ClawHub
Back to skill

Security audit

Ai File Organizer

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly behaves like a file organizer, but it requests cloud/network credentials and advertises safety features that are not actually implemented.

Review this carefully before installing. Use it only on a test folder first, avoid enabling the declared cloud credentials or network permissions unless a reviewed cloud implementation is added, do not run the cron examples until behavior is verified, and treat duplicate cleanup as a real file-moving operation rather than a harmless scan.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
_meta.json:20
Finding

Declared Network and Cloud Credential Access Exceeds Implemented Requirements

Content
View full analysis

Vulnerability Details

File Location: _meta.json, lines 20–35
Vulnerability Type: Excessive permissions and unnecessary sensitive credential exposure
Risk Level: Medium

json
"environmentVariables": [
  "ALIYUN_ACCESS_KEY",
  "ALIYUN_SECRET_KEY",
  "BAIDU_ACCESS_TOKEN"
],
"permissions": {
  "network": true,
  "networkEndpoints": [
    "dashscope.aliyuncs.com",
    "api.aliyundrive.com",
    "pan.baidu.com"
  ],
  "fileRead": true,
  "fileWrite": true,
  "fileWriteScope": "user_directories"
}

Technical Analysis

The metadata declares access to cloud credentials and network endpoints for DashScope, Aliyun Drive, and Baidu services. The shipped executable does not contain a network client, cloud provider implementation, AI provider integration, or environment-variable access.

The implemented functionality only requires reading files selected by the user, writing organized copies, moving duplicate files, and maintaining a local cache. Consequently, network access and cloud credential declarations are not required by the current implementation and violate least-privilege principles.

The risk depends on how the host platform enforces metadata. If declared environment variables and network permissions are made available to the Skill process, later-modified, substituted, or compromised code could use them without requesting an additional permission change.

Attack Path

  1. The Skill is installed with the permissions declared in _meta.json.
  2. The host exposes the listed cloud credentials or allows access to the declared network endpoints.
  3. A later update, compromised dependency, or replaced entry-point script reads the available credentials.
  4. The malicious component sends authenticated requests to an allowed cloud endpoint.
  5. Cloud data or resources accessible to those credentials may be read, modified, or uploaded.

No such credential theft or network transmission e ...[truncated 453 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove network, networkEndpoints, and cloud-related environment variables from _meta.json until reviewed cloud functionality is actually implemented.
  2. Keep only filesystem permissions necessary for explicitly selected source and destination directories.
  3. If cloud synchronization is later added, isolate it as an optional, separately permissioned component.
  4. Request provider-specific credentials only when the user enables that provider.
  5. Use narrowly scoped, short-lived tokens instead of account-wide or long-lived secrets.
  6. Require explicit user confirmation before any upload or remote modification.
  7. Add tests verifying that local-only operations cannot access environment credentials or the network.

T08 · Insecure Dependencies

Note
Location
README.md:43
Finding

Installation Instructions Add Unpinned and Unused Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 43–48; QUICKSTART.md, lines 12–14
Vulnerability Type: Unnecessary and unpinned package installation
Risk Level: Low

bash
pip install aiofiles aiomultiprocess tqdm pyyaml

pip install dashscope

The quick-start guide repeats the following installation command:

bash
pip install aiofiles aiomultiprocess tqdm pyyaml

Technical Analysis

The instructions install packages directly from the configured Python package index without version constraints or hash verification. The shipped executable optionally imports tqdm and yaml, but it does not import or use aiofiles, aiomultiprocess, or dashscope.

Installing unused dependencies unnecessarily increases the number of third-party packages that can execute installation or import-time code. Unpinned resolution also means that users auditing one release may receive a different dependency release later.

No evidence was found that the named packages are intentionally malicious, misspelled, or fetched from an untrusted custom index. The risk arises from avoidable supply-chain exposure and non-reproducible installation.

Attack Path

  1. A user follows the README or quick-start installation instructions.
  2. pip resolves the latest versions available from the user's configured package index.
  3. A package, transitive dependency, or package-index account is compromised, or an unexpected future release is published.
  4. Installation or later import executes attacker-controlled package code under the user's account.
  5. That code gains the same local access as the installation process, potentially including access to user files and environment variables.

Impact Assessment

Successful exploitation would execute code with the privileges of the user running pip. This could expose or modify user-accessible files and credentials. The impact is limited by the account and environment ...[truncated 114 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove aiofiles, aiomultiprocess, and dashscope from installation instructions unless corresponding functionality is implemented.
  2. Define the minimal runtime dependencies in one authoritative dependency file.
  3. Pin reviewed versions and use a lock file with cryptographic hashes.
  4. Recommend installation inside a dedicated virtual environment rather than the global Python environment.
  5. Use automated dependency scanning and update pinned versions through reviewed changes.
  6. Keep optional dependencies in explicit extras, such as an independently reviewed cloud or AI integration extra.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/organizer.py:625
Finding

Duplicate Cleanup Moves Files Without Preview, Confirmation, or Promised Recovery Safeguards

Content
View full analysis

Vulnerability Details

File Location: scripts/organizer.py, lines 625–655
Related Documentation: SKILL.md, lines 247–253; README.md, lines 285–301
Vulnerability Type: Unsafe filesystem mutation and misleading safety guarantees
Risk Level: Medium

python
duplicates = self.find_duplicates(source_dir)

dup_folder = os.path.join(source_dir, move_to)
os.makedirs(dup_folder, exist_ok=True)

moved_count = 0
space_saved = 0

if HAS_TQDM:
    dup_iter = tqdm(duplicates.items(), desc="清理重复", unit="组")
else:
    dup_iter = duplicates.items()

for hash_val, files in dup_iter:
    for file_path in files[1:]:
        try:
            file_size = os.path.getsize(file_path)
            filename = os.path.basename(file_path)
            target_path = os.path.join(dup_folder, filename)

            counter = 1
            while os.path.exists(target_path):
                name, ext = os.path.splitext(filename)
                target_path = os.path.join(
                    dup_folder,
                    f"{name}_{counter}{ext}"
                )
                counter += 1

            shutil.move(file_path, target_path)
            moved_count += 1
            space_saved += file_size
        except Exception as e:
            self.logger.error(f"移动文件失败 {file_path}: {e}")

Technical Analysis

Invoking the documented --duplicates option calls clean_duplicates(), which immediately moves every duplicate except the first one encountered during directory traversal. It does not provide a detection-only mode, operation preview, interactive confirmation, transaction log suitable for rollback, restore point, or recycle-bin integration.

The retained file is merely the first path returned by filesystem traversal. The implementation does not apply the documented “best version” policy based on quality or creation time. Consequently, a preferred copy can be moved while an arbi ...[truncated 1674 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make --duplicates detection-only by default and require a separate explicit option for moving files.
  2. Implement a genuine --dry-run mode that prints every source and destination path without changing the filesystem.
  3. Require interactive confirmation before mutation unless the user supplies an explicit non-interactive approval flag.
  4. Generate a durable transaction manifest recording hashes, original paths, destination paths, and timestamps.
  5. Add a tested rollback command that restores files from the manifest and safely handles destination conflicts.
  6. Implement the documented retention policy or clearly state that traversal order determines the retained copy.
  7. Validate and constrain cleanup destinations to an approved directory under the selected source root.
  8. Refuse sensitive or excessively broad roots by default and require explicit confirmation for home directories or filesystem roots.
  9. Remove claims concerning restore points, encrypted configuration, interactive mode, and safe deletion until those features are implemented and tested.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The quickstart provides a forceful recursive deletion command as a cleanup step. In a file-organizer context, users may trust and run shell snippets verbatim, and a destructive command can cause irreversible loss if the path is wrong, expanded unexpectedly, or copied with modifications.

Content

Scanner excerpt · QUICKSTART.md (reported line 199)May include surrounding context.

整理是复制文件（非移动），原文件保留。如需清理：

bash
# 删除整理后的文件夹
rm -rf ~/Organized

Q: 支持哪些文件类型？

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The quickstart provides a forceful recursive deletion command as a cleanup step. In a file-organizer context, users may trust and run shell snippets verbatim, and a destructive command can cause irreversible loss if the path is wrong, expanded unexpectedly, or copied with modifications.

Content

Scanner excerpt · QUICKSTART.md (reported line 199)May include surrounding context.

整理是复制文件（非移动），原文件保留。如需清理：

bash
# 删除整理后的文件夹
rm -rf ~/Organized

Q: 支持哪些文件类型？

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

If the supplied artifact is primarily tests or incomplete documentation while production-grade capabilities are asserted, reviewers and users cannot verify whether sensitive operations like cloud upload, archival, or file mutation are implemented safely. This undermines trust and can conceal missing safeguards around data handling and destructive actions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

If the supplied artifact is primarily tests or incomplete documentation while production-grade capabilities are asserted, reviewers and users cannot verify whether sensitive operations like cloud upload, archival, or file mutation are implemented safely. This undermines trust and can conceal missing safeguards around data handling and destructive actions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

If the supplied artifact is primarily tests or incomplete documentation while production-grade capabilities are asserted, reviewers and users cannot verify whether sensitive operations like cloud upload, archival, or file mutation are implemented safely. This undermines trust and can conceal missing safeguards around data handling and destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The guide recommends setting up cron-based automatic organization without warning that it will repeatedly process new files and may continuously copy, rename, or reorganize data. In a file-management skill, unattended recurring actions increase the risk of unexpected file churn, storage growth, and user confusion.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The cron setup introduces persistent, unattended execution of the organizer. For a skill that performs file operations, persistence increases risk because any misconfiguration, broad path selection, or later behavioral change will continue running automatically without user review.

Content

Scanner excerpt · QUICKSTART.md (reported line 108)May include surrounding context.

bash
# 编辑 crontab
crontab -e

# 添加：每周日凌晨 2 点自动整理
0 2 * * 0 python /path/to/organizer.py --organize ~/Downloads

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The quickstart states that organizing is copy-only and preserves originals, but elsewhere it documents duplicate handling by moving files. This inconsistency can mislead users about whether operations are reversible and may cause unintended data relocation or loss during cleanup or duplicate processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation includes a destructive deletion command to remove organized output without a strong warning or safety checks. Even though the path shown is specific, users often adapt such commands, and destructive shell examples in quickstarts can lead to accidental data deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README promotes AI content analysis and cloud sync, both of which can transmit file contents, filenames, metadata, or derived classifications to third-party services, but it does not prominently warn users about privacy and data-sharing risks. In a file-organizing skill, users may point the tool at Downloads, Documents, or other sensitive directories, making silent or poorly disclosed external transmission materially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README encourages automatic organization and duplicate cleanup without a prominent up-front warning that files may be moved, renamed, or relocated based on rules, which can disrupt workflows or lead to accidental data loss if users misunderstand behavior. Because the examples target broad user directories like Downloads and Files, the operational risk is elevated even if the behavior is intentional.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 246)May include surrounding context.

bash
# 编辑 crontab
crontab -e

# 添加定时任务（每周日凌晨 2 点整理下载文件夹）
0 2 * * 0 /usr/bin/python3 /path/to/organizer.py --organize ~/Downloads --target ~/Organized >> /var/log/organizer.log 2>&1

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill advertises file read/write and shell-driven workflows but does not declare any explicit tool scope or permission boundaries. In an agent environment, that can cause the skill to be invoked with broader capabilities than users expect, increasing the risk of unintended file modification, deletion, or command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and the entire user-facing documentation are presented in Chinese, and no option is offered for users to choose another language or locale. Under the stated policy, a skill should not impose a specific language unless there is user opt-in or a clearly justified region-specific limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Broad trigger phrases like everyday requests to 'help organize files' or 'clean duplicate files' can cause unintended invocation in ordinary conversation. Because this skill can lead to filesystem changes and possible cloud synchronization, accidental activation materially raises the risk of unwanted file operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description is written entirely in Chinese, presenting the skill in a single language with no indication that users can choose another language or that the skill is intended only for a Chinese-speaking region. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This JSON manifest describes the skill only in broad capability terms like intelligent file organization, batch renaming, and auto-archiving, but provides no explicit invocation phrases, context limits, or exclusion conditions. In a manifest file, such unspecific language can contribute to unintended matching or invocation because the scope of when this skill should activate is not clearly bounded.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module header claims AI analysis, cloud sync, and related capabilities that are not implemented in the code. This is dangerous because users may trust the tool to provide protections, classifications, or remote synchronization guarantees that do not exist, leading to unsafe operational decisions or accidental data exposure assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

User-facing descriptions, docstrings, log messages, CLI help text, and console output are written in Chinese throughout the file, with no indication of language choice or opt-in. That creates a locale/language policy issue because the skill presents a single language experience by default rather than offering user selection or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The demo output and documentation advertise AI analysis, cloud sync, version management, and an interactive CLI, but the implementation only performs local file classification, copying, reporting, and duplicate movement. Security-wise, overstated capabilities can mislead users into running the skill on sensitive data under false assumptions about review, rollback, synchronization, or confirmation safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

clean_duplicates modifies the source directory by moving files automatically once invoked, without a dry-run, confirmation prompt, or explicit warning. In a file-management skill, this creates a real integrity risk: a mistaken invocation, bad duplicate classification, or use on important directories can silently relocate user data and disrupt workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains natural-language text presented to users entirely in Chinese, including the module description and later CLI help/output, but it does not indicate that the tool is intentionally region-specific or allow opting into another language. That can violate language/locale policy because the skill effectively forces a specific language for interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The argparse description and help strings are user-facing interface text, and they are written only in Chinese. Because no alternate language or opt-in is provided, the command-line interface imposes a locale choice on users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This Python test file contains user-facing and instructional natural-language content entirely in Chinese, including the module docstring and later printed guidance. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation, and this file does not document that the skill is region-specific or provide any language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The printed coverage guidance shown when the file is run is hard-coded in Chinese and offers no alternative language or opt-in. Because this is user-visible output, it can violate the policy against forcing a specific language unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.