ClawHub
Back to skill

Security audit

坐标转换

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local GeoJSON coordinate-conversion helper with no hidden persistence, credential access, or unrelated behavior found.

Install dependencies in a virtual environment and prefer a pinned, reviewed pyproj version. When using `-o/--output`, choose a new output path or back up existing files because the script writes directly to that path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:80
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:80-84
Related Runtime Import: scripts/transform_coords.py:13-18
Vulnerability Type: Unpinned and unverifiable third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
## Dependency Installation

```bash
pip3 install pyproj
text

The installed dependency is subsequently imported by the application:

```python
try:
    from pyproj import Transformer
except ImportError:
    sys.exit(1)

Technical Analysis

The installation instructions retrieve the latest version of pyproj selected by the active Python package index without specifying an audited version, verifying package hashes, using a lockfile, or requiring an isolated environment. This creates a mutable and non-reproducible software supply-chain boundary.

The audit found no evidence that pyproj itself is malicious. The confirmed weakness is the unsafe dependency-management pattern. If the package publisher account, configured package index, package artifact, or dependency-resolution environment is compromised, a substituted distribution can execute attacker-controlled code during installation or when the application imports the package.

Attack Path

  1. An attacker compromises a configured Python package index, publisher account, distribution artifact, or local package-resolution configuration.
  2. The user follows the documented pip3 install pyproj command.
  3. Because no version or artifact hash is specified, pip resolves and installs the attacker-controlled or compromised release.
  4. Malicious package installation hooks or import-time code execute when the package is installed or imported by transform_coords.py.
  5. The payload runs with the permissions of the user who invoked pip or the coordinate-conversion script.

This path requires compromise or manipulation of the dependency supply chain; the reviewed project does not indepen ...[truncated 648 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin pyproj to a reviewed, supported version rather than resolving an unrestricted latest release.
  2. Place the dependency in a version-controlled requirements or lock file.
  3. Require cryptographic hashes, for example through a hash-locked requirements file and pip install --require-hashes.
  4. Install dependencies inside a dedicated virtual environment rather than the system Python environment.
  5. Configure an explicitly trusted package index and avoid untrusted extra indexes that could introduce dependency-confusion risks.
  6. Periodically review and update the pinned version after vulnerability and provenance checks.
  7. Document a reproducible installation command, such as:
bash
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

SQP-3 applies to natural-language policy issues in all file types, including markdown. The document consistently forces a specific language locale for instructions and examples without indicating that the user can choose another language or that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This is a markdown file, so SQP-2 applies to missing user-facing warnings in the skill description. The examples prominently use -o output.geojson to write files, but the README does not warn that running the command will create or overwrite output files and affect user data on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains natural-language strings only in Chinese, including the module description, installation guidance, CLI help text, and status/error messages. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in or a clearly justified regional scope.

Content

No source excerpt is available for this finding.