ClawHub
Back to skill

Security audit

BimDown 中文

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for BIM modeling, but it asks for an unpinned global npm install and gives a direct ZIP download-and-unzip command that should be reviewed before use.

Install only if you are comfortable approving a global npm package install from the npm registry. Prefer a pinned/local bimdown-cli install in a sandbox, review shared ZIP contents before extraction, and treat publish links as public because uploaded project names, geometry, rooms, materials, notes, CSV/SVG, GLB files, and metadata leave your machine.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Unpinned Global npm Dependency May Execute Unreviewed Code

Content
View full analysis
Remediation
View remediation
``` 2. Prefer a project-local installation over `npm install -g`, and invoke it through a controlled local path or `npm exec` with an exact version. 3. Commit and enforce a lockfile containing resolved versions and integrity hashes. 4. Verify the expected npm registry, package publisher, package signature or provenance, and artifact checksum before installation. 5. Review both the direct package and its transitive dependencies whenever the pinned version is updated. 6. Disable lifecycle scripts with `--ignore-scripts` where the CLI does not require them. If scripts are required, inspect them before installation and execute the installation in a restricted environment. 7. Avoid elevated installation. Run dependency setup as an unprivileged account in a sandbox or container with minimal filesystem, credential, and network access. 8. Retain the existing explicit-consent requirement, but disclose the exact version, registry, script-execution behavior, and installation scope in the consent prompt. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill's operative instructions begin in Chinese and continue throughout the document, effectively constraining the interaction and instruction set to a specific language. There is no explicit user opt-in or alternative language choice documented here, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill instructs the agent to fetch a remote ZIP via curl and immediately unzip it into a local directory. This creates a supply-chain ingestion risk: untrusted remote content can introduce malicious files, path traversal via archive entries, or unsafe project contents that later influence agent behavior or downstream tools.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
9. **`bimdown resolve-topology <dir>`**: 为机电(MEP)管线自动检测共点端点，生成 `mep_nodes` 并填充连接字段。
10. **`bimdown merge <dirs...> -o <output>`**: 将多个项目目录合并为一个整合模型，自动解决 ID 冲突。
11. **`bimdown sync <dir>`**: 将数据水合到 DuckDB，然后再脱水写回 CSV/SVG，以此来应用默认计算值。
12. **下载他人共享的项目**: 若用户提供分享链接如 `https://bim-claw.com/s/<token>`，在末尾加上 `/download` 下载压缩包：`curl -L https://bim-claw.com/s/<token>/download -o project.zip && unzip project.zip -d project/`

## 发布与数据上传 (Publishing & Data Upload)