data-cleaning-claw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This data-cleaning skill mostly matches its stated purpose, but it needs Review because it can install unpinned Python packages and exports spreadsheet files without neutralizing formula-like values.

Install only if you are comfortable with a Chinese-language data-cleaning tool that may install Python packages at runtime. Use it in an isolated environment, avoid opening cleaned CSV/XLSX files from untrusted data in spreadsheet software unless formulas are neutralized, and keep original data backups before running deduplication.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/data_clean.py:31
• Finding: Spreadsheet Formula Injection in Exported CSV and Excel Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/data_clean.py:31-42` **Vulnerability Type**: Spreadsheet formula injection **Risk Level**: Medium ### Vulnerable Code ```python def save_data(df: pd.DataFrame, path: str): p = Path(path) ext = p.suffix.lower() if ext in (".xlsx", ".xls"): df.to_excel(path, index=False) elif ext == ".csv": df.to_csv(path, index=False, encoding="utf-8-sig") elif ext == ".json": df.to_json(path, orient="records", force_ascii=False, indent=2) else: df.to_csv(path, index=False, encoding="utf-8-sig") ``` ### Technical Analysis The application reads user-controlled data as strings and writes it directly to CSV or Excel without neutralizing spreadsheet formula prefixes. Values beginning with characters such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the generated file is opened in spreadsheet software. The cleaning operations do not provide a final output-encoding step that forces untrusted values to be treated as literal text. Consequently, a malicious formula can survive ingestion, cleaning, and export. Whether a particular payload executes depends on the spreadsheet application, its security configuration, and the formula features it supports. Potential payloads include deceptive hyperlinks and formulas that initiate external requests. Legacy or insecure spreadsheet configurations may expose more dangerous functionality. ### Attack Path 1. An attacker places a formula-like value in an input CSV, JSON, or Excel cell. 2. A user invokes the cleaning Skill on that attacker-controlled dataset. 3. The input value passes through the cleaning pipeline without formula neutralization. 4. `save_data` writes the value into the generated CSV or Excel file. 5. The user or another recipient opens the output in spreadsheet software. 6. The spreadsheet application interprets the cell as a formula rather than ordinary text. 7. Depending on application capab ...[truncated 903 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Add a dedicated output-sanitization step for CSV and spreadsheet exports: 1. Inspect every string value before exporting it to CSV or Excel. 2. Treat cells beginning with `=`, `+`, `-`, or `@` as potentially dangerous. Also account for leading whitespace, tabs, carriage returns, and other characters that spreadsheet applications may ignore before evaluating a formula. 3. Prefix dangerous values with an apostrophe or otherwise force the destination cell type to text. 4. Apply protection after all cleaning and transformation steps so later processing cannot reintroduce unsafe values. 5. Use an Excel writer that explicitly sets untrusted cells to text where feasible. 6. Keep JSON output unchanged unless it will subsequently be imported into spreadsheet software. 7. Add regression tests covering every formula prefix, leading whitespace, tabs, Unicode whitespace, and ordinary negative numeric values. 8. Document whether formula neutralization is enabled and provide an explicit opt-out only for trusted data workflows. The sanitizer should distinguish legitimate numeric negative values from untrusted string formulas to avoid unnecessarily changing valid data. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:73
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73` **Vulnerability Type**: Unpinned and non-reproducible dependency installation **Risk Level**: Medium ### Vulnerable Instruction ```text - Script dependencies: `pandas numpy openpyxl beautifulsoup4`; if dependencies are missing, first run `pip install pandas numpy openpyxl beautifulsoup4` ``` The original instruction is written in Chinese, but it directs the agent to execute the following command: ```bash pip install pandas numpy openpyxl beautifulsoup4 ``` ### Technical Analysis The Skill instructs the agent to install third-party packages without exact version constraints, integrity hashes, a lock file, or an explicitly approved package index. Dependency resolution is therefore mutable: separate installations can retrieve different package and transitive-dependency versions. The package names shown are established packages rather than apparent typosquatting names. Nevertheless, the unrestricted command provides no cryptographic guarantee that the reviewed versions are the versions subsequently installed. A compromised release, compromised package index, dependency takeover, or unexpectedly incompatible future release could affect the Skill. Installed dependencies are imported by `scripts/data_clean.py`, so malicious package code could execute when imported or used. Installation and package code would run under the privileges of the account executing the Skill. ### Attack Path 1. A required dependency is absent from the environment. 2. The agent follows `SKILL.md` and runs the unpinned `pip install` command. 3. Pip resolves the latest acceptable direct and transitive packages from its configured index. 4. A compromised, malicious, or unexpectedly changed package version is downloaded and installed. 5. The cleaning script imports or invokes the installed package. 6. Malicious dependency code executes with the permissions of the account running the agent or script. This path requires ...[truncated 877 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a reviewed dependency lock file containing exact direct and transitive versions. 2. Generate and verify cryptographic hashes for every permitted distribution. 3. Install dependencies with a command such as: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Configure pip to use an explicitly approved package index and trusted certificate configuration. 5. Review and update locked dependencies through a controlled process that includes vulnerability and provenance checks. 6. Run dependency installation and the Skill inside an isolated virtual environment or container with minimum filesystem and network privileges. 7. Avoid installing packages automatically during normal Skill execution. Provision and verify dependencies before processing untrusted data. 8. Record the supported Python version and platform-specific package artifacts to improve reproducibility. 9. Consider generating a software bill of materials and using automated dependency vulnerability scanning in the release process. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill performs file-writing behavior by saving uploaded or pasted data to the workspace and generating cleaned output/report files, but it declares no explicit tool scope or permissions. This weakens enforcement and review boundaries, making unintended file operations harder to govern if the skill is invoked unexpectedly or extended later.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger conditions are broad and include common phrases around cleaning, deduplication, preprocessing, and data quality, which increases the chance of accidental invocation. Because this skill writes files and runs a script over user-provided inputs, over-triggering can lead to unintended data processing, file creation, or privacy-impacting handling of uploaded datasets.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: L72 states the default strategy is to mark abnormal values and 'not directly delete' them, preserving manual review. However, elsewhere the skill explicitly documents `deduplicate` as a default cleaning rule and the report includes '删除行数' (L28, L44, L58), which indicates row deletion can occur as part of normal execution.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The instruction to run pip install introduces package installation as part of skill execution, which expands the attack surface beyond routine data cleaning. Installing dependencies at runtime can fetch unpinned or tampered packages and enables environment modification that is unnecessary for normal operation in a tightly controlled skill environment.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains natural-language strings entirely in Chinese in the module docstring and CLI help text, which imposes a specific language on users without opt-in. The file does not indicate that the skill is region-specific or provide any alternative locale, so it conflicts with the language/locale policy criteria.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: 该技能整体说明以中文固定表述其行为与触发方式，但没有说明这是面向特定中文用户群的限定场景，也没有提供语言/locale 选择或 opt-in。按规则，若技能隐含强制特定语言而无用户选择，属于自然语言层面的策略风险。

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: This markdown file presents all skill guidance in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.