ClawHub
Back to skill

Security audit

course-study

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed course-study helper, but it automatically runs a course-folder Python script if present, which could execute untrusted local code.

Review this skill before installing if you use shared or downloaded course folders. The main risk is that a course directory containing `管理/catalog.py` would cause the agent to run that Python file automatically after writing notes; only use it with course folders and scripts you trust, or remove/disable that step.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
rules/layout.md:93
Finding

Automatic Execution of an Untrusted Course-Local Python Script

Content
View full analysis

Vulnerability Details

File Location: rules/layout.md:93
Related Entry: SKILL.md:54
Vulnerability Type: Execution of untrusted local code across the course-content trust boundary
Risk Level: High

Complete vulnerable snippet:

text
课程根真有 `管理/catalog.py` 时，在课程根只跑这两条：`python3 管理/catalog.py refresh`、`python3 管理/catalog.py verify`。失败就把输出报告给用户；不为过检去改名、搬动或删除任何不是本次写出的文件。verify 全绿只说明路径与哈希对得上，不说明链接能跳。脚本不存在就什么都不跑。

The corresponding condensed instruction in SKILL.md:54 states:

text
课程根真有 `管理/catalog.py` 才跑、只跑 refresh 与 verify。

Technical Analysis

The Skill processes course directories whose documents and files may originate from course-material authors, shared-folder participants, or archive providers. It otherwise treats course materials as input data and contains several safeguards against following instructions embedded in those materials.

However, rules/layout.md:93 instructs the agent to discover and execute a Python file based only on its path and existence. It does not require inspection, provenance validation, ownership checks, an integrity check, or explicit confirmation from the user.

Restricting the command-line arguments to refresh and verify does not make execution safe. Python runs module-level statements before or independently of argument handling. A malicious 管理/catalog.py can therefore perform arbitrary actions as soon as the interpreter loads it.

The project history reinforces that this behavior is intentional but not malicious: CHANGELOG.md:54 states that the course-root script is run as a user-local configuration command and that its contents are not audited. This confirms the reachable trust-boundary violation, but there is no evidence that the Skill author supplied a malicious payload or intended exploitation.

Attack Path

  1. An attacker who can contribute to a course archive or shared course directory creates or replaces <course>/管理/catalog.py.
  2. The file contains malicious top ...[truncated 1485 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove automatic execution based solely on the presence of <course>/管理/catalog.py.
  2. Implement the required refresh and verification operations inside the trusted Skill using constrained file APIs rather than executing course-provided code.
  3. If compatibility requires the external script:
    • Require explicit user approval immediately before execution.
    • Display the exact canonical script path and explain that it is executable code from the course directory.
    • Inspect the complete script before execution and reject dynamic imports, subprocess execution, network access, and writes outside the authorized study directory.
    • Validate provenance or integrity using a user-configured allowlist or pinned cryptographic digest.
    • Reject symlinks and verify that the canonical path remains within the intended course root.
    • Execute it in a sandbox with no network access, a minimal environment, no unrelated credentials, and write access limited to the authorized course output directory.
  4. Treat SPEC.md, AGENTS.md, course PDFs, archives, and all course-local scripts as untrusted input unless the user explicitly establishes their trust.
  5. Prefer a declarative catalog format over executable Python for local course metadata and verification settings.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README states that the skill "writes a Chinese companion document," which imposes a specific output language by default. Although the file itself has an English README, the skill behavior does not appear to offer the user a language choice or make the locale restriction an explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The line explicitly requires "Chinese explanation with English technical terms kept as-is," which is a fixed language policy. There is no indication here that users can opt into another language or locale, so this appears to violate the requirement not to force a specific language without user choice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
77% confidence
Finding

The skill is explicitly designed to persist course content into a study/记忆库/ and later answer follow-up questions based on stored concepts across sessions. Persistent storage of user-provided lecture material can create privacy and data-retention risk, especially if the notes contain copyrighted material, personal annotations, or institution-restricted content, and if users are not clearly prompted for consent or retention boundaries.

Content

Scanner excerpt · README.en.md (reported line 28)May include surrounding context.

md
**Known limitations (4.2)** — A very long lecture may be delivered one Part at a time: unwritten Parts are marked "（未写）" in the navigation, the reply says where it stopped, and the next run on the same lecture continues from there. Past homework / exam questions of the same type get a full worked drill (including the result) in the appendix — just never in a submittable answer-sheet form. Appendix link clicks were not GUI-tested on GitHub / Typora; mermaid is untested on GitHub / Obsidian / pandoc. A few rules rely on the model's own discipline and are occasionally missed (【延伸】 tags vs. memory write-backs, English source terms in entries, the "（未核）" mark), with no mechanical gate behind them. The dev-time scanner checks shape only; whether a section really teaches is judged by blind review. Since 4.2.1 its granularity gate grants the "动画分页" (animation build) exemption only when the pages share a first line, a footer logical page number can be read on every page, and the range spans at most 3 logical pages; it does not check that the content grows page by page. The footer number is read from each page's last line only, so a slide whose last line is a content digit is misread (one known false green), and a mislabel spanning 2–3 logical pages still passes. Against the bare model (4.2.1, 3 cases): learnability and correctness tied in all three, fidelity (header, verbatim problems, appendix back-links, memory store) better in all three, but the documents run 2–3x longer, mostly from quoting a slide line and then restating it; on padding it lost two cases and tied one.

**When to use** — "here's lecture 9, write the companion and file it" · "write a companion doc for this PPT" · "so why is lw's critical path 1ns longer?" (a follow-up on a stored concept) · "finals are coming, summarize the whole course"; or call `$course-study`.

**Not for** — writing the graded homework you have to hand in (same-type questions are only worked through in the appendix, with the source file
...[truncated 25 chars]

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The usage examples include generic phrases like "write a companion doc for this PPT" and especially "here's lecture 9, write the companion and file it," which are broad natural requests rather than narrowly scoped invocation triggers. The description does not provide exclusion conditions or tighter constraints, so these phrases may overlap with ordinary conversation and lead to accidental activation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.en.md (reported line 34)May include surrounding context.

md
**Deliberately dropped from v3** — whole-course batch mode with its coverage checklist and reconciliation; the Phase-0 intake questionnaire; page-count tiers; the "PDFs may only go through the `/pdf` skill" rule.

**Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/course-study ~/.claude/skills/`).

Full spec: [SKILL.md](SKILL.md)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README states the skill will produce a Chinese companion document, which is a natural-language policy constraint. Although an English README exists, the skill behavior itself is described as fixed to Chinese rather than offering the user a language or locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This line explicitly requires Chinese explanations while preserving English terminology, which reinforces a mandatory language policy. The file does not indicate that users may opt into another language or that the restriction is limited to a clearly justified regional/compliance context.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md
**相对 v3 刻意去掉** —— 整门课批处理与覆盖清单对账；Phase-0 问卷式 intake；按页数分档；「PDF 只许走 `/pdf` skill」这条限制。

**安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/course-study ~/.claude/skills/`）。

完整说明见 [SKILL.md](SKILL.md)。

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md
**相对 v3 刻意去掉** —— 整门课批处理与覆盖清单对账;Phase-0 问卷式 intake;按页数分档;「PDF 只许走 `/pdf` skill」这条限制。

**安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/course-study ~/.claude/skills/`)。

完整说明见 [SKILL.md](SKILL.md)。

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest sets language: zh, and the description also repeatedly requires producing Chinese companion documents. This imposes a specific language behavior without indicating user opt-in or an option to choose another language, which matches the locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire skill specification mandates Chinese output and workflow phrasing throughout the file, including user-facing reply requirements, but does not offer any language choice or opt-in. Under the locale policy rule, forcing a specific language is a natural-language policy violation unless the constraint is explicitly optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The opening instruction is written as a directive in Chinese and states when to read this exemplar, while the rest of the file consistently presents the skill guidance in Chinese. There is no indication that users may choose another language or locale, which makes this a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file is entirely written as a prescriptive formatting policy in Chinese and repeatedly uses mandatory language such as '一律', '只用', and fixed Chinese labels, which effectively forces a specific language/locale for the skill's content. The file does not offer a user language choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The prescribed reply text at L14 is fixed in Chinese, and the surrounding document is written as mandatory operational guidance rather than an optional locale preference. This creates a natural-language locale policy issue because it constrains output language without user opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction text is entirely in Chinese and includes prescriptive guidance about when to read the file, but it does not offer any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The entire skill file is written as mandatory operating instructions in Chinese, and it does not indicate that the user may choose another language or that Chinese is required for a documented regional purpose. This creates a language-policy issue because the skill appears to prescribe a specific language by default without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

Line L008 states the reply format should use a fixed Chinese phrase: “四处统一成一行『图形未核对：<文件> p.N（原因）』, 每页一行、只在回复里”. This is a natural-language locale choice embedded as a required response string, with no indication that the user can choose language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.