ClawHub
Back to skill

Security audit

Taiwan Calendar Plugin

Security checks for vulnerabilities and agentic risk

Overview

This Taiwan calendar skill is purpose-aligned and shows no data theft or persistence, but it relies on external calendar data and has data-integrity and dependency hygiene risks.

Install only if you are comfortable with the skill running a Python script via Bash, installing its Python dependencies through uv, contacting external calendar-data endpoints, and caching calendar JSON in the temp directory. For deadline-critical use, verify important dates against an official Taiwan source because one source is a mutable mirror and the fallback weakens TLS verification.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
scripts/taiwan_calendar.py:3
Finding

Unpinned Automatically Installed Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: scripts/taiwan_calendar.py:3-8
Vulnerability Type: Supply-chain exposure through unconstrained dependency resolution
Risk Level: Medium

Vulnerable Code

python
# /// script
# requires-python = ">=3.11"
# dependencies = [
#   "requests",
#   "python-dateutil",
# ]
# ///

The documented execution command uses uv run --managed-python, causing uv to resolve and install these dependencies automatically. Neither dependency has an exact version constraint, and the project contains no reviewed lockfile or package hashes.

Technical Analysis

Dependency resolution therefore depends on mutable package-index state at execution time. A future compromised, malicious, or unexpectedly incompatible release could be downloaded without any project change or additional review. Python packages may execute code during installation or import, so dependency compromise can extend beyond incorrect calendar behavior.

The audit did not find evidence that the currently published requests or python-dateutil packages are malicious. The vulnerability is the absence of controls that ensure future executions use the same reviewed artifacts.

Attack Path

  1. An attacker compromises a dependency release channel or publishes a malicious release through an applicable supply-chain attack.
  2. The Skill is invoked using uv run --managed-python scripts/taiwan_calendar.py.
  3. uv resolves the unconstrained dependency to the attacker-controlled release.
  4. The package is downloaded and installed without a lockfile or hash verification rejecting it.
  5. Malicious package code executes during installation or when the script imports the package.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user or Agent process running the Skill. This may permit access to files, environment variables, network resources, and credentia ...[truncated 146 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an exact, reviewed version.
  2. Generate and commit a uv lockfile so installations are reproducible.
  3. Require package hashes where the deployment process supports them.
  4. Use a trusted internal package mirror or an allowlisted package index.
  5. Add automated dependency vulnerability and provenance scanning.
  6. Review and deliberately update dependencies rather than allowing invocation-time upgrades.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/taiwan_calendar.py:105
Finding

TLS Certificate Verification Disabled for the Fallback API

Content
View full analysis

Vulnerability Details

File Location: scripts/taiwan_calendar.py:105-109
Vulnerability Type: Improper certificate validation for remote calendar data
Risk Level: Medium

Vulnerable Code

python
            # Some government APIs have SSL certificate issues
            # Use verify=False for fallback sources
            verify_ssl = "jsdelivr" in url or "github" in url
            response = requests.get(url, timeout=10, verify=verify_ssl)
            response.raise_for_status()

The value of verify_ssl is false for the fallback data.ntpc.gov.tw endpoint because its URL contains neither jsdelivr nor github. Consequently, requests.get establishes HTTPS without validating the server certificate.

Technical Analysis

Encryption without certificate validation does not authenticate the remote endpoint. An attacker capable of intercepting or redirecting network traffic can present an arbitrary certificate and return forged JSON. The script accepts the resulting records as authoritative calendar data and can persist them in its local cache.

This does not directly create a Python code-execution path because the response is parsed as JSON rather than evaluated. It does, however, compromise the integrity and authenticity of all calculations based on the fallback response.

Attack Path

  1. The primary jsDelivr source fails, is blocked, or returns unusable data.
  2. The script requests calendar data from the New Taipei City fallback endpoint.
  3. A network-positioned attacker intercepts or redirects that connection.
  4. Because certificate verification is disabled, the attacker can impersonate the endpoint using an untrusted certificate.
  5. The attacker returns syntactically valid forged calendar JSON.
  6. The script parses and caches the forged records.
  7. Subsequent date checks, working-day counts, and deadline calculations use the manipulated data.

Impact Assessment

Exploitat ...[truncated 366 chars]

Remediation
View remediation

Remediation Suggestions

  1. Always enable TLS certificate validation:
    python
    response = requests.get(url, timeout=10, verify=True)
  2. If the endpoint requires a nonstandard certificate authority, bundle and explicitly reference the required trusted CA rather than using verify=False.
  3. Remove fallback sources that cannot support properly authenticated HTTPS.
  4. Validate response schemas, expected years, date ranges, and field types before caching data.
  5. Consider authenticating downloaded datasets with a government-provided signature or a separately verified digest.
  6. Ensure failed certificate validation causes a safe failure or use of previously authenticated cached data.

T08 · Insecure Dependencies

Warning
Location
scripts/taiwan_calendar.py:34
Finding

Mutable Third-Party Repository Used as the Primary Calendar Source

Content
View full analysis

Vulnerability Details

File Location: scripts/taiwan_calendar.py:34-43
Related Documentation: SKILL.md:228-231
Vulnerability Type: Unverified mutable external data dependency
Risk Level: Medium

Vulnerable Code

python
# API Sources
API_SOURCES = [
    {
        "name": "data.gov.tw - Taiwan Calendar (GitHub CDN)",
        "url": "https://cdn.jsdelivr.net/gh/ruyut/TaiwanCalendar/data/{year}.json",
        "field_mapping": {
            "date": "date",
            "is_holiday": "isHoliday",
            "name": "description",
        },
    },

The corresponding documentation describes the primary source as follows:

markdown
### Data Source

- **Primary**: Taiwan government open data platform (data.gov.tw)
- **Fallback**: New Taipei City open data

Technical Analysis

The actual primary endpoint is a jsDelivr URL backed by the mutable ruyut/TaiwanCalendar GitHub repository, not a direct data.gov.tw government endpoint. The URL does not pin a Git commit or immutable release, and the downloaded dataset is not checked against a signature or trusted hash.

HTTPS authenticates jsDelivr during transit but does not establish that mutable repository content is official government data. Repository compromise, maintainer-account compromise, or unauthorized source modification could therefore change the data accepted by the Skill without changing the audited project.

The documentation mismatch may also cause users and reviewers to apply a higher level of trust than is warranted.

Attack Path

  1. An attacker obtains the ability to modify the referenced GitHub repository or otherwise influence the mutable content delivered from it.
  2. The attacker changes a yearly JSON calendar file while preserving the expected schema.
  3. jsDelivr distributes the modified file from the unchanged URL.
  4. The Skill downloads and accepts the records without signature, digest, ...[truncated 592 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the GitHub-backed CDN source with a direct, documented official government endpoint.
  2. If a mirror is unavoidable, pin downloads to an immutable reviewed commit or release.
  3. Verify datasets using trusted signatures or pinned cryptographic hashes.
  4. Validate that records match the requested year and reject malformed, duplicate, or implausible dates and values.
  5. Record source provenance and validation status in the cache.
  6. Update SKILL.md and README.md to accurately distinguish official sources from community-maintained mirrors.
  7. Prefer safe failure over silently treating unverified third-party content as authoritative government data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction says the script outputs Chinese (Traditional) responses and to use these directly when responding to users, which imposes a specific language/locale behavior. This can violate language-choice policy because it does not require checking the user's preferred language before replying.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/taiwan_calendar.py (reported line 47)May include surrounding context.

python
},
    {
        "name": "New Taipei City Open Data",
        "url": "https://data.ntpc.gov.tw/api/datasets/308DCD75-6434-45BC-A95F-584DA4FED251/json",
        "field_mapping": {
            "date": "date",
            "is_holiday": "isHoliday",

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
98% confidence
Finding

TLS verification is effectively disabled for the non-jsDelivr/GitHub source because verify_ssl becomes false for that URL and is passed to requests.get(..., verify=verify_ssl). This allows man-in-the-middle interception or tampering of calendar data, so an attacker on the network path could inject false holiday/workday information and compromise output integrity.

Content

Scanner excerpt · scripts/taiwan_calendar.py (reported line 120)May include surrounding context.

python
url += f"?year={year}"

            # Some government APIs have SSL certificate issues
            # Use verify=False for fallback sources
            verify_ssl = "jsdelivr" in url or "github" in url
            response = requests.get(url, timeout=10, verify=verify_ssl)
            response.raise_for_status()

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The usage examples and activation description show the skill being triggered for Taiwan calendar-related questions only through Chinese examples, which can imply a language-specific interaction model. Because no opt-in or explicit statement of supported languages is provided, this may constitute a natural-language locale policy constraint that is not clearly documented.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring says the script queries Taiwan's government open data platform for accurate holiday information. However, the first configured source at L37-L38 is a jsDelivr-hosted GitHub repository mirror rather than a government endpoint, so the documentation overstates the provenance of the data source.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code emits user-facing strings exclusively in Chinese, including weekday names and all CLI results. Because the file does not provide user opt-in, language selection, or a documented justification that the tool is intentionally locale-specific, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.