ClawHub
Back to skill

Security audit

传统起名工作流

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Chinese naming workflow, but it can automatically install a Python package and write Word files using user-controlled names without enough containment.

Review before installing. Use it only in an isolated environment, install reviewed dependencies yourself instead of allowing automatic pip installation, provide an explicit safe output path, and avoid sharing precise birth or family details unless you are comfortable with them being included in generated local files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/generate_doc.py:15
Finding

Automatic Installation of an Unpinned Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_doc.py, lines 15-23
Vulnerability Type: Supply-chain exposure through runtime dependency installation
Risk Level: Medium

Vulnerable Code:

python
def check_deps():
    try:
        from docx import Document
        return True
    except ImportError:
        print("Installing python-docx...")
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "python-docx", "-q"])
        return True

Technical Analysis

When python-docx is unavailable, the script automatically invokes pip and installs the package without pinning a version or verifying package hashes. The effective dependency version and its transitive dependency graph can therefore change after the Skill has been audited.

The installation also inherits the executing environment's pip configuration, including configured package indexes, extra indexes, proxies, and trusted hosts. If an index, package release, transitive dependency, or pip configuration is compromised, installation-time or import-time code can execute with the privileges of the user running the Skill.

The subprocess call uses an argument list and is not vulnerable to shell command injection. The weakness is the uncontrolled and mutable software supply chain.

Attack Path

  1. The attacker compromises a configured Python package index, publishes a compromised dependency release, or causes the runtime to use an attacker-controlled package source.
  2. The target environment does not already have an importable docx module.
  3. A user invokes scripts/generate_doc.py.
  4. check_deps() catches ImportError and automatically executes pip install python-docx.
  5. Pip retrieves and installs the mutable package and its dependencies without version or hash verification.
  6. Malicious installation-time or import-time code executes under the account running the Skill ...[truncated 472 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove automatic dependency installation from the document-generation path.
  2. Declare dependencies in a dedicated dependency manifest and install them during an explicit, controlled setup phase.
  3. Pin python-docx and all transitive dependencies to reviewed versions.
  4. Use a lockfile or a hash-checked requirements file, such as:
    text
    python-docx==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH
  5. Install from an approved package index and prevent untrusted extra-index-url configuration in production.
  6. If the dependency is missing, terminate with a clear error instead of modifying the environment:
    python
    def check_deps():
    try:
        import docx
    except ImportError as exc:
        raise RuntimeError(
            "python-docx is required; install the reviewed locked dependencies first"
        ) from exc
  7. Run dependency installation and document generation in a least-privileged virtual environment or isolated container.
  8. Add automated dependency vulnerability and integrity scanning to the release process.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_doc.py:33
Finding

Path Traversal Through User-Controlled Default Output Filename

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_doc.py, lines 33-42
Vulnerability Type: Unvalidated path construction
Risk Level: Medium

Vulnerable Code:

python
if not output_path:
    father = data.get("father_name", "")
    mother = data.get("mother_name", "")
    suffix = data.get("child_label", "之子")
    output_path = os.path.join(
        os.path.dirname(json_path),
        f"\u300a{father}\u5148\u751f{mother}\u5973\u58eb{suffix}\u300b\u5b9a\u540d\u65b9\u6848.docx"
    )

The resulting path is later used without containment or overwrite checks:

python
doc.save(output_path)

Technical Analysis

The father_name, mother_name, and child_label fields originate in the input JSON and are embedded directly into a filesystem path. The implementation does not reject path separators, traversal components, reserved filename characters, control characters, or excessive filename lengths.

Because attacker-controlled separators can create additional path components, subsequent .. components can escape the directory containing the JSON file. os.path.join() does not sanitize components embedded inside the formatted filename, and the script does not resolve the result and verify that it remains under an approved output directory.

Exploitation requires the destination's parent directories to exist and be writable. The generated content remains a DOCX document, which limits the ability to create an arbitrary byte-for-byte payload, but unintended file creation and overwriting are still possible.

Attack Path

  1. An attacker supplies or influences an input JSON document processed by the script.
  2. The attacker places path separators and traversal components in a field such as mother_name or child_label.
  3. The script is invoked without an explicit second output.docx argument, causing automatic filename construction.
  4. The formatted filename is interpreted a ...[truncated 909 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat all JSON fields as display text rather than filesystem path components.
  2. Generate the physical filename from a server-controlled identifier, random UUID, or fixed safe name.
  3. If personal names must appear in the filename, apply a strict allowlist and replace path separators, traversal tokens, control characters, and platform-reserved characters.
  4. Impose a conservative filename-length limit.
  5. Resolve the candidate destination and verify containment under a dedicated output directory:
    python
    from pathlib import Path
import re

def safe_component(value):
    value = str(value)
    value = re.sub(r'[^A-Za-z0-9_.-]', '_', value)
    value = value.replace("..", "_")
    return value[:80] or "unnamed"

output_dir = Path(json_path).resolve().parent
filename = (
    f"{safe_component(father)}_"
    f"{safe_component(mother)}_"
    f"{safe_component(suffix)}.docx"
)
candidate = (output_dir / filename).resolve()

if candidate.parent != output_dir:
    raise ValueError("Output path escapes the approved directory")

output_path = str(candidate)
  6. Open the destination using exclusive-create behavior, or require explicit authorization before replacing an existing file.
  7. Apply equivalent containment validation to an explicitly supplied output_path when the caller is not fully trusted.
  8. Use a dedicated least-privileged output directory rather than writing beside arbitrary input files.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior promises a naming-analysis workflow but also introduces undeclared environment-changing behavior through script execution and automatic dependency installation. This mismatch is dangerous because users and orchestrators may trust the skill as a content-only workflow while it can modify the runtime, create files, and execute code paths that were not transparently declared or constrained.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/output-template.md (reported line 1)May include surrounding context.

md
# 输出模板与 JSON Schema

## Word 文档生成

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises or implies capabilities that require file access and shell execution, but it does not declare any tool scope or permissions boundaries. This is dangerous because downstream agents may invoke broader-than-expected execution paths, including reading local files or running commands, without an explicit least-privilege contract for users or the platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill requests personal data including surname, gender, birth date, and precise birth time, which can be sensitive and identifying, but gives no privacy notice, retention policy, or minimization guidance. In context, this increases risk of unnecessary collection and mishandling of personal data, especially for newborns or family members who may not be the direct user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

All user-facing metadata and the default prompt are written only in Chinese, which signals a fixed language/locale behavior with no opt-in or alternative language path. The file does not state that the skill is intentionally limited to Chinese-speaking users or a region-specific context, so this may violate language-choice policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest's default prompt begins with "帮我为宝宝起名" (help me name my baby), which is a natural, common request phrasing rather than a narrowly scoped invocation. The file does not provide any negative examples, trigger boundaries, or context restrictions to clarify when this skill should activate versus when a general assistant should respond.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file explicitly labels several numerological values as '女忌' ('unsuitable for women') without justification, user opt-in, or framing as a historical belief that may be outdated or discriminatory. In a naming workflow, this can cause the system to steer recommendations differently based on gender, embedding biased treatment into outputs and potentially excluding otherwise acceptable names for female users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script automatically invokes pip to install python-docx at runtime when the dependency is missing. Installing packages during execution expands the trust boundary to package indexes and the local Python environment, which can lead to supply-chain exposure, unexpected code execution in restricted environments, or abuse if package sources or configuration are compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script hardcodes Chinese fonts and produces Chinese-language document content and filenames throughout the generated output. This constitutes a locale/language constraint in a code file, and there is no user choice or explicit justification in the file that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill description and operating instructions are entirely presented in Chinese and do not indicate that users may choose another language. Per the policy, a skill should not impose a specific language or locale unless it is clearly justified or user-selected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill instructs generating a Word document via a script that writes local files, but it does not warn users about file creation, output locations, or possible local environment changes. While lower severity than arbitrary execution, it still creates transparency and consent issues and can lead to unexpected artifacts or writes on the host system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and schema descriptions only in Chinese, with no note that the user may choose another language or that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.