ClawHub
Back to skill

Security audit

Data Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core sales analysis behavior is mostly coherent, but it ships an unrelated installer-named HTML page with remote scripts and uses predictable /tmp output paths, so it needs review before installation.

Review this package before installing. The sales-analysis code itself is simple and does not show credential theft or destructive behavior, but the unrelated install_skillhub.sh page should be removed or explained, dependencies should be pinned, and generated chart/PDF outputs should use safe private temporary paths instead of fixed /tmp filenames.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
__init__.py:102
Finding

Predictable PDF output path permits symlink-based file overwrite

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
__init__.py:46
Finding

Predictable chart output paths permit symlink-based file overwrite

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Third-party dependencies are not version-pinned or integrity-locked

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill metadata advertises sales analysis, charting, and deep analysis, but the body also declares PDF report generation using a user-supplied chart path. That introduces file-system interaction and file output capabilities not reflected in the top-level description, which can mislead reviewers and downstream policy controls about the skill's real capabilities. Hidden or underdeclared file I/O increases the risk of unsafe path handling, unauthorized file writes, or accidental exposure of local files if implementation follows this interface.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill metadata advertises sales analysis, charting, and deep analysis, but the body also declares PDF report generation using a user-supplied chart path. That introduces file-system interaction and file output capabilities not reflected in the top-level description, which can mislead reviewers and downstream policy controls about the skill's real capabilities. Hidden or underdeclared file I/O increases the risk of unsafe path handling, unauthorized file writes, or accidental exposure of local files if implementation follows this interface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file claimed to be an install script for a sales data analysis skill is actually a full SkillHub website HTML page, which is a strong supply-chain integrity mismatch. This can conceal unrelated or unauthorized client-side behavior, and in the context of a skill package, the mismatch materially increases the risk of deceptive distribution, hidden tracking, or delivery of unexpected remote code through external scripts.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · sales_data.csv (reported line 1)May include surrounding context.

text
产品名称,月份,销售额(万元)
产品A,1月,120
产品A,2月,150
产品A,3月,180

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description and all user-facing documentation are written entirely in Chinese, with no indication that other languages are supported or that Chinese is an intentional opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The query and analysis logic matches only Chinese trigger terms such as "最高", "总销售额", and "利润下降", and returns Chinese-only responses. This imposes a specific language/locale behavior without any opt-in, fallback, or documented justification, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes a sales data analysis skill supporting queries, chart generation, and deep analysis. The code additionally creates a PDF business report and writes it to /tmp, which is a distinct reporting/export capability not disclosed by the stated description.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · install_skillhub.sh (reported line 37)May include surrounding context.

sh
<script>
    window.G_isMobile = false;
    window.G_isSupportWxOauth = false;
    window.G_isSupportQQOauth = false;
    window.G_isIntl = false;
    window.G_captchaAppId = "2021704706";

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · install_skillhub.sh (reported line 38)May include surrounding context.

sh
<script>
    window.G_isMobile = false;
    window.G_isSupportWxOauth = false;
    window.G_isSupportQQOauth = false;
    window.G_isIntl = false;
    window.G_captchaAppId = "2021704706";

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file sets window.G_language = 'zh', which hard-codes the user-facing language to Chinese. The page title and description also indicate a China-specific audience, but this file does not present any language choice or explicit opt-in within the content shown.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The page loads analytics, inspects browser environment, displays extension-related alerts, and contains social-sharing logic that are unrelated to sales data analysis. In a skill context, such unjustified telemetry and environment probing expands data exposure and can fingerprint users or create privacy and trust issues without a legitimate business need.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The plotting function writes a PNG file to a fixed temporary path as part of its operation. Although the return value mentions the saved path after the fact, there is no advance warning in the docstring, comments, or visible prompt that invoking the function will create or overwrite a local file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code performs a file write by saving a generated PDF to a fixed path under /tmp. While the method name suggests report generation, there is no prior warning in comments, docstrings, or user-facing confirmation that a filesystem write will occur or that an existing file at that path may be overwritten.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency pandas is unpinned, so installs may pull different versions over time, reducing reproducibility and increasing supply-chain risk if a newly resolved version is vulnerable or maliciously compromised. In a data-analysis skill that processes user-provided data, pulling an unexpected pandas release could expose the environment to known or newly introduced parsing or deserialization flaws.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
pandas
matplotlib
fpdf2

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The manifest does not pin pandas, and pandas has at least one known disputed advisory affecting some historical versions. Because the version is unspecified, it is impossible to verify whether deployment will select an affected release, leaving a plausible exposure window if vulnerable versions are installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency matplotlib is unpinned, which makes builds non-reproducible and exposes the skill to supply-chain drift. A future install could resolve to a version with security issues or breaking behavior, which is especially relevant here because the skill generates charts and will likely process externally influenced content.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
pandas
matplotlib
fpdf2

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency fpdf2 is unpinned, so the installed package version may vary across environments and over time. Because PDF generation libraries often handle complex document content, an unexpected version could introduce exploitable parsing/rendering weaknesses or malicious supply-chain changes.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
pandas
matplotlib
fpdf2

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description is written only in Chinese, which signals a language-specific skill experience without any indication that users can opt into another language or that the locale restriction is intentional. Under the policy, language constraints should be user-selectable or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.