ClawHub
Back to skill

Security audit

Batch Format Converter

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real batch file converter, but it under-discloses credential handling and remote license verification that users should review before installing.

Review before installing. Use only a dedicated converter or 91Skillhub license token if you trust the publisher endpoint, avoid relying on OPENAI_API_KEY for this tool, and disable network access if you only need local conversion. Do not enable Feishu delivery for sensitive documents unless you understand what metadata or files will be sent, and do not copy the cleanup commands into unrelated directories.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tainted flow: 'req' from os.environ.get (line 121, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
},
            data=b"{}",  # POST body required
        )
        with urllib.request.urlopen(req, timeout=10) as resp:
            data = json.loads(resp.read().decode("utf-8"))
            # 修正：使用 valid 字段
            if data.get("valid", False):
Confidence
98% confidence
Finding
The code sends a bearer token derived from user input or the OPENAI_API_KEY environment variable to an external domain for plan verification. That creates a real credential-exfiltration path because a sensitive API key unrelated to file conversion is transmitted off-host, and the skill context makes this more dangerous since token verification is not necessary to perform local format conversion.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill contains external token-verification logic that is unrelated to its stated purpose of local file-format conversion. This expands the trust boundary, introduces network egress and data-sharing behavior users would not expect, and can facilitate credential disclosure or tracking.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
Using OPENAI_API_KEY from the environment for plan selection is unjustified for a file converter and risks repurposing a sensitive credential for an unrelated service. In practice this can leak a broadly privileged API key to the remote verifier, violating least privilege and user expectations.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises Feishu webhook support for pushing conversion results and notifications to an external service, but provides no warning that converted data may contain sensitive content and will leave the local environment. In a batch document conversion tool, files may include internal reports, PII, or confidential business data, so silent or poorly explained outbound transmission creates a real data-leakage risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly states that conversion-complete notifications and result files are sent to Feishu, but it does not disclose the privacy and security implications of transmitting user files or metadata to an external service. This can expose sensitive document contents, filenames, or workflow metadata to third-party systems without informed user consent, which is especially risky for a file-conversion tool likely to process business documents.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code transmits the API key in an Authorization header to a remote verification service without any user-facing disclosure at the point of use. Undisclosed transmission of credentials is dangerous because users may unknowingly expose secrets to a third party, especially in a tool that otherwise appears to be a local converter.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code accesses OPENAI_API_KEY from the environment without clear disclosure, then uses it for non-OpenAI plan verification. This is a real security issue because it silently harvests a sensitive environment secret for an unrelated purpose and may forward it externally.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
# 清理 Python 缓存
find . -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true
find . -type f -name "*.pyc" -delete

# 清理 .pytest_cache
Confidence
94% confidence
Finding
The cleanup command uses 'find . ... -exec rm -rf {} +' to recursively delete matched directories under the current working tree. In a packaging or CI context, if run from the wrong directory or against an unexpected checkout containing symlinks/misplaced files, it can destroy unintended content and suppress errors via '2>/dev/null || true', making damage harder to detect.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
find . -type f -name "*.pyc" -delete

# 清理 .pytest_cache
find . -type d -name ".pytest_cache" -exec rm -rf {} + 2>/dev/null || true

# 清理 output 目录（如果有）
rm -rf ./output 2>/dev/null || true
Confidence
94% confidence
Finding
This command recursively deletes '.pytest_cache' directories anywhere under the current tree and hides failures, which increases the chance of accidental destructive cleanup in the wrong execution context. While intended as housekeeping, broad recursive deletion in documentation can be copied into automation and cause loss of unintended files or mask mistakes.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
find . -type d -name ".pytest_cache" -exec rm -rf {} + 2>/dev/null || true

# 清理 output 目录（如果有）
rm -rf ./output 2>/dev/null || true

# 清理测试生成的文件
find . -type f -name "*.tmp" -delete
Confidence
95% confidence
Finding
The command 'rm -rf ./output' is a destructive filesystem operation presented without safeguards. If the skill is executed or the command is copied in an unexpected directory layout, important generated artifacts or unrelated data in an 'output' path could be irreversibly deleted, and the redirection hides warning signs.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
find . -type f -name "test_*" -type f -delete 2>/dev/null || true

# 清理 config.yaml（如果包含敏感信息）
rm -f config.yaml 2>/dev/null || true

# 清理日志文件
find . -type f -name "*.log" -delete 2>/dev/null || true
Confidence
91% confidence
Finding
Deleting 'config.yaml' as a generic cleanup step is risky because configuration files often contain essential settings or secrets needed for operation, and the command permanently removes it without backup or confirmation. In automation or when copied by users, this can cause availability issues, accidental credential loss, and hinder forensic review.

Static analysis

No suspicious patterns detected.