ClawHub
Back to skill

Security audit

chart-free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local chart-generation guide with some documentation inconsistencies, but no evidence of hidden exfiltration, destructive behavior, or unsafe persistence.

Before installing, treat this as a local Python chart helper: use a virtual environment, pin matplotlib if possible, avoid providing a callback URL unless you explicitly want network callbacks, and do not store sensitive chart data unless you are comfortable with it being written locally under the disclosed workspace path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:210
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 210 and 301
Vulnerability Type: Unpinned and unverified package installation
Risk Level: Medium

Complete Code Snippets

Line 210:

text
| `ModuleNotFoundError: matplotlib` | matplotlib is not installed | Run `pip3 install matplotlib`, then check the network connection and configuration before retrying |

Line 301:

text
| matplotlib is not installed | matplotlib is missing or installed incorrectly | Run `python3 -c "import matplotlib"`; if it produces no output, matplotlib must be installed. | Run `pip3 install matplotlib` to install matplotlib. |

The English descriptions above translate the surrounding table text faithfully; the security-relevant command appears verbatim.

Technical Analysis

The Skill directs users to install matplotlib through pip without specifying a reviewed version, validating package hashes, using a dependency lockfile, identifying a trusted package index, or requiring an isolated environment. The selected package and its transitive dependencies therefore remain mutable and depend on the invoking system's pip configuration.

This is a supply-chain weakness rather than evidence that matplotlib itself is malicious. If the configured package repository, a future package release, or a transitive dependency is compromised, attacker-controlled installation or runtime code could execute under the invoking user's account. The installation is also non-reproducible because different invocations may resolve different artifacts.

Attack Path

  1. A user invokes the Skill and encounters the documented missing-module condition.
  2. The user follows the instruction and runs pip3 install matplotlib.
  3. Pip resolves an unpinned release and its transitive dependencies from the configured package index.
  4. An attacker who has compromised a resolved release, dependency, or configured index serves a malicious artifact.
  5. Malicious installation hooks or impo ...[truncated 1137 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin matplotlib and every transitive dependency to reviewed versions through a lockfile.
  2. Require cryptographic hashes for downloaded artifacts, such as with a hash-pinned requirements file and pip install --require-hashes -r requirements.txt.
  3. Explicitly identify the approved package index and prevent unexpected fallback to untrusted or internally misconfigured indexes.
  4. Install dependencies inside a dedicated, least-privileged virtual environment rather than the global Python environment.
  5. Document the exact supported Python and dependency versions.
  6. Generate and retain a software bill of materials, and routinely scan pinned dependencies for known vulnerabilities.
  7. Replace both vulnerable commands with a controlled installation procedure, for example:
bash
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt
  1. Ensure requirements.txt contains exact versions and verified hashes for all resolved artifacts.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The display name, summaries, and the rest of the document are presented in Chinese, and the file does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is justified or optional.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The '功能边界' section says '无历史管理能力，无法回溯历史生成记录' at L235, which actively contradicts earlier documentation stating that charts.json is a '图表历史索引' and that init_storage.py initializes that index (L80, L96, L145). This is not mere omission: the docs both describe persisted history metadata and deny any history capability, creating a direct intent/documentation conflict.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill repeatedly emphasizes '仅落地本地' and '不调用任何云端图表API' (for example L12, L51, L221), yet the parameter table advertises a callback_url for async completion notifications. A callback URL implies outbound network communication, which conflicts with the stated local-only operating model even if no implementation is shown in this file.

Content

No source excerpt is available for this finding.