ClawHub
Back to skill

Security audit

generate-mindmap

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it asks agents to run missing local code and may automatically install an unpinned Python package, so it should be reviewed before use.

Review before installing. Use it only in an isolated environment, prefer --no-auto-install, install any dependencies yourself from a trusted pinned source, and verify that the missing generator script and referenced files are supplied by the publisher before relying on the skill.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:105
Finding

Automatic Installation of an Unpinned Runtime Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 105–106
Vulnerability Type: Unpinned and automatically installed third-party dependency
Risk Level: Medium

Vulnerable Code Snippet

bash
pip install pillow

The documented behavior states that if Pillow is unavailable, the generator attempts to install it automatically, first into the active environment and then with the --user option.

Technical Analysis

The Skill instructs its generator to install Pillow dynamically without specifying a reviewed version, cryptographic hashes, a lock file, or a trusted package index. Consequently, dependency resolution occurs against mutable package-index state at execution time.

Although pillow is the expected package name, an unpinned installation remains exposed to upstream package compromise, compromised index or mirror configuration, DNS or repository redirection, and unexpectedly malicious future releases. Package installation and subsequent import can execute package-controlled code with the privileges of the Agent process.

The referenced generate_mindmap.py implementation is absent from the audited project, so the exact subprocess arguments and installation safeguards could not be independently verified. The unsafe automatic installation behavior is nevertheless explicitly prescribed by the Skill documentation.

Attack Path

  1. A user requests PNG, JPG, or PDF mind-map output.
  2. The documented generator checks the environment and determines that Pillow is unavailable.
  3. It automatically invokes an unpinned pip install pillow, falling back to a user-level installation if necessary.
  4. The Python package resolver obtains the dependency from the currently configured package index or mirror.
  5. If that distribution source or a resolved release has been compromised, attacker-controlled package code is installed.
  6. Installation-time behavior or a later import executes the attacker-contr ...[truncated 791 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable automatic dependency installation by default and require explicit user approval before modifying the Python environment.
  2. Declare Pillow in a dependency manifest and pin it to a reviewed version.
  3. Use a lock file with cryptographic hashes, such as a hash-locked requirements.txt, and install with pip install --require-hashes.
  4. Retrieve dependencies only from an organization-approved HTTPS index or internal artifact repository.
  5. Install dependencies in an isolated virtual environment with minimal filesystem and network privileges.
  6. Keep --no-auto-install enabled by default and provide installation instructions rather than silently changing the environment.
  7. Include generate_mindmap.py in the package so its package-installation logic, subprocess handling, and dependency validation can be audited.
  8. Add automated checks that reject unpinned dependencies and unexpected package sources.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest-facing summary and description are presented only in Chinese, which effectively imposes a language choice on users who may not have opted into that locale. The file does not indicate that language selection is configurable or intentionally region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger keywords include very broad terms such as 'generate', 'html', and '支持', which are likely to match many unrelated user requests. That increases the chance of unintended skill invocation, potentially causing file creation, command execution, or dependency installation in contexts where the user did not mean to invoke this skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill explicitly documents automatic package installation via pip during execution, which introduces a supply-chain and environment-modification risk. Even though it says it will avoid one especially risky pip flag, the dangerous behavior is the auto-install itself: a skill that can trigger dependency installation may alter the host environment or pull unreviewed code from package indexes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The repeated broad trigger list in the core capabilities section reinforces ambiguous activation conditions and may cause the platform or downstream tooling to treat commonplace words as invocation signals. In a skill that can guide command execution and package installation, accidental activation raises the operational risk beyond a purely cosmetic documentation issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.