ClawHub
Back to skill

Security audit

AI资讯网站生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it needs review because it can delete an arbitrary chosen output directory and generates a web service with exposed unsafe defaults and vulnerable dependencies.

Use this only in a disposable or clearly chosen workspace, and do not point the generator at an existing project, home directory, repository root, or any sensitive path. Before deploying the generated site, update dependencies, add lockfiles or hashes, restrict CORS, bind the backend appropriately, protect or rate-limit /api/refresh, and review how to stop Docker containers or local background processes.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate-project.py:26
Finding

Unrestricted Recursive Deletion of a User-Selected Output Directory

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
templates/backend-main.py:145
Finding

Unauthenticated Refresh Endpoint Permits Remote Resource Exhaustion

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
templates/backend-main.py:14
Finding

Overly Permissive Cross-Origin Resource Sharing Configuration

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
templates/start.sh:68
Finding

Runtime Dependency Installation Without Lockfiles or Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Known Vulnerable Dependency: next==15.0.0 — 16 advisory(ies): GHSA-2xp9-vwfh-vxw4 (Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AV); CVE-2026-44573 (Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n); CVE-2026-44572 (Next.js's Middleware / Proxy redirects can be cache-poisoned) +13 more

Critical
Category
Supply Chain
Confidence
99% confidence
Finding

The manifest pins Next.js to exactly 15.0.0, and the static analysis reports multiple known advisories against that precise version, including critical issues such as unauthenticated remote code execution and middleware/proxy bypasses. In a web application generator, shipping a template with a known vulnerable framework version can directly propagate exploitable flaws into generated sites.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High
Category
Supply Chain
Confidence
70% confidence
Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-multipart==0.0.6 — 16 advisory(ies): CVE-2024-24762 (python-multipart vulnerable to Content-Type Header ReDoS); CVE-2024-53981 (Denial of service (DoS) via deformation `multipart/form-data` boundary); CVE-2026-53539 (python-multipart: Quadratic-time querystring parsing with semicolon separators c) +13 more

High
Category
Supply Chain
Confidence
98% confidence
Finding

python-multipart==0.0.6 is an old version with multiple reported multipart parsing denial-of-service issues, including Content-Type header ReDoS and malformed boundary handling. In a FastAPI backend, this package is especially relevant because it is commonly used to process form-data and file uploads, so a remote attacker may be able to trigger excessive CPU or resource consumption with crafted requests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill instructs the user to run a local Python generator, create a full project tree, use Docker Compose, and access network resources, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens transparency and reviewability, making it easier for a consumer or agent to invoke file writes, shell execution, and network activity without clear prior authorization boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The generated layout sets <html lang="zh-CN">, and surrounding generated content and user-facing strings are also Chinese-centric. This imposes a specific language/locale on all generated projects without opt-in, which matches the policy-violation category for forced language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code explicitly formats dates using the 'zh-CN' locale, and the visible interface text throughout the page is Chinese-only. This creates a natural-language/locale policy issue because the skill imposes a specific language and locale without user opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script presents its user-facing interface entirely in Chinese, beginning with the title banner and continuing throughout prompts and status messages. The policy requires avoiding forced language or locale constraints unless the user is given a choice or the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · templates/start.sh (reported line 74)May include surrounding context.

sh
# 启动后端（后台）
echo "启动后端服务 (端口 8000)..."
nohup python3 -m uvicorn main:app --host 0.0.0.0 --port 8000 --reload > backend.log 2>&1 &
BACKEND_PID=$!
echo "后端 PID: $BACKEND_PID"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill tells the user to run a generator script and then start the resulting stack with docker-compose, but it does not clearly warn that these actions will create files on disk and launch persistent local services and containers. This is dangerous mainly from a safety and consent perspective: users may trigger system changes, port bindings, or background workloads without understanding the local side effects.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 12)May include surrounding context.

json
"lint": "next lint"
  },
  "dependencies": {
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "next": "15.0.0"
  },

Unverifiable Dependency: react has 2 known advisory(ies) (CVE-2013-7035 (Cross-Site Scripting in react); GHSA-hg79-j56m-fxgv (Cross-Site Scripting in react)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 13)May include surrounding context.

json
},
  "dependencies": {
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "next": "15.0.0"
  },
  "devDependencies": {

Unverifiable Dependency: react-dom has 1 known advisory(ies) (CVE-2018-6341 (Cross-Site Scripting in react-dom)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 17)May include surrounding context.

json
"next": "15.0.0"
  },
  "devDependencies": {
    "typescript": "^5",
    "@types/node": "^20",
    "@types/react": "^19",
    "@types/react-dom": "^19",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 18)May include surrounding context.

json
},
  "devDependencies": {
    "typescript": "^5",
    "@types/node": "^20",
    "@types/react": "^19",
    "@types/react-dom": "^19",
    "tailwindcss": "^3.4.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 19)May include surrounding context.

json
"devDependencies": {
    "typescript": "^5",
    "@types/node": "^20",
    "@types/react": "^19",
    "@types/react-dom": "^19",
    "tailwindcss": "^3.4.0",
    "postcss": "^8",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 20)May include surrounding context.

json
"typescript": "^5",
    "@types/node": "^20",
    "@types/react": "^19",
    "@types/react-dom": "^19",
    "tailwindcss": "^3.4.0",
    "postcss": "^8",
    "autoprefixer": "^10.0.1"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 21)May include surrounding context.

json
"@types/node": "^20",
    "@types/react": "^19",
    "@types/react-dom": "^19",
    "tailwindcss": "^3.4.0",
    "postcss": "^8",
    "autoprefixer": "^10.0.1"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 22)May include surrounding context.

json
"@types/react": "^19",
    "@types/react-dom": "^19",
    "tailwindcss": "^3.4.0",
    "postcss": "^8",
    "autoprefixer": "^10.0.1"
  }
}

Unverifiable Dependency: postcss has 7 known advisory(ies) (CVE-2021-23382 (Regular Expression Denial of Service in postcss); CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2023-44270 (PostCSS line return parsing error) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · templates/frontend-package.json (reported line 23)May include surrounding context.

json
"@types/react-dom": "^19",
    "tailwindcss": "^3.4.0",
    "postcss": "^8",
    "autoprefixer": "^10.0.1"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
templates/frontend-page.tsx:26