ClawHub
Back to skill

Security audit

Knowlgdge-Skill

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for knowledge-base generation, but it needs review because it processes private documents through LLM services and deploys unauthenticated local services that can store or expose that data.

Install only in an isolated local or private-network environment. Do not process confidential, regulated, or proprietary documents unless the configured LLM, vision model, EasyDataset service, and MongoDB instance are trusted and access-controlled. Avoid exposing ports 1717 or 27017 publicly, add authentication where possible, review retention/deletion practices for uploads and generated datasets, and prefer pinned dependencies and safer Docker installation steps.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Findings (29)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 对于支持数组形式的命令使用 shell=False，带管道的命令仍需 shell=True
    use_shell = "|" in cmd or ">" in cmd
    try:
        result = subprocess.run(cmd, shell=use_shell, capture_output=True, text=True, timeout=10)
        output = (result.stdout + result.stderr).strip()
        return {"ok": result.returncode == 0, "cmd": cmd, "desc": desc,
                "detail": output[:200] if output else "命令执行成功但无输出"}
Confidence
88% confidence
Finding
result = subprocess.run(cmd, shell=use_shell, capture_output=True, text=True, timeout=10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill instructs the agent to perform sensitive operations including shell execution, network access, file reads/writes, package installation, Docker deployment, and writing config.json, yet it declares no permissions. This creates a permission-transparency gap: a host or reviewer may treat the skill as low-privilege while it is actually designed to make system changes and access local resources.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The documented HuggingFace upload capability enables remote exfiltration/publication of locally processed datasets to a third-party service, which exceeds a normal local knowledge-processing workflow. In the context of a skill that handles uploaded documents and generated datasets, this creates a meaningful risk of unintended disclosure of sensitive or proprietary data.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
`execute_llm_command` lets LLM-produced text directly select any collection and perform reads and state-changing operations such as `insertOne`, `insertMany`, `updateOne`, `updateMany`, and `deleteOne`. The blacklist is narrow and bypassable in principle, and there is no allowlist restricting collections or methods to the intended category/file management scope, so an adversarial prompt or compromised upstream model could modify unrelated data or exfiltrate sensitive records.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The class documentation presents this component as a category manager, but the implementation includes a generic executor capable of operating on arbitrary MongoDB collections. This mismatch can cause callers, reviewers, or surrounding agents to grant broader trust than warranted, increasing the chance that dangerous database capabilities are exposed without proper controls.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code takes the first 2000 characters of uploaded file content and sends them to an external LLM API for value assessment, but there is no consent gate, sensitivity check, redaction step, or indication that user data leaves the local system. In a knowledge-base workflow, uploaded documents may contain proprietary, regulated, or personal data, so silent transmission to a third party creates a real confidentiality and compliance risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The classification path transmits both file content and the full category tree to the external LLM. This expands the data exposure beyond document text to internal taxonomy and organizational structure, which may reveal business domains, projects, or sensitive knowledge organization metadata without any warning or approval step.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation includes destructive operations such as physical directory deletion without any warning, confirmation flow, or mention of access controls. In a system that also states APIs are directly callable, such endpoints materially increase the risk of accidental or unauthorized data loss.

Missing User Warnings

High
Confidence
99% confidence
Finding
The document explicitly states there is no authentication middleware and that all APIs are directly callable. Given the API surface includes deletion, configuration changes, file upload, dataset export, remote publishing, and task control, this implies unauthenticated access to highly sensitive and destructive operations, making the skill context substantially more dangerous.

Missing User Warnings

High
Confidence
98% confidence
Finding
The guide instructs users to run MongoDB bound to host port 27017 with no authentication, and it does so without a strong warning that this is unsafe outside tightly isolated local development. If exposed beyond localhost or a trusted network segment, unauthorized users could read, modify, or delete stored classification and dataset data, and potentially leverage the database for further compromise.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The one-click scripts forcibly remove existing containers before redeployment without clearly warning about service interruption, loss of ephemeral state, or the possibility of replacing a differently configured service. In operational environments, this can cause avoidable downtime and accidental disruption, especially if users run the script on shared hosts.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The architecture explicitly sends uploaded file content and extracted image/table content to external LLM and vision APIs, but the document provides no warning, consent step, data classification guidance, or privacy constraints. In a knowledge-base ingestion workflow, users may upload sensitive internal documents, so silent third-party transmission materially increases confidentiality and compliance risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document states that generated datasets and Q&A records are persisted both on disk and in MongoDB, but it does not mention retention limits, deletion procedures, access controls, or the possibility that sensitive source material may be reproduced in stored outputs. Because this skill is designed for bulk document processing and retrieval, long-term storage can amplify exposure well beyond the original upload event.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The troubleshooting guide recommends deleting the Docker volume `easy-dataset-data` to recover from a corrupted database, but it does not explicitly warn that this permanently destroys persisted application data. In the context of a knowledge-base and dataset generation system, that can cause unintended data loss or operational disruption if an operator follows the instruction during incident response.

Missing User Warnings

High
Confidence
97% confidence
Finding
The VisionLLMClient base64-encodes full image content and sends it to an external chat/completions API, and this file’s processing paths automatically route images, PDF pages, and complex table screenshots into that client. In a knowledge-base ingestion skill, uploaded files may contain confidential documents, PII, financial records, or proprietary materials, so transmitting them off-box without explicit consent, policy checks, or data-classification gates creates a real data-exfiltration/privacy risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code sends extracted file content samples to an LLM for value assessment and classification without any explicit consent prompt, warning, or locality check in this file. Because the skill is designed to process arbitrary user documents, this can leak sensitive business, personal, or regulated data to external model endpoints configured by base_url.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill sends full generated markdown derived from user files into the EasyDataset pipeline along with model connection details, again without an explicit disclosure or confirmation in this file. Since markdown may contain the bulk of the original document, the exposure is broader than a small sample and creates a substantial confidentiality risk if the dataset service or downstream model endpoint is remote, third-party, or misconfigured.

Missing User Warnings

High
Confidence
98% confidence
Finding
The code permits LLM-generated write and delete operations with no explicit approval gate, role check, or user-facing confirmation before mutating database state. In this skill context, where uploaded content and conversational inputs may influence the model, prompt injection or model error could trigger unauthorized data corruption, deletion, or tampering.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The tool encourages users to share diagnostic output with support staff, and `--full` mode is documented as including environment and network details. That can lead to accidental disclosure of sensitive host information, service topology, credentials in logs, or other secrets if users paste the output externally.

External Transmission

Medium
Category
Data Exfiltration
Content
"max_tokens": self.max_tokens
        }

        resp = requests.post(
            f"{self.base_url}/chat/completions",
            json=payload,
            headers={
Confidence
93% confidence
Finding
requests.post( f"{self.base_url}/chat/completions", json=

External Transmission

Medium
Category
Data Exfiltration
Content
"max_tokens": self.max_tokens
        }

        resp = requests.post(
            f"{self.base_url}/chat/completions",
            json=payload,
            headers={
Confidence
96% confidence
Finding
requests.post( f"{self.base_url}/chat/completions", json=

Unvalidated Output Injection

High
Category
Output Handling
Content
if full:
        print(f"\n--- Docker 容器 ---")
        try:
            r = subprocess.run(["docker", "ps", "-a", "--format", "table {{.Names}}\t{{.Status}}\t{{.Ports}}"],
                              capture_output=True, text=True, timeout=5)
            print(r.stdout)
        except Exception as e:
Confidence
76% confidence
Finding
subprocess.run(["docker", "ps", "-a", "--format", "table {{.Names}}\t{{.Status}}\t{{.Ports}}"], capture_output

External Script Fetching

Low
Category
Supply Chain
Content
**未安装时的用户交互话术**：
> 当前服务器未检测到 Docker。EasyDataset 和 MongoDB 需要 Docker 环境。
> - Windows：请从 https://www.docker.com/products/docker-desktop/ 下载安装
> - Linux：请执行 `curl -fsSL https://get.docker.com | sh`
> 安装完成后请回复"已安装"，我会继续部署服务。

## Phase 5：EasyDataset
Confidence
94% confidence
Finding
curl -fsSL https://get.docker.com | sh

Unpinned Dependencies

Low
Category
Supply Chain
Content
# JY_Knowledge_Skill Python 依赖

# HTTP 请求
requests>=2.31.0

# MongoDB
pymongo>=4.6.0
Confidence
94% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0

# MongoDB
pymongo>=4.6.0

# 文件处理
mammoth>=1.6.0          # DOCX → Markdown
Confidence
94% confidence
Finding
pymongo>=4.6.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.