ClawHub
Back to skill

Security audit

Python数据可视化-免费版

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Python charting skill, with ordinary code execution, file export, dependency, and sample-data caveats rather than hidden or malicious behavior.

Install and use this as a normal code-running visualization helper: run it in a virtual environment, review generated Python before execution, choose non-conflicting output filenames, and avoid the remote seaborn sample dataset in restricted or offline environments unless you approve that network access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:194
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:194
Additional References: SKILL.md:286, 303-308
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install matplotlib seaborn plotly pandas numpy

The same unsafe installation pattern is repeated in the dependency documentation:

text
| matplotlib | Plotting library | Required | pip install matplotlib |
| seaborn | Statistical plotting | Recommended | pip install seaborn |
| plotly | Interactive plotting | Recommended | pip install plotly |
| pandas | Data processing | Recommended | pip install pandas |
| numpy | Numerical computing | Required | pip install numpy |
| kaleido | Plotly export | Optional | pip install kaleido |

Technical Analysis

The Skill directs the Agent to install multiple packages without fixed versions, integrity hashes, a lockfile, or an explicitly trusted package index. Consequently, the artifacts installed during execution may differ from those available when the Skill was audited.

Package installation and later import execute package-controlled code, including build backends, installation hooks, native extensions, and module initialization logic. If a package, transitive dependency, package-index account, or resolution source is compromised, malicious code could execute under the account running the Agent.

This finding does not establish that any named package is currently malicious. The vulnerability is the mutable and unverifiable supply-chain installation process.

Attack Path

  1. An attacker compromises a package release, maintainer account, transitive dependency, or package source used by pip.
  2. The Agent follows the documented environment-setup command.
  3. pip resolves the dependency to the attacker-controlled or compromised release because no reviewed version or hash is enforced.
  4. Malicious code executes duri ...[truncated 747 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed version rather than installing unconstrained latest releases.
  2. Resolve and pin all transitive dependencies in a committed lockfile.
  3. Require cryptographic hashes, such as with pip install --require-hashes -r requirements.txt.
  4. Configure an approved package index or internal mirror instead of relying on an unspecified source.
  5. Scan resolved dependencies for known vulnerabilities and review updates before changing pinned versions.
  6. Install packages in an isolated virtual environment or container running with least privilege.
  7. Restrict network access, mounted secrets, and writable host paths during installation and chart generation.
  8. Update every repeated installation example in SKILL.md, including the separate Kaleido instruction, to use the hardened dependency file.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:137
Finding

Undisclosed Outbound Network Retrieval Through Seaborn Dataset Loading

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:137
Conflicting Documentation: SKILL.md:314
Vulnerability Type: Undisclosed external network access and remotely mutable input
Risk Level: Low

Vulnerable Code

python
# Example
tips = sns.load_dataset("tips")

The Skill later makes the conflicting assurance:

text
- This Skill does not require an API key
- Purely local plotting, with no external API calls

Technical Analysis

seaborn.load_dataset("tips") can retrieve a sample dataset from an external source when the dataset is not already available in the local cache. The example therefore may perform outbound network communication despite the Skill's local-only assurance.

Although this operation retrieves data rather than executable Python code, the downloaded content is remote and may change independently of the reviewed Skill. The instruction does not disclose the destination, require user approval, pin an immutable revision, or verify the retrieved content's integrity.

This is not classified as remote payload execution because the documented operation loads a dataset rather than code. It is an insecure practice involving undisclosed network behavior and unverified remote input.

Attack Path

  1. A user or Agent executes the documented Seaborn example in an environment without a cached copy of the tips dataset.
  2. sns.load_dataset initiates an outbound request to retrieve the dataset.
  3. Connection metadata becomes visible to the external service and intervening network infrastructure.
  4. The remote response is accepted as visualization input without a locally specified integrity check.
  5. A compromised source or network path could return manipulated data, causing misleading or incorrect chart output.

Impact Assessment

The direct impact is limited to unexpected network access, disclosure of network metadata such as the source IP address and request ...[truncated 441 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bundle a reviewed local sample dataset with the Skill and load it from a fixed local path.
  2. If remote retrieval remains necessary, explicitly disclose the network destination and behavior before execution.
  3. Obtain user approval before initiating outbound access.
  4. Pin the dataset to an immutable revision and verify its cryptographic checksum before processing it.
  5. Apply download size limits, timeouts, and schema validation.
  6. Cache only validated content in a controlled directory.
  7. Correct the local-only assurance at line 314 so that it accurately reflects the example's possible network behavior.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill name, summary, and the entire markdown content are presented in Chinese, with no indication that users may choose another language. Under the policy, a fixed language/locale should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill repeatedly demonstrates saving PNG/SVG/PDF/HTML files and declares write-capable tools, but it does not prominently warn users that running the skill may create or overwrite files on disk. This can lead to unintended filesystem changes, especially when combined with generated code and export examples that normalize writing outputs by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger condition is very broad ('需要数据分析、报表生成、统计洞察、数据可视化时使用'), so the agent may invoke this skill for generic analysis requests that do not clearly require code execution or file output. In this skill, that matters because the tool set includes exec and write, increasing the chance of unnecessary code execution or filesystem modification from loosely matched prompts.

Content

No source excerpt is available for this finding.