ClawHub
Back to skill

Security audit

political-struggle-history

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent history explainer, but its optional search mode needs review because it uses Bash, a Tavily API key, external queries, and a hardcoded fallback path outside the package.

Install only if you are comfortable with a Chinese-language history skill that can run a local Python search script through Bash and send search terms to Tavily when search mode or differing-view requests are used. Prefer using the local reference mode unless you have set a Tavily key intentionally, and avoid the hardcoded fallback path or broad Bash troubleshooting unless you have verified the target file yourself.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/search_views.py:25
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: scripts/search_views.py:25-30
Vulnerability Type: Unpinned and unverified third-party package installation
Risk Level: Medium

Vulnerable Code

python
try:
    from tavily import TavilyClient
except ImportError:
    print("错误: 请先安装 tavily-python\n  pip install tavily-python", file=sys.stderr)
    sys.exit(1)

Technical Analysis

When the Tavily client is unavailable, the script recommends installing tavily-python without specifying an audited version, package hash, lockfile, or trusted package index. The package and its transitive dependencies can therefore change independently of the reviewed Skill.

Python packages may execute code during installation or when imported. If the referenced package, one of its dependencies, or the configured package index is compromised, following this installation instruction could execute attacker-controlled code. The repository does not contain evidence that the current Tavily package is malicious; the vulnerability is the absence of reproducible dependency and integrity controls.

Attack Path

  1. A user invokes the Skill's optional search functionality.
  2. The environment does not contain the tavily module.
  3. The script displays the unpinned pip install tavily-python instruction.
  4. The user or Agent installs the package from the configured package index.
  5. A compromised or unexpectedly changed package or transitive dependency is resolved.
  6. Malicious package code executes during installation or subsequent import with the installing process's privileges.

Impact Assessment

Successful supply-chain exploitation could run arbitrary code with the privileges of the user or Agent process performing the installation. This could expose files, environment variables such as API credentials, and network resources accessible to that account. The issue does not itself provide privilege escalation beyond the i ...[truncated 95 chars]

Remediation
View remediation

Remediation Suggestions

  1. Declare an audited, exact tavily-python version in a dependency manifest or lockfile.
  2. Pin all transitive dependencies and record cryptographic hashes.
  3. Install dependencies with hash verification, such as pip install --require-hashes -r requirements.txt.
  4. Use an isolated virtual environment rather than modifying the Agent's global Python environment.
  5. Configure an explicitly trusted package index and disable unintended fallback indexes.
  6. Add automated dependency vulnerability and integrity scanning.
  7. Replace the free-form installation recommendation with documented, reproducible setup instructions.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search_views.py:183
Finding

Indirect Prompt Injection Through Untrusted Search Results

Content
View full analysis

Vulnerability Details

File Location: scripts/search_views.py:183-192, 237-250; SKILL.md:115-125
Vulnerability Type: Untrusted remote content passed into Agent synthesis without an explicit trust boundary
Risk Level: Medium

Vulnerable Code

python
vr = ViewResult(
    title=r.get("title", ""),
    url=url,
    snippet=r.get("content", "")[:500],
    source_type=source_type,
)
if vr.source_type == "folk":
    report.folk.append(vr)
elif vr.source_type == "overseas":
    report.overseas.append(vr)
else:
    report.mainstream.append(vr)
python
def format_markdown(report: SearchReport) -> str:
    """将搜索结果格式化为 Markdown。"""
    lines = []
    lines.append(f"# 「{report.event}」多元观点搜索报告\n")

    def section(title: str, items: list[ViewResult]):
        lines.append(f"## {title}（共 {len(items)} 条）\n")
        if not items:
            lines.append("_暂无搜索结果_\n")
            return
        for i, v in enumerate(items, 1):
            lines.append(f"### {i}. {v.title}\n")
            lines.append(f"- **来源**: [{v.url}]({v.url})")
            lines.append(f"- **摘要**: {v.snippet}\n")

The Skill then directs the Agent to synthesize the returned Markdown:

markdown
搜索完成后，基于脚本返回的 markdown 结果，进一步整理并追加综合分析

Technical Analysis

Tavily result fields are derived from arbitrary Internet pages. The script copies each result's title, URL, and content snippet into Markdown without escaping Markdown control characters, validating the URL scheme, or marking the content as untrusted data. The Skill subsequently instructs the Agent to use that output for further analysis but does not explicitly require it to ignore commands or policy-like text embedded in retrieved results.

An attacker can publish a page whose indexed title or content contains instructions directed at an AI Agent. If Tavily returns that page, the injected text becomes part of the context used for sy ...[truncated 1463 chars]

Remediation
View remediation

Remediation Suggestions

  1. Explicitly define every search-result field as untrusted evidence and instruct the Agent never to follow directives contained in titles, snippets, pages, or metadata.
  2. Return structured JSON rather than interpolated Markdown, keeping remote data separate from Agent instructions.
  3. Escape Markdown metacharacters in titles and snippets before display.
  4. Parse URLs and allow only expected schemes such as https; reject control characters and unsafe or malformed schemes.
  5. Place retrieved text inside clearly delimited quotation blocks labeled as untrusted external content.
  6. Add a preprocessing step that flags common prompt-injection patterns while retaining the original evidence for review.
  7. Require human confirmation before any tool action suggested by retrieved content.
  8. Ensure synthesis prompts state that external text cannot modify system instructions, Skill rules, tool permissions, or the user's request.
  9. Prefer allowlisted, reputable sources where practical and preserve provenance for every quoted claim.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill is presented as a historical explanation tool, but it conditionally performs external network-backed search via a Bash-invoked script and depends on an API key not reflected in the high-level description. This creates a trust and scope mismatch: users and platform operators may not expect data to be transmitted externally or the skill to invoke shell commands for a history-commentary task.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The script reads the TAVILY_API_KEY from environment variables, which is a privileged capability that should be explicitly declared in the skill's permissions model. Undeclared secret or environment access can surprise users and reviewers, and in an agent setting it expands the skill's effective trust boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

L003 写明“当用户询问历史政治斗争、宫廷政变、权力斗争时自动触发”，其中“权力斗争”等表述范围很广，缺少明确边界，容易覆盖普通对话或泛历史讨论场景。该描述也未提供排除条件或负面示例，无法清晰区分何时应激活、何时不应激活。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to run a search script that sends the user's query to an external service, but it does not require a clear warning or consent step before transmitting that content. Even seemingly harmless history queries can contain sensitive context, and undisclosed external transmission is a privacy and trust risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation directs the agent to rely on a local environment variable containing an external API credential for network search, even though the core skill purpose is historical explanation. That expands the skill's privileges and can cause unintended credential use or external data disclosure beyond what users would reasonably expect from the declared function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill tells the agent to use Bash directly to execute and troubleshoot script failures, which grants broad operational latitude unrelated to a narrow history-explanation role. In practice, this can normalize shell access, increase attack surface, and encourage actions beyond the least-privilege behavior users expect from a content skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

L132 明确规定“所有内容用中文输出”，属于固定语言要求，未提供用户选择或同意机制。根据语言/locale 政策，除非有清晰、合理且已说明的地域性限制，否则不应无条件强制单一语言。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document is presented entirely in Chinese and the title explicitly targets Chinese historical-political reference material, but there is no indication that this locale constraint is optional or justified as a region-specific skill requirement. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill explains political struggles across China and Western Europe and supports China-West comparison. In this file, the module docstring, CLI help, event translations, and query templates are all narrowly scoped to Chinese historical events, with no support for Western European events or comparative analysis logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

User-supplied event names are sent to the external Tavily service during search, but the script provides no explicit user-facing notice or consent boundary about that transmission. In an agent or privacy-sensitive environment, this can leak user queries, interests, or potentially sensitive investigation topics to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The argument help text explicitly requires the event name to be provided in Chinese, which imposes a language constraint on the user. The file does not present this as an optional or user-selected locale preference, and the policy calls for flagging language-forcing behavior unless opt-in or clear justification is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring states that the output is structured JSON containing summarized viewpoints. However, the argument parser defines both JSON and Markdown formats and defaults to Markdown, so the documented behavior contradicts the actual runtime behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown file presents all instructional/reference content in a single language, Chinese, with no indication that the user can select another language or that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.