深智智预习生成

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:38 PM UTC
• Version: 1.0.2

Overview

This skill does what it claims, but it stores passwords plainly and can send credentials and documents to loosely configured servers without strong safeguards.

Review before installing. Use only the official HTTPS server or a trusted local loopback server, avoid configuring arbitrary HTTP endpoints, and do not store a reused account password in this tool. Treat uploaded textbook PDFs and images as data sent to the configured service for processing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: deepaistudy_prep.py:41

Finding

Authentication Password Stored in Plaintext with Insufficient File Protection

Content

View full analysis

configparser.ConfigParser: config = configparser.ConfigParser() CONFIG_DIR.mkdir(parents=True, exist_ok=True) if CONFIG_FILE.exists(): config.read(CONFIG_FILE) if not config.has_section("default"): config.add_section("default") return config def save_config(config: configparser.ConfigParser) -> None: CONFIG_DIR.mkdir(parents=True, exist_ok=True) with open(CONFIG_FILE, "w") as f: config.write(f) ``` The password is configured through the documented command: ```text deepaistudy-prep config set password your_password ``` ### Technical Analysis The application stores its server address, username, and password in `~/.config/deepaistudy-prep/config.ini` through Python's `configparser`. The file is written as an ordinary text file, and the code does not explicitly enforce owner-only permissions such as mode `0600`. The password is therefore recoverable as plaintext by any process or user able to read the configuration file. Actual exposure depends on the operating system's effective umask and the permissions of the user's configuration directories, but security-sensitive code should not rely on environmental defaults for credential protection. The documented interface also accepts the password as a command-line argument. This can expose it through shell history and, depending on the operating system, process inspection while the command is running. This behavior is not necessary for the declared PDF and image processing functionality. Authentication is necessary for the remote service, but persistent plaintext password storage is not the least-privilege or least-exposure approach. ### Attack Path ...[truncated 1197 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: deepaistudy_prep.py:464

Finding

Credentials and User Documents Can Be Sent to Arbitrary Plain-HTTP Servers

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to configure a server, username, and password and describes sending textbook PDFs/images through OCR and AI generation services, but it does not warn that these materials and credentials may be transmitted to external systems. This creates a real privacy and security issue because users may unknowingly expose sensitive educational content, personal account data, or authentication secrets to third-party or remote services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module usage text and command help say the analyze command will 'AI分析PDF并自动生成预习', and there is a dedicated analyze_pdf_ai() function for that purpose. However, cmd_analyze() only detects PDF page count, converts pages to images, and uploads them; it never calls analyze_pdf_ai() or performs the advertised AI-based metadata extraction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI stores username and password in plaintext in ~/.config/deepaistudy-prep/config.ini with no warning or stronger secret handling. Local attackers, malware, backups, or accidental disclosure of dotfiles could expose account credentials and enable unauthorized access to the service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This request uploads user-supplied image content to /api/prep, which may contain sensitive document data. Although the CLI prints that it is uploading images, it does not disclose that the files are being sent to a remote server or warn users about potential privacy implications when the server is not local.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · deepaistudy_prep.py (reported line 357)May include surrounding context.

python

# 尝试用 pdftoppm
            if output_dir is None:
                output_dir = tempfile.mkdtemp()
            result = subprocess.run(
                ["pdftoppm", "-r", "150", "-png", pdf_path, "page"],
                capture_output=True,
                cwd=output_dir,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · deepaistudy_prep.py (reported line 396)May include surrounding context.

python

try:
            import subprocess

            result = subprocess.run(
                ["pdfinfo", pdf_path],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 84% confidence

Finding

The tool automatically executes a local script from ~/clawd/scripts/pdf-analyze.sh if present, without integrity verification, explicit opt-in at the call site, or trust checks. Any attacker who can place or modify that script gains code execution in the user's context when the analyze workflow runs.

Content

Scanner excerpt · deepaistudy_prep.py (reported line 426)May include surrounding context.

python

if ai_script.exists():
        import subprocess

        result = subprocess.run(
            [str(ai_script), pdf_path],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · deepaistudy_prep.py (reported line 665)May include surrounding context.

python

if args.open and server == "http://127.0.0.1:5000":
            import subprocess

            subprocess.run(["open", f"http://127.0.0.1:5000/preps/detail/{prep_id}"])
    else:
        print(f"\n✗ 生成失败: {done.get('error')}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The analyze flow extracts images from the user's PDF and then uploads them to create a prep task, effectively sending document contents to the server. The command prints progress messages, but it does not clearly warn that potentially sensitive PDF contents will be transmitted off-device.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · deepaistudy_prep.py (reported line 760)May include surrounding context.

python

# 预览拆分
    print("\n预览目录拆分...")
    result = subprocess.run(
        ["curl", "-s", "-X", "POST",
         f"{server}/api/prep/batch/preview",
         "-F", f"pdf_file=@{pdf_path}",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The batch preview request sends the full PDF file to the server using curl, and the subsequent batch creation does so again. The script prints the server address and asks for confirmation about generating lessons, but that confirmation is about task creation volume, not about transmitting the full document to an external endpoint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · deepaistudy_prep.py (reported line 799)May include surrounding context.

python

# 实际批量创建
    print("\n创建批量预习任务...")
    result = subprocess.run(
        ["curl", "-s", "-X", "POST",
         f"{server}/api/prep/batch",
         "-F", f"pdf_file=@{pdf_path}",

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The module docstring presents the skill only in Chinese ("深智智预习课件生成工具"), which may indicate a language-specific user experience without any visible opt-in or alternative locale choice. This can conflict with language/locale policy requirements when a skill implicitly forces one language for users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage text and subsequent user-facing strings throughout the file are entirely in Chinese, which effectively forces a specific language/locale on all users. There is no option to select another language and no documented justification that this tool is intentionally limited to a Chinese-speaking region or audience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The documentation presents the batch command as a content-generation workflow, but the implementation uses subprocess.run() to invoke external curl commands for both preview and batch creation. This is not merely omitted detail in comments about safety, but a divergence between the apparent intent of an internal CLI/API workflow and actual dependence on external command execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.