ClawHub
Back to skill

Security audit

密码生成器Pro免费版

Security checks for vulnerabilities and agentic risk

Overview

This password tool is not malicious, but it needs Review because it handles secrets while making unreliable security claims and including weak or broken generation examples.

Review carefully before installing. Avoid using the documented Bash passphrase generator or the small-word-list passphrases for real accounts, do not print generated credentials in shared or logged environments, and treat the strength checker and password generator examples as unreliable until the broken code and overstated entropy claims are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:205
Finding

Passphrases Generated with a Predictable Non-Cryptographic PRNG

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 205-222
Vulnerability Type: Use of a predictable pseudo-random number generator for security-sensitive credentials
Risk Level: High

bash
generate_passphrase() {
    local count=${1:-4}
    local separator=${2:--}
    local passphrase=""
    for i in $(seq 1 "$count"); do
        word="${WORD_LIST[$((RANDOM % ${#WORD_LIST[@]}))]}"
        if [ -z "$passphrase" ]; then
            passphrase="$word"
        else
            passphrase="${passphrase}${separator}${word}"
        fi
    done
    passphrase="${passphrase}${separator}$((RANDOM % 100))"
    echo "$passphrase"
}

Technical Analysis

The Bash implementation uses $RANDOM to select every word and the numeric suffix. Bash $RANDOM is a small-state, non-cryptographic pseudo-random number generator and is unsuitable for password or passphrase generation. Its outputs may be predictable when an attacker can observe related outputs or infer the process state.

The expressions using the modulo operator also introduce selection bias when the number of possible $RANDOM values is not evenly divisible by the word-list size or by 100. This further weakens the distribution of generated credentials.

Attack Path

  1. A user invokes the documented Bash passphrase generator and uses its output as an account credential.
  2. An attacker learns that the credential was generated by this Skill, and therefore knows the fixed word list and output format.
  3. The attacker observes one or more related generator outputs, estimates the generator state, or enumerates the comparatively small output space.
  4. The attacker generates likely candidate passphrases and attempts them against the target account or a captured password hash.
  5. If authentication lacks strong rate limiting, or if the attacker has an offline verifier, the credential may be recovered.

Impact Assessment

Successfu ...[truncated 422 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the Bash $RANDOM implementation from all security-sensitive credential workflows.
  • Use Python's secrets module or an equivalent operating-system-backed cryptographic random source.
  • Use unbiased selection such as secrets.choice(word_list) rather than modulo reduction.
  • Generate numeric components with secrets.randbelow() if they are necessary.
  • Add statistical and functional tests that verify selections use an approved cryptographic random source.
  • Clearly state that previously generated Bash passphrases should be replaced if they protect sensitive accounts.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:92
Finding

Passphrase Entropy Is Substantially Overstated

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 92-100 and line 387
Vulnerability Type: Incorrect security assurance caused by an undersized fixed word list
Risk Level: High

python
words = [
    'apple', 'brave', 'cloud', 'dance', 'eagle', 'flame', 'globe',
    'heart', 'ivory', 'jungle', 'knife', 'lemon', 'magic', 'noble',
    'ocean', 'piano', 'quest', 'river', 'storm', 'tiger', 'unity',
    'voice', 'water', 'xenon', 'youth', 'zebra', 'alert', 'blaze',
    'coral', 'delta', 'ember', 'frost', 'grace', 'haven', 'image',
]
return separator.join(secrets.choice(words) for _ in range(word_count))

The documentation subsequently states that a four-word random passphrase provides approximately 52 bits of entropy.

Technical Analysis

Although secrets.choice() is cryptographically appropriate, the source list contains only 35 words. With four independent selections, the theoretical maximum entropy is:

text
log2(35^4) = 4 × log2(35) ≈ 20.5 bits

There are only 35^4 = 1,500,625 possible four-word outputs. This is drastically below the documented estimate of approximately 52 bits. Repeated words are permitted, but this does not increase the total output space beyond 35^4.

The discrepancy can cause users to select these passphrases for use cases that require much stronger credentials. A fixed list embedded in a public Skill also allows an attacker to construct the complete candidate set without guessing the vocabulary.

Attack Path

  1. A user relies on the documented entropy claim and generates a default four-word passphrase.
  2. The attacker obtains a password hash, encrypted data verifier, or access to an authentication endpoint without adequate rate limiting.
  3. The attacker extracts the public 35-word list and enumerates all 1,500,625 four-word combinations.
  4. Each candidate is checked against the offline verifier or submitted to the target service.
  5. The correc ...[truncated 500 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the 35-word vocabulary with a vetted passphrase list containing at least 7,776 uniformly selectable entries.
  • Continue using secrets.choice() or another cryptographically secure, unbiased selection mechanism.
  • Calculate and publish entropy using word_count × log2(word_list_size).
  • Select a default word count appropriate for the intended security level; do not describe approximately 20.5 bits as 52 bits.
  • Add automated tests that verify the word-list size and prevent documentation entropy claims from diverging from the implementation.
  • Warn users that passphrases previously generated from the 35-word list should not be treated as high-entropy credentials.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:60
Finding

Password Generator Crashes Instead of Enforcing Required Character Classes

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-79
Vulnerability Type: Undefined function calls in a security-sensitive password generator
Risk Level: Medium

python
if use_lower:
    lower = self.CHAR_SETS['lower']
    if exclude_similar:
        lower = lower.replace('l', '').replace('o', '')
    chars += lower
    required.append(secrets.choice(lower))
if use_upper:
    upper = self.CHAR_SETS['upper']
    if exclude_similar:
        upper = upper.replace('I', '').replace('O', '')
    chars += upper
append(secrets.choice(upper))
if use_digits:
    digits = self.CHAR_SETS['digits']
    if exclude_similar:
        digits = digits.replace('0', '').replace('1', '')
    chars += digits
append(secrets.choice(digits))
if use_symbols:
    symbols = self.CHAR_SETS['symbols']
    chars += symbols
append(secrets.choice(symbols))

Technical Analysis

The uppercase, digit, and symbol branches invoke an undefined global function named append. They should invoke the append method on the required list. Under the documented default configuration, execution reaches the first bare append(...) call and raises NameError.

In addition, the displayed indentation places the bare calls outside their corresponding conditional blocks. Consequently, disabling a character class can also result in access to an uninitialized local variable. The implementation therefore neither reliably generates a password nor enforces the advertised requirement that each enabled character class be represented.

Attack Path

  1. A user invokes generate() using the documented defaults or another affected configuration.
  2. Execution reaches an undefined append(...) call.
  3. Python raises NameError, and credential generation terminates.
  4. In an automated account-provisioning workflow, this causes denial of service or incomplete provisioning.
  5. A user may respond by choosing a manuall ...[truncated 650 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace every bare call with the correctly scoped list operation:
python
required.append(secrets.choice(upper))
required.append(secrets.choice(digits))
required.append(secrets.choice(symbols))
  • Indent each operation inside its associated if block.
  • Validate that at least one non-empty character set is enabled before sampling.
  • Add unit tests for every combination of enabled and disabled character classes.
  • Assert that generated passwords contain at least one character from each enabled class.
  • Add tests for minimum length handling and exclude_similar=True.
  • Treat runtime failures as errors rather than returning malformed or partially generated credentials.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:126
Finding

Password Strength Checker Contains Multiple Reachable Runtime Failures

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126-156
Vulnerability Type: Undefined function calls in password validation branches
Risk Level: Medium

python
if length >= 16:
    score += 40
    feedback.append("Excellent length (at least 16)")
elif length >= 12:
    score += 30
append("Good length (at least 12)")
elif length >= 8:
    score += 20
else:
    score += 5
append("Insufficient length; at least 12 is recommended")

has_lower = bool(re.search(r'[a-z]', password))
has_upper = bool(re.search(r'[A-Z]', password))
has_digit = bool(re.search(r'\d', password))
has_symbol = bool(re.search(r'[!@#$%^&*()\-_=+\[\]{}|;:,.<>?]', password))
diversity = sum([has_lower, has_upper, has_digit, has_symbol])
score += diversity * 10

if diversity < 3:
append("Use at least three character types")
if re.search(r'(.)\1{2,}', password):
    score -= 15
append("Contains repeated characters")
if re.search(r'^\d+$', password):
    score -= 20
append("Numeric-only passwords are easy to crack")

Technical Analysis

Multiple branches call an undefined global function named append instead of feedback.append. Common password inputs can therefore cause NameError before the checker returns a result. Affected conditions include passwords between 12 and 15 characters, passwords shorter than eight characters, low-diversity passwords, repeated-character passwords, and numeric-only passwords.

The shown indentation also makes some calls unconditional or syntactically detached from the intended branch. As a result, the checker cannot be relied upon as a security gate for password acceptance or auditing.

Attack Path

  1. An application or audit workflow passes an ordinary or attacker-selected password to PasswordStrengthChecker.check().
  2. The input reaches one of the defective branches, such as the 12-to-15-character length branch or the low-diversity branch.

...[truncated 763 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace every bare append(...) invocation with feedback.append(...).
  • Correct indentation so each feedback operation executes only in its intended branch.
  • Add branch-coverage tests for all length ranges, character-diversity values, repeated characters, prohibited sequences, and numeric-only inputs.
  • Define explicit exception handling at integration boundaries.
  • Ensure password-policy enforcement fails closed when the checker cannot complete, while returning a clear operational error to the caller.
  • Add regression tests verifying that every input produces a structured result without an uncaught exception.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is presented as a password-generation utility, but later advertises unrelated capabilities such as file processing, API integration, and command execution. This scope mismatch is dangerous because it expands the operational surface beyond user expectations and can justify risky tool use under a benign-looking identity, making abuse or over-privileged execution harder to detect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation description includes generic security tasks like compliance auditing, vulnerability scanning, and encryption protection that go well beyond password generation. This overbroad framing can cause the agent to invoke the skill in contexts where its code and safeguards are inappropriate, increasing misuse and privilege creep.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Declaring exec for a password generator is not obviously necessary and creates avoidable risk, especially when the skill includes shell examples and promotes command execution. In a tool expected to handle secrets, unnecessary command execution increases the chance of leaking generated passwords to process listings, logs, shell history, or enabling later command-injection patterns if the skill evolves.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation says the free edition does not support batch generation, yet the code provides a bulk PIN generator. This inconsistency can mislead users and reviewers about actual functionality, undermining trust and making it easier for unreviewed or higher-risk behavior to hide behind inaccurate feature statements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples print generated passwords and PINs directly to stdout without warning about secret exposure. In agent, terminal, CI, or shared-session contexts, stdout is often logged or persisted, so this can leak credentials immediately at generation time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The keyword-based scope expansion is overly broad and not tightly tied to the concrete password features implemented in the file. Overbroad triggers increase the chance that the agent activates this skill in unrelated workflows, which is especially risky because the skill also exposes exec and presents itself as broadly automating security tasks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The FAQ implies secure randomness via Python secrets, but the documented shell passphrase generator uses Bash RANDOM, which is not cryptographically secure. For a password tool, this directly weakens generated secrets and may cause users to trust passphrases that are more predictable than advertised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description states '支持中文交互', and the document presents the interaction model as Chinese-only without indicating that users may choose another language. This is a natural-language locale constraint that should either be optional or explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.