ClawHub
Back to skill

Security audit

Social Security Fund

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local China social-security and housing-fund calculator/guide, but it asks for sensitive identifiers in command-line arguments and points users to plain-HTTP official-service links.

Review before installing. Do not enter real ID-card numbers, housing-fund account numbers, passwords, or verification codes into this skill; use non-sensitive test values for simulations and verify any government portal manually over HTTPS before logging in.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unnecessary and Unpinned Third-Party Dependencies Increase Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Additional Documentation Locations: README.md:25-30, SKILL.md:218-229
Vulnerability Type: Unpinned and unnecessary third-party dependencies
Risk Level: Low

Vulnerable Code

text
requests>=2.28.0
beautifulsoup4>=4.11.0

The documented installation procedure executes:

bash
pip3 install -r requirements.txt

Technical Analysis

Both dependencies use open-ended minimum-version constraints. Consequently, each installation can resolve to a different future release from the configured package index. The manifest does not provide exact versions, integrity hashes, or a lock file.

Neither requests nor beautifulsoup4 is imported by any of the audited Python scripts. Installing them therefore expands the project's dependency and supply-chain attack surface without supporting current runtime behavior.

No malicious package or currently compromised dependency was identified during this audit. The issue is the unnecessary exposure to mutable third-party artifacts and the absence of reproducible, integrity-verified installation controls.

Attack Path

  1. A user follows the installation instructions in README.md or SKILL.md.
  2. pip3 install -r requirements.txt contacts the user's configured package index.
  3. Pip selects any available release satisfying the open-ended minimum constraint.
  4. If the index, account, distribution artifact, or a future compatible release is compromised, malicious package installation logic may run.
  5. The malicious code executes with the permissions of the account running pip and may modify that account's Python environment or accessible files.

Impact Assessment

Exploitation would run with the privileges of the user performing installation. In a virtual environment, impact would normally include the environment and data accessible to that user. If installation is perfor ...[truncated 357 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove requests and beautifulsoup4 because the current scripts do not import them.
  2. If future functionality requires these packages, pin reviewed exact versions rather than using open-ended lower bounds.
  3. Generate a lock file and require package hashes, for example through pip-tools and pip's --require-hashes option.
  4. Install dependencies inside a dedicated, non-privileged virtual environment.
  5. Add automated dependency review, vulnerability scanning, and controlled update procedures.
  6. Keep documentation synchronized with the actual dependency requirements.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check_deals.py:53
Finding

Sensitive Identity and Account Values Are Accepted and Forwarded Through Process Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/check_deals.py:53-60, 85-96
Additional Locations: scripts/query_social_security.py:168-178, scripts/query_fund.py:196-206, SKILL.md:81-84
Vulnerability Type: Sensitive information exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

python
ss_parser = subparsers.add_parser("social-security", help="社保查询")
ss_parser.add_argument("--city", type=str, default="北京", help="城市")
ss_parser.add_argument("--idcard", type=str, help="身份证号")
ss_parser.add_argument("--guide", action="store_true", help="查询指引")
ss_parser.add_argument("--json", action="store_true", help="JSON 输出")

fund_parser = subparsers.add_parser("fund", help="公积金查询")
fund_parser.add_argument("--city", type=str, default="北京", help="城市")
fund_parser.add_argument("--account", type=str, help="公积金账号")
fund_parser.add_argument("--guide", action="store_true", help="查询指引")
fund_parser.add_argument("--json", action="store_true", help="JSON 输出")

The values are subsequently copied into child-process arguments:

python
elif args.command == "social-security":
    cmd_args = ["--city", args.city]
    if args.idcard:
        cmd_args.extend(["--idcard", args.idcard])
    if args.guide:
        cmd_args.append("--guide")
    if args.json:
        cmd_args.append("--json")
    run_script("query_social_security.py", cmd_args)

elif args.command == "fund":
    cmd_args = ["--city", args.city]
    if args.account:
        cmd_args.extend(["--account", args.account])
    if args.guide:
        cmd_args.append("--guide")
    if args.json:
        cmd_args.append("--json")
    run_script("query_fund.py", cmd_args)

The child process is created using:

python
def run_script(script: str, args: list) -> None:
    """运行子脚本"""
    cmd = [sys.executable, os.path.join(SCRIPT_DIR, script)] + args
    subprocess.run(cmd, cwd=SCRIPT_
...[truncated 2077 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove --idcard and --account from the simulation interfaces because real identifiers are not required.
  2. Generate simulation seeds randomly or accept an explicitly non-sensitive test seed.
  3. If sensitive input becomes necessary, collect it through a protected interactive prompt such as getpass.getpass() or through a carefully permissioned input channel rather than command-line arguments.
  4. Avoid forwarding sensitive data to a second process; call the relevant Python function directly within the unified launcher.
  5. Validate and minimize all sensitive input, clear references promptly, and ensure it is excluded from logs and exception messages.
  6. Replace documentation examples with unmistakably synthetic placeholders and add an explicit warning not to enter genuine identity or account data.
  7. Add automated tests ensuring sensitive values are never included in generated commands, logs, JSON output, or diagnostics.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/query_social_security.py:18
Finding

Plain-HTTP Government Service Links Expose Users to Interception and Phishing

Content
View full analysis

Vulnerability Details

File Location: scripts/query_social_security.py:18-47
Additional Locations: scripts/query_fund.py:18-52, SKILL.md:332-337
Vulnerability Type: Insecure transport for sensitive service links
Risk Level: Medium

Vulnerable Code

python
CITY_PORTALS = {
    "北京": {
        "name": "北京市人力资源和社会保障局",
        "url": "http://rsj.beijing.gov.cn/",
        "query_url": "http://fuwu.rsj.beijing.gov.cn/bishopsite/login/login.html",
    },
    "上海": {
        "name": "上海市人力资源和社会保障局",
        "url": "http://rsj.sh.gov.cn/",
        "query_url": "https://zzfz.rsj.sh.gov.cn/zzfz/",
    },
    "广州": {
        "name": "广州市人力资源和社会保障局",
        "url": "http://rsj.gz.gov.cn/",
        "query_url": "http://ggfw.gdhrss.gov.cn/gdggfw/",
    },
    "深圳": {
        "name": "深圳市社会保险基金管理局",
        "url": "http://hrss.sz.gov.cn/szsi/",
        "query_url": "https://sipub.sz.gov.cn/homsWeb/",
    },
    "杭州": {
        "name": "杭州市人力资源和社会保障局",
        "url": "http://hrss.hangzhou.gov.cn/",
        "query_url": "https://gzlz.hrss.hangzhou.gov.cn/",
    },
    "成都": {
        "name": "成都市人力资源和社会保障局",
        "url": "http://cdhrss.chengdu.gov.cn/",
        "query_url": "http://www.cd12333.com/",
    },
}

Housing-fund guide entries similarly include plaintext URLs:

python
"url": "http://gjj.beijing.gov.cn/",
"url": "http://www.shgjj.com/",
"url": "http://gjj.gz.gov.cn/",
"url": "http://zjj.sz.gov.cn/",
"url": "http://gjj.hangzhou.gov.cn/",
"url": "http://gjj.chengdu.gov.cn/",

Technical Analysis

HTTP provides neither server authentication nor transport integrity. A network-positioned attacker can intercept or modify an initial HTTP request before any server-side redirect to HTTPS occurs.

These links are presented as official portals in workflows where users may expect to authenticate using identity information, telephone ...[truncated 1594 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace every HTTP URL with a verified HTTPS endpoint operated by the relevant government authority.
  2. Remove any service for which an authenticated HTTPS endpoint cannot be verified.
  3. Prefer linking to a verified HTTPS government homepage rather than directly linking to a potentially unstable login path.
  4. Maintain an explicit allowlist of expected HTTPS schemes, hostnames, and optional path prefixes.
  5. Add validation that rejects non-HTTPS URLs when portal configuration is loaded or tested.
  6. Review links periodically because official service domains and authentication routes can change.
  7. Warn users to verify the HTTPS scheme, hostname, and certificate before entering credentials or verification codes.
  8. Update both Python configuration and documentation so insecure links are not reintroduced through copied examples.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied code only implements a calculator for 五险一金 contributions using predefined city rates, plus simple personal income tax and net pay estimation. It accepts salary, city, and fund ratio as inputs and outputs computed contribution amounts. There is no code for querying external records, retrieving social security contribution history, checking housing fund balances, or estimating retirement pensions. The declared description presents a broader assistant centered on nationwide record/balance queries and pension estimation, while the actual code provides only one subset feature: contribution calculation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a broad assistant covering both 社保 and 公积金, including record lookup, balance lookup, 五险一金 calculation, and retirement pension estimation. The supplied code implements only a 公积金-focused script. It contains hardcoded city portal metadata, simulated account-derived balances, and a simple city-based loan estimate. The docstring explicitly states that actual queries require logging into local systems and that this script only provides mock queries and official query guidance. There is no code for 社保缴纳记录, no 五险一金 calculator, and no 退休金估算 logic. Therefore the code's actual behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description claims a broader assistant covering social security records, provident fund queries, five-insurance-one-fund calculations, and pension estimation. However, the supplied code only contains a social security script. Its main functions are: (1) generate mock social security data based on an ID hash, and (2) return official query guidance URLs for a handful of cities. The docstring explicitly says real queries require logging into local systems and that the script only provides simulated queries and official entry guidance. There is no code for provident fund lookup, no benefits/contribution calculator, and no pension estimation logic beyond fabricated account values in the mock response. Therefore the declared description materially overstates the implemented functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill description, examples, and user-facing guidance are entirely in Chinese and framed specifically for Chinese social-security and housing-fund workflows. The file does not offer any language choice or explicitly document that the locale restriction is a justified region-specific constraint, which matches the policy check for language/locale limitations without opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description and visible user-facing title/tagline are entirely in Chinese, and the document does not indicate that the skill is region-specific by design or that users may choose another language. This can violate a language/locale policy when a skill effectively forces one language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The privacy section promises that sensitive identifiers such as ID card numbers are not stored, yet the documented file structure includes a cache file for the last query result. In a skill handling social security and housing fund data, such cached results could include personal identifiers or benefit details, creating confidentiality and compliance risk through local disclosure or unintended retention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s user-facing natural language is entirely in Chinese, including the module description, CLI description, argument help text, and formatted output, with no option for users to select another language or locale. This constitutes a language/locale policy concern under the rule because the skill implicitly forces Chinese-language interaction.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_deals.py (reported line 19)May include surrounding context.

python
def run_script(script: str, args: list) -> None:
    """运行子脚本"""
    cmd = [sys.executable, os.path.join(SCRIPT_DIR, script)] + args
    subprocess.run(cmd, cwd=SCRIPT_DIR)

def main():
    parser = argparse.ArgumentParser(

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This entrypoint accepts highly sensitive personal data such as Chinese ID card numbers and housing fund account numbers, then forwards them to sub-scripts without any visible privacy notice, masking, minimization, or guidance about local handling. In a skill centered on social security and housing fund queries, this increases the chance of inadvertent disclosure through logs, terminal history, screenshots, downstream processing, or unsafe storage in other components.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a broader assistant covering 社保缴纳记录、公积金余额、五险一金计算、退休金估算 across major cities, but the code in this file only handles 公积金-related portal guidance and simulated balance/loan output. There is no implementation for social-security record queries, five-insurance-one-fund calculation, or pension estimation here, creating a clear description-to-behavior mismatch for this skill component.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring presents the script as a social security query tool before later noting that real queries require official systems, while the actual behavior remains simulation plus guidance. This mismatch is dangerous because users or integrating agents may rely on the initial framing and surface simulated outputs as authoritative personal-benefit data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring uses Chinese exclusively to describe the tool and its behavior, and the CLI help strings later follow the same pattern. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill metadata claims real social security and provident fund query support, but the implementation only generates deterministic mock data and provides portal guidance. In a finance/benefits context, this can mislead users into treating fabricated balances, contribution history, or retirement-related figures as real records, causing bad decisions and trust harm.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The dependency specification uses a lower bound only (requests>=2.28.0) rather than pinning to an exact version or constrained safe range. This makes builds non-reproducible and can pull in unexpected or vulnerable releases over time, which is especially relevant for a skill that may handle sensitive social security and housing fund data via network requests.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0
beautifulsoup4>=4.11.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The manifest references requests without pinning to a version that can be verified as patched, despite multiple known advisories affecting some releases. Because this skill likely communicates with external services for social security and provident fund queries, an affected requests version could expose credentials, mishandle TLS/session validation, or leak sensitive information depending on how the library is used.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

beautifulsoup4>=4.11.0 is also unpinned, which allows environment-dependent installs and weakens supply-chain control. While not inherently exploitable by itself, unpinned packages increase the chance of accidental introduction of breaking or vulnerable versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.28.0
beautifulsoup4>=4.11.0

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

Natural-language strings in the module docstring and CLI descriptions force a single language/locale experience without user opt-in. Under the stated policy, this is a language/locale policy concern unless the locale restriction is explicitly offered as a choice or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This Python file contains natural-language documentation only in Chinese, describing city social security and housing fund rates, with no indication that users can select another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains user-facing natural language in Chinese in the module description, and the same single-language assumption continues through CLI help and output. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The docstring labels the script as a 公积金查询工具 and says it supports balance and contribution-record queries, which implies real retrieval capability. However, the implementation explicitly returns synthesized data via simulate_query and only provides official-entry guidance; it does not access any live system or actual records.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module description and user-facing strings are presented only in Chinese, which imposes a specific language on users without any opt-in or alternative locale handling. Under the policy provided, forcing a language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.