ClawHub
Back to skill

Security audit

TRAE指挥官

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-built to automate TRAE, but it needs Review because it can launch a local app, write project files, and auto-submit clipboard text through the desktop without strong safeguards.

Install only if you intentionally want a skill that controls a local TRAE IDE session. Use a dedicated project directory under version control, avoid placing secrets in requirements or prompts, prefer manual paste unless you can verify the TRAE window focus, install optional dependencies in a virtual environment with reviewed versions, and do not run it as Administrator unless there is a specific, understood need.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:980
Finding

Unpinned Third-Party Automation Dependencies

Content
View full analysis
Remediation
View remediation
--hash=sha256: pyperclip== --hash=sha256: ``` 2. Install dependencies with hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Explicitly document the trusted package index and disable unintended fallback indexes where practical: ```bash python -m pip install \ --index-url https://pypi.org/simple \ --require-hashes \ -r requirements.txt ``` 4. Review transitive dependencies and update the lock file through a controlled dependency-review process. 5. Recommend installation inside a dedicated virtual environment rather than a privileged or system-wide Python environment. 6. Replace the unpinned installation commands in both `SKILL.md` and the runtime error message with the locked installation procedure. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
automation_helper.py:109
Finding

Unverified Global Keyboard Input Can Target the Wrong Application

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description understates the actual behavior: the skill can discover executables, launch local programs, manipulate the clipboard, simulate keystrokes, create and delete files, and continuously orchestrate work on the host. That mismatch is dangerous because users or higher-level agents may authorize the skill for 'project management' while unintentionally granting invasive automation over the local desktop and filesystem.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 565)May include surrounding context.

time.sleep(1)

text

## Self-Update

Log in `execution_log.json`:
```json

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · automation_helper.py (reported line 221)May include surrounding context.

python
f.write(prompt_text)
            
        print(f"✅ 提示文件已创建: {prompt_file}")
        return prompt_file


class ProgressMonitor:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation promotes automatic prompt sending via GUI automation and persistent config/file creation without any explicit warning, confirmation step, or discussion of side effects. In an agent skill context, this is dangerous because it normalizes actions that can manipulate another application and modify the local filesystem, increasing the risk of unintended actions, prompt injection propagation, or misuse on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The one-click workflow is framed as a convenience feature while omitting that it will create project artifacts, launch the IDE, and automatically inject prompts. Presenting system-impacting behavior as a single action without warnings or gating is risky because users may trigger broad local changes without understanding them, especially in an orchestration skill intended to automate development tasks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill embeds capabilities for local process launch, file read/write, shell-like orchestration, and desktop automation, but it declares no explicit tool scope or permission boundaries. In an agent setting, this can cause the skill to be invoked with overly broad authority and perform impactful host-side actions without clear consent or sandboxing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation metadata is broad enough to match many normal software-development requests, increasing the chance that this powerful automation skill is selected when a safer, read-only or advisory skill would suffice. Because the skill can modify files and control a local IDE, overbroad activation materially raises the risk of unintended execution and system changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The 'When to Invoke' section lists generic triggers like developing software or needing project management, with no scope constraints. In context, that is risky because the documented behavior includes launching executables, writing project files, and sending GUI input, so ambiguous routing can escalate a routine request into host-modifying actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill openly instructs file creation, prompt generation, IDE launching, and task submission, but it does not present a clear warning that it will modify the local system and potentially overwrite project state. Missing a safety notice is especially problematic here because the operations are not merely advisory; they change files and trigger automated execution flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Clipboard injection and simulated keypresses via pyautogui/pyperclip can send unintended commands to whichever window has focus, leak sensitive clipboard contents, or interfere with unrelated applications. Without a dedicated warning and focus-validation safeguards, this desktop automation creates a realistic path to accidental command execution and data exposure on the user's machine.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · automation_helper.py (reported line 96)May include surrounding context.

python
if project_path:
            print(f"   项目: {project_path}")
            
        subprocess.Popen(cmd)
        return True
    
    def send_prompt(self, prompt_text, delay=5):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The function copies prompt content to the system clipboard and immediately auto-pastes it into the active GUI window. Clipboard contents can be observed or overwritten by other applications, and GUI automation may send sensitive text to the wrong window if focus changes, causing unintended disclosure or execution in another application.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

create_project() creates directories and overwrites requirements.md without prompting or safeguarding existing contents. If project_dir is mistaken, attacker-influenced, or points to an important location, local files may be modified or destroyed unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The generated prompt instructs the downstream agent to work autonomously and not require user confirmation. In an orchestration skill, this reduces human oversight for code generation and filesystem changes, increasing the chance of unsafe actions, overreach, or propagation of harmful instructions embedded in requirements.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

wait_for_completion() allows timeout=None and then loops indefinitely, polling the filesystem forever unless a signal file appears. In automation contexts this can hang an orchestrator, tie up worker capacity, and create a denial-of-service condition or operational deadlock.

Content

Scanner excerpt · automation_helper.py (reported line 265)May include surrounding context.

python
return status
    
    def wait_for_completion(self, timeout=None, interval=10):
        """
        等待项目完成

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This Python file presents its title, menu, prompts, and status messages entirely in Chinese, beginning with the module description. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The entire skill file is presented only in Chinese and includes Chinese-facing instructions, with no indication that users may choose another language or that the skill is intentionally region-specific. Under SQP-3, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

Several examples, comments, prompts, and status strings are written in Chinese while the surrounding document is in English, and the skill does not state that Chinese output is optional or user-selected. This creates an implicit language preference that may not match the user's locale or expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Docstrings, console output, and generated prompt content are all presented in Chinese, with no indication that another language can be selected. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The code persists prompt content derived from requirements to a local file, which may store sensitive project details on disk without notice. This is primarily a privacy/data-handling issue rather than code-execution risk, but it can expose confidential requirements through backups, indexing, or other local access.

Content

No source excerpt is available for this finding.