ClawHub
Back to skill

Security audit

iBook Widget Packer

Security checks for vulnerabilities and agentic risk

Overview

This widget-packing skill does what it claims, but its bundled script can delete or package files outside the intended folders if given unsafe paths or symlinked project files.

Install only if you will run it on projects you trust, choose simple widget names like letters, numbers, dashes, and underscores, avoid elevated privileges, and use a dedicated output directory. Review source folders for symlinks before packaging and install Pillow only in a virtual environment if thumbnail generation is needed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
pack_widget.py:133
Finding

Path Traversal Enables Recursive Deletion Outside the Output Directory

Content
View full analysis
/../important.wdgt`. 4. `os.path.exists()` confirms that the attacker-selected directory exists. 5. `shutil.rmtree()` recursively deletes that directory. 6. The program creates a replacement widget directory at the same location. An absolute widget name can similarly cause `os.path.join()` to ignore `output_dir`. ### Impact Assessment An attacker who can control command-line arguments can recursively delete any directory writable by the process, provided the resolved target ends in `.wdgt`. The impact ...[truncated 270 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
pack_widget.py:157
Finding

Source Symbolic Links Can Disclose Files Outside the Project

Content
View full analysis
/path/to/sensitive/file`. 2. A user runs the widget packer against the untrusted project. 3. `os.path.isfile()` follows the link and treats its target as a regular file. 4. `shutil.copy2()` follows the link and copies the target's contents into `peresources/secret.json`. 5. The copied data is added to the generated `.wdgt.zip`. 6. The sensitive contents can be disclose ...[truncated 636 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
pack_widget.py:75
Finding

Unescaped User Input Allows Info.plist XML Injection

Content
View full analysis
CFBundleDisplayName {display_name} CFBundleIdentifier {identifier} CFBundleName {bundle_name} CFBundleShortVersionString {version} CFBundleVersion {version} MainHTML index.html AllowNetworkAccess Width {width} Height {height} ''' ``` The generated content is written at `pack_widget.py:203-205`: ```python plist_content = generate_info_plist(display_name, identifier, bundle_name, version) with open(os.path.join(wdgt_dir, 'Info.plist'), 'w', encoding='utf-8') as f: f.write(plist_content) ``` ### Technical Analysis User-controlled values are inserted directly into an XML document using an f-string. XML metacharacters such as `&`, `<`, and `>` are not escaped. An attacker can close an intended `` element and inject additional plist keys and values. Less sophisticated input containing ordinary XML metacharacters can also produce malformed XML and cause denial of service when the widget is imported or parsed. The `display_name` and `version` values are direct command-line inputs. The bundle name is derived from `widget_name` but is not safely serialized as XML. ### Attack Path 1. The attacker supplies a crafted display name or version containing ...[truncated 1072 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:118
Finding

Documentation Recommends Installation of an Unpinned Runtime Dependency

Content
View full analysis
Remediation
View remediation
\ --hash=sha256: ``` Example installation procedure: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (38)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly instructs installing Pillow via pip3 at runtime, which expands its capability from packaging files to modifying the local software environment and fetching code from an external package source. That increases supply-chain and environment-integrity risk, especially if the agent performs the install automatically without explicit user consent or isolation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill performs file reads and writes, copies project assets, generates new files, and creates archives, but it declares no explicit tool scope or permissions boundary. Without an allowlist for file and command access, an agent may overreach into unintended directories or modify files beyond the user's expected output path.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 76)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 78)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 149)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · pack_widget.py (reported line 75)May include surrounding context.

python
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · pack_widget.py (reported line 76)May include surrounding context.

python
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · pack_widget.py (reported line 78)May include surrounding context.

python
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · pack_widget.py (reported line 80)May include surrounding context.

python
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · pack_widget.py (reported line 101)May include surrounding context.

python
---
name: ibook-widget-packer
description: 将 H5 游戏项目打包成 Apple iBook 支持的 .wdgt（Widget）格式。适用于：已有 H5 游戏项目（包含 index.html、CSS、JS 等文件），需要打包成 iBook Author 可用的 Widget 压缩包（.wdgt.zip）时使用。自动完成目录结构规范化、资源路径修正、Info.plist 生成、缩略图生成、最终 zip 打包全流程。
metadata:
  author: knot-user
  version: "1.0"

Static analysis

No suspicious patterns detected.