        VALUES (?, ?, ?, ?, ?)
    ''', (
        title,
        summary_data.get('type', 'general'),
        content,
        json.dumps(summary_data, ensure_ascii=False),
        summary_data.get('provider', 'unknown')
    ))

    summary_id = cursor.lastrowid
    conn.commit()
    conn.close()

    return summary_id
python
summary = self.summarizer.summarize(content, content_type)

# Save to database
if title:
    self.storage.save(title, content, summary, 
...[truncated 1812 chars]
Remediation
View remediation

Remediation Suggestions

  • Default to no persistence and request explicit user consent before saving original content.
  • Store only the generated summary unless retaining source content is necessary and specifically requested.
  • Create the database with owner-only permissions and verify its final mode.
  • Encrypt sensitive records using a securely managed key when persistent source storage is required.
  • Implement record deletion, database clearing, configurable retention periods, and automatic expiration.
  • Clearly document what data is stored, where it is stored, and how users can remove it.
  • Provide a private-session mode that disables all history storage.
  • Avoid mutating caller-owned summary_data while preparing database records.

T08 · Insecure Dependencies

Warning
Location
install.sh:17
Finding

Installer Fetches Unpinned Dependencies into the Active Python Environment

Content
View full analysis

Vulnerability Details

File Location: install.sh:17-29; requirements.txt:1-9
Vulnerability Type: Unpinned dependency installation and environment contamination
Risk Level: Medium

Vulnerable Code

bash
# Install dependencies
echo ""
echo "Installing dependencies..."

# OpenAI-compatible SDK
pip install openai -q

# Anthropic SDK (optional)
read -p "Install Anthropic Claude support? (y/n): " install_claude

if [ "$install_claude" = "y" ]; then
    pip install anthropic -q
    echo "Anthropic SDK installed"
fi
text
# AI Summary Review Skill v2.0 dependencies

# Core dependency
openai>=1.0.0

# Optional dependency
anthropic>=0.18.0

# No additional dependencies are required

Technical Analysis

The installation script downloads the current openai and optional anthropic releases without exact version pins, upper bounds, lock-file resolution, or package hashes. It invokes the generic pip executable rather than python3 -m pip, so the selected installer may not correspond to the Python interpreter used by the Skill.

The script also installs into the currently active environment. Although the generated launcher can activate an existing venv, the installer neither creates nor activates one before running pip. This can modify a user-wide, system-wide, or unrelated project environment.

The requirements file only specifies minimum versions, while the installer does not use it at all. The effective dependency graph can therefore change after the Skill has been reviewed.

Attack Path

  1. A user runs install.sh.
  2. The shell resolves whichever pip executable appears first in PATH.
  3. pip queries its configured package index and resolves the latest compatible packages and transitive dependencies.
  4. A compromised package release, compromised configured index, or unexpectedly unsafe future dependency version is downloaded.
  5. Installation modif ...[truncated 625 chars]
Remediation
View remediation

Remediation Suggestions

  • Create and activate a dedicated virtual environment before installing dependencies.
  • Use python3 -m pip to ensure the installer matches the runtime interpreter.
  • Maintain a reviewed lock file containing exact versions of direct and transitive dependencies.
  • Require package hashes, for example through pip's --require-hashes mode.
  • Install from the lock file instead of issuing independent package installation commands.
  • Add upper version bounds where exact locking is not feasible.
  • Document and restrict trusted package indexes.
  • Avoid quiet installation during security-sensitive setup so users can review the selected versions and source.
  • Scan and update locked dependencies through a controlled maintenance process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises executable capabilities consistent with file writing and shell access, but the manifest does not declare any tool scope or permission boundary. That creates an authorization gap: an agent or reviewer cannot easily determine what the skill is allowed to do, increasing the risk of unintended command execution or filesystem modification if the linked script is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill is designed to send user-provided content to third-party LLM providers, but the description does not warn users that their data may leave the local environment. In a summarization/review context, users may submit work logs, meeting notes, or project data containing sensitive business or personal information, so the omission can lead to unintentional data disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

All prompts and status messages in the installer are presented only in Chinese, and the file does not provide an opt-in, alternative language, or justification for the locale restriction. This can violate language/locale policy when a skill imposes a single language on all users without choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The summarize method sends arbitrary user content to an external LLM provider via self.client.summarize without an explicit warning or consent flow at the call site. Because summarization inputs often include sensitive business or personal text, silent third-party transfer creates a real privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The project review flow sends project name, goals, results, and metrics to an external LLM through the chat API without warning the user that third parties will process that information. In this skill context, project retrospectives are especially likely to include internal strategy, delivery issues, or performance metrics, making the disclosure more sensitive than generic text processing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill’s primary stated purpose is summarization and project review, but it also stores full user-provided content in a local SQLite database and supports writing exported Markdown files to disk. That expands data retention and local file side effects beyond what many users would reasonably expect from a summarization tool, creating confidentiality and privacy risk if sensitive notes, meeting content, or project data are processed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code saves raw input content into a database under the user’s home directory (~/.ai_summary.db), which may contain confidential text such as reports, meetings, or project retrospectives. Even though this is local rather than remote exfiltration, undisclosed retention of sensitive data increases exposure to other local users, backups, malware, or accidental disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The natural-language instructions and examples are entirely in Chinese, and the skill does not indicate that this language choice is optional, configurable, or region-specific. This can violate a language/locale policy when users are not given an explicit opt-in or alternative language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This shell script creates and chmods a new file named run.sh, which is a file-system modification. Although the script logs that installation is occurring, it does not explicitly disclose beforehand that it will create an executable file in the working directory or potentially overwrite an existing one.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The installation output includes guidance to set ZHIPU_API_KEY, which involves handling sensitive credentials. There is no accompanying warning to avoid sharing keys, storing them insecurely, or exposing them in shell history or logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language comments in this file are entirely in Chinese, including the skill description and usage note. This can indicate a language-specific constraint without any documented user choice or opt-in, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

Using an unpinned dependency range for openai allows different versions to be installed over time, making builds non-reproducible and increasing supply-chain risk if a future release introduces a vulnerability or breaking behavior. In an AI skill that depends on external model SDKs, this can unexpectedly change authentication, request handling, or tool behavior across deployments.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
# AI总结复盘技能 v2.0 依赖

# 核心依赖（支持多个大模型）
openai>=1.0.0

# 可选依赖
anthropic>=0.18.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The anthropic dependency is also unpinned, which creates non-reproducible installs and increases exposure to vulnerable or incompatible future releases. This is more concerning here because the static analysis already indicates known advisories in this package family, so leaving the version open makes it impossible to verify whether deployments are safe.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text
openai>=1.0.0

# 可选依赖
anthropic>=0.18.0

# 注意：无需额外依赖，技能可与基础版共存

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The manifest includes anthropic without a fixed version even though known advisories exist for that package. Because the installed version is not constrained, consumers of the skill cannot verify whether they are pulling a safe release, creating a realistic supply-chain exposure and making incident response harder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

Natural-language strings, prompts, and CLI text are presented only in Chinese throughout the skill, effectively forcing a specific language for interaction. The file does not indicate that Chinese is optional, configurable, or justified as a region-specific constraint.

Content

No source excerpt is available for this finding.