ClawHub
Back to skill

Security audit

File Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent file manager, but it needs Review because its bulk rename and sync commands can unexpectedly move or delete user files outside the intended scope.

Review this skill carefully before installing. It has no network or credential behavior, but it can make broad local filesystem changes. Use scan-only or preview modes first, avoid --no-confirm and unattended cron usage, do not run sync with overlapping source and target directories, and prefer quarantine/move workflows over direct deletion until the path-scope issues are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/batch_rename.py:49
Finding

Path Traversal in Batch Rename Destination

Content
View full analysis
Remediation
View remediation
{new_path.resolve(strict=False)}") ``` 4. Abort execution when destination collisions are detected instead of merely warning. 5. Consider removing `--no-confirm`. If non-interactive operation is required, require an additional explicit safety option after all paths have passed containment validation. 6. Revalidate containment immediately before `rename()` to reduce time-of-check/time-of-use risks caused by filesystem changes. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sync.py:35
Finding

Overlapping Synchronization Roots Can Delete Source Files or Cause Recursive Copy Growth

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The code is clearly related to file management and does perform one subset of the declared description: intelligent file classification/organization. However, the declared purpose describes a broader automation assistant supporting batch operations, duplicate cleanup, renaming, directory sync, and automated workflows. This code chunk only implements organization by type or date, plus copy/move into category folders. It does not perform duplicate detection/removal, explicit batch renaming, directory synchronization, or broader workflow automation. Additionally, although the CLI advertises --by-size, that feature is only a placeholder ('开发中...') and not functional. Therefore the description materially overstates the implemented capabilities, creating a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
python scripts/sync.py <source> <target> --mirror

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
python scripts/sync.py <source> <target> --mirror

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
python scripts/sync.py <source> <target> --mirror

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
python scripts/sync.py <source> <target> --mirror

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

The tool allows destructive filesystem changes to proceed non-interactively via --execute --no-confirm, with user-controlled patterns and rename templates. In an agent skill context, this increases the risk of parameter abuse: a mistaken or malicious invocation can mass-rename files at scale without a human checkpoint, causing operational disruption or data handling errors.

Content

Scanner excerpt · scripts/batch_rename.py (reported line 155)May include surrounding context.

python
help='转换为大写')
    parser.add_argument('--execute', action='store_true',
                       help='执行重命名 (默认仅预览)')
    parser.add_argument('--no-confirm', action='store_true',
                       help='跳过确认')
    
    args = parser.parse_args()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises and instructs file-modifying operations but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent may invoke file-write capabilities more broadly than intended, increasing the chance of unintended or unsafe filesystem changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation description is broad enough to trigger on many ordinary file-related requests, which can cause the skill to be selected in situations the user did not specifically intend. In a file-management context, overbroad invocation is risky because the skill includes write, move, delete, and sync workflows that could alter user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The examples prominently show destructive operations such as deleting duplicate files and mirroring directories without adjacent, explicit warnings about irreversible data loss. In a filesystem-management skill, copy-pastable destructive commands materially increase the risk of accidental deletion, overwrite, or propagation of mistakes across directories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guidance '中文文件名（某些系统兼容性问题）' is presented as a blanket rule in a Chinese-language document, effectively imposing a language-related naming restriction. The file does not frame this as optional, context-dependent, or limited to environments with demonstrated compatibility issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document provides destructive or state-changing automation examples such as --mirror, --move, and --execute for backup and file organization without prominent warnings about deletion, overwrite, or unintended file movement. In a file-management skill, users are likely to copy these commands directly, so unsafe examples can cause accidental data loss even if the content is not overtly malicious.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The natural-language content presented to users, including the module description, CLI help text, prompts, and status messages, is entirely in Chinese. This imposes a specific language on users without offering a language choice or documenting a justified region-specific constraint, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
65% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/batch_rename.py (reported line 155)May include surrounding context.

python
help='转换为大写')
    parser.add_argument('--execute', action='store_true',
                       help='执行重命名 (默认仅预览)')
    parser.add_argument('--no-confirm', action='store_true',
                       help='跳过确认')
    
    args = parser.parse_args()

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring and all user-facing CLI descriptions are written only in Chinese, indicating a fixed language choice. The file does not offer any language selection or explain that the tool is intentionally limited to a Chinese-speaking context, which conflicts with the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language strings that present the tool exclusively in Chinese, including the module docstring and later CLI messages. Under the stated policy, forcing a specific language without offering a choice or documenting a justified locale restriction is a policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level docstring states that the tool supports both one-way mirror synchronization and bidirectional synchronization. In contrast, the sync_bidirectional function only prints that the feature is under development and performs no synchronization, which is a direct contradiction between documentation and behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file presents its description, prompts, status messages, and CLI guidance only in Chinese, which imposes a locale/language choice on users. The policy allows language constraints only when users can opt in or when the limitation is clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description explicitly includes directory synchronization as a supported task, and this script exposes a --bidirectional mode for that purpose. However, the implementation merely prints that bidirectional sync is still under development and recommends using another tool, so the claimed capability does not match actual behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.