漫剧

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 1.0.0

Overview

The skill’s goal is clear, but it relies on vulnerable or under-verified Python dependencies and the shipped entrypoint appears malformed, so it should be reviewed before installation.

Install only in an isolated OpenClaw virtual environment or container, verify the libtv package source, and update or audit the pinned dependencies before use. Do not provide private or sensitive story files unless you are comfortable with the libtv backend processing their contents. The entrypoint also needs packaging correction because it appears to contain Markdown fencing rather than valid Python.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unverified Third-Party Dependency Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-3, README.md:4-7
Vulnerability Type: Third-party software supply-chain risk
Risk Level: Medium

Vulnerable Code

requirements.txt:1-3:

text

libtv==0.3.2
Pillow==10.3.0
tqdm==4.66.2

README.md:4-7:

bash

# 1️⃣ Enter the folder
cd libtv-qunqin

# 2️⃣ Install dependencies
pip install -r requirements.txt

Technical Analysis

The documented installation procedure directs users to install third-party Python packages through pip. Although exact package versions are specified, the dependency artifacts are not protected with cryptographic hashes, and the project does not identify a trusted package index, verified source repository, or other provenance information for the specialized libtv package.

Version pinning prevents ordinary version drift, but it does not verify that the downloaded artifact is authentic or that the named package corresponds to the intended implementation. Python packages may execute code during installation, import, or normal runtime. The entry point imports WebtoonCreator from libtv and delegates the principal processing operation to it, giving that dependency access to the complete story text, rendering parameters, output path, filesystem permissions, network access, and other privileges of the invoking user.

The repository does not itself prove that libtv==0.3.2 is malicious. The finding concerns the absence of dependency provenance and artifact-integrity controls around executable third-party code.

Attack Path

1. An attacker compromises the package distribution account, upstream release process, package index, or dependency delivery channel associated with libtv.
2. The attacker causes a malicious or substituted artifact to be served for the expected dependency.
3. A user follows the documented command pip install -r requirements.txt.
4. The malicious package executes co ...[truncated 1116 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify that libtv==0.3.2 comes from the intended publisher and document its authoritative source repository and package-index identity.
2. Generate a fully resolved lock file containing SHA-256 hashes for every permitted distribution artifact, and install with hash verification, such as pip install --require-hashes.
3. Configure installations to use an explicitly trusted package index rather than relying on ambient or user-controlled pip configuration.
4. Audit or vendor the exact libtv source used by the project, including build metadata and installation hooks.
5. Build dependencies in a controlled environment and retain provenance or software bill of materials records for deployed artifacts.
6. Run installation and execution under a dedicated, least-privileged account or isolated container with restricted filesystem and network access.
7. Avoid exposing unrelated credentials or sensitive environment variables to the rendering process.
8. Add automated dependency vulnerability, provenance, and integrity checks to the release workflow.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Known Vulnerable Dependency: Pillow==10.3.0 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is pinned to Pillow 10.3.0, and the provided finding indicates multiple published advisories affecting that exact version, including denial-of-service and command-injection related issues. In a requirements file, shipping a version with known CVEs is a real supply-chain risk because any code path that processes untrusted images or invokes affected functionality could expose the agent runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The natural-language instructions are entirely in Chinese, including operational guidance and examples, with no indication that other languages are supported or that the Chinese-only presentation is required for a region-specific purpose. This can violate a language/locale policy when users are not given an opt-in or alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Error strings and operational comments are presented only in Chinese, which can impose a fixed language on users without opt-in. Under the policy rule, forcing a specific language without offering a choice or clearly documenting a justified locale restriction is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code accepts an output_dir, creates it with mkdir, and then runs a generator that is clearly intended to produce files in that location. While there are internal comments, there is no user-facing confirmation, log message, or explicit disclosure that filesystem changes will occur, which matches the missing-warning criterion for file writes in code files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language content describing the skill, parameters, and behavior is entirely in Chinese, which can impose a language constraint on users without opt-in. The policy allows locale constraints when they are explicitly justified, but this file does not state that the skill is intended only for Chinese-speaking users or a China-specific workflow.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: tqdm==4.66.2 — 2 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2024-34062 (tqdm CLI arguments injection attack)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The requirements file pins tqdm 4.66.2, and the finding cites a known CLI argument injection advisory for that version. While exploitation typically depends on the package being used through its CLI or with attacker-controlled arguments, pinning a known vulnerable version still represents a genuine dependency vulnerability.

Content

No source excerpt is available for this finding.