ClawHub
Back to skill

Security audit

China Holiday

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward China holiday calendar helper with a minor dependency-pinning risk but no hidden or high-impact behavior.

Install in a normal isolated Python environment and consider pinning chinese-calendar to a reviewed version before production use. Expect Chinese-language output focused on China Mainland holiday rules.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Related Location: holiday.py:11-15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text
chinese-calendar

Related installation guidance in holiday.py:11-15:

python
try:
    import chinese_calendar
except ImportError:
    print("Please install chinese-calendar: pip install chinese-calendar")
    sys.exit(1)

The quoted English message is a translation of the original installation prompt; its command is unchanged.

Technical Analysis

The project declares chinese-calendar without an exact version or integrity hash. The fallback message also recommends an unconstrained pip install chinese-calendar command.

Consequently, installations are not reproducible and may retrieve any release selected by the configured package index. This does not demonstrate that the current upstream package is malicious. However, it creates a supply-chain exposure if a future release is compromised, the package owner or distribution account is compromised, or the installer is configured to use an untrusted package index.

Python packages may execute code during installation, and imported modules execute top-level code at runtime. The application imports this dependency whenever holiday.py is loaded, so a malicious resolved package could execute before the calendar functionality is used.

Attack Path

  1. An attacker compromises the package's distribution channel or causes the victim's package installer to resolve the dependency through an attacker-controlled or untrusted index.
  2. The attacker publishes a malicious release under the dependency name.
  3. A user runs pip install -r requirements.txt or follows the installation command printed by holiday.py.
  4. Because no version or hash is enforced, the installer accepts the attacker-controlled distribution.
  5. Malicious code executes during installation or when `hol ...[truncated 664 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed release:

    text
    chinese-calendar==<reviewed-version>

  2. Generate and commit cryptographic hashes for all resolved distributions, then install with hash verification:

    bash
    python -m pip install --require-hashes -r requirements.txt

  3. Use a lock-generation workflow such as pip-tools so direct and transitive dependencies are fixed and reviewed.

  4. Install only from an explicitly approved HTTPS package index; disable unintended supplemental indexes where practical.

  5. Add automated dependency vulnerability and provenance checks to CI.

  6. Test dependency updates in an isolated environment before changing the reviewed pin and hashes.

  7. Run installation and the Skill under a least-privileged account or isolated environment to reduce the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest description and the entire markdown content are written in Chinese, and the skill presents itself as a general calendar service rather than explicitly documenting that it is intended only for Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code presents its purpose and all user-facing messages in Chinese only, indicating a fixed language/locale behavior. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

At L170 the comment says is_holiday returns False for makeup workdays, but this loop iterates over chinese_calendar.get_holidays(start, end) and then labels entries based on chinese_calendar.is_holiday(date). In this context the comment is misleading because the function is operating on holidays returned by get_holidays, not a mixed set of holidays and makeup workdays, so the documented intent does not match what the code is actually processing.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency is specified without a version pin, so installs may resolve to different upstream releases over time. This creates supply-chain and reproducibility risk: a future malicious or breaking release of chinese-calendar could be pulled automatically during deployment, even though the package itself is not inherently suspicious in this holiday-calendar skill.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
chinese-calendar

Static analysis

No suspicious patterns detected.