ClawHub
Back to skill

Security audit

Data Chart Tool

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent chart-generation tool, but its Python import path handling can load attacker-controlled local code and its licensing setup has risky secret-handling and authorization weaknesses.

Review before installing. Use it only in an isolated Python environment, avoid running it from shared writable directories, do not persist `SKILL_LICENSE_SECRET` in shell startup files, and be aware that the paid-feature license check is weak. The import-path issue should be fixed before using this on a multi-user system or with sensitive data.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T07 · Tool Hijacking and Spoofing

Error
Location
source/data_visualizer.py:14
Finding

Arbitrary Code Execution Through an Attacker-Controlled Python Import Path

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
source/data_visualizer.py:257
Finding

Premium License Verification Fails Open on Unexpected Errors

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
install.sh:18
Finding

Installation Uses Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · LICENSE.md (reported line 36)May include surrounding context.

  1. 安装：
    bash
    # 复制许可证到用户目录
mkdir -p ~/.data-chart-tool
cp /path/to/license.json ~/.data-chart-tool/license.json

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · LICENSE.md (reported line 36)May include surrounding context.

  1. 安装:
    bash
    # 复制许可证到用户目录
mkdir -p ~/.data-chart-tool
cp /path/to/license.json ~/.data-chart-tool/license.json

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document instructs users to persist a secret signing key in shell startup files, which increases the chance of credential exposure through dotfile sync, backups, shell history mishandling, process inheritance, or accidental disclosure to other local users and tools. In this skill's context, the risk is amplified because the same secret appears to be shared with customers for offline verification, so compromise of that secret can undermine the licensing mechanism and enable forged licenses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The prominent user-facing description and marketing copy are entirely in Chinese, and the document does not indicate that other languages are supported or that Chinese is required for a region-specific purpose. Under the policy, mandating a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language comments and user-facing messages are presented only in Chinese, which effectively forces a specific language for installation guidance and errors. The file does not offer any user opt-in, alternative locale, or justification for restricting the skill to Chinese-language output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description is written as broad promotional copy and does not define clear activation boundaries, supported inputs, or limiting conditions. In agent ecosystems, this can cause the skill to be selected in overly broad contexts, increasing the chance it is invoked on unintended data-processing tasks and exposing users to unexpected file handling or workflow behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is effectively Chinese-only and does not disclose a locale requirement or offer language choice. This can mislead routing or user understanding, causing the skill to be invoked for users who cannot read the description or constraints, which increases the risk of misuse or accidental execution in the wrong context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring and user-facing description are entirely in Chinese, and the CLI help/messages throughout the file continue that assumption. This creates a language/locale policy concern because the skill presents a fixed language experience with no opt-in or alternative for users who may expect another language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code explicitly permits the premium scatter feature to continue when license verification infrastructure fails, despite a comment stating it should be restricted in production. This creates a fail-open authorization bypass: an attacker or normal user can access paid functionality by inducing license-manager failure, missing dependencies, or other exceptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

All user-facing instructional content in the file is presented in Chinese, and the document does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking regional context. The policy for natural-language content requires avoiding forced language or locale constraints unless users are given a choice or the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.