ClawHub
Back to skill

Security audit

Project Showcase Enhancer

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate portfolio and interview-prep skill, but it needs review because it may read real configuration secrets and personal resume data without clear redaction or privacy safeguards.

Install only if you are comfortable letting the agent inspect the selected project and any resume/JD files you provide. Before use, remove or redact real .env files, tokens, passwords, private service URLs, and confidential resume details; prefer .env.example files and isolated Python dependencies for optional document parsing.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:85
Finding

Unnecessary Access to Secret-Bearing Environment Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:85
Vulnerability Type: Excessive access to sensitive configuration data
Risk Level: Medium

Vulnerable Instruction

The following is a faithful English rendering of the instruction at line 85:

markdown
- Configuration file analysis: Read `.env`, `application.yml`, and similar files to understand deployment environments and third-party service dependencies.

Technical Analysis

The Skill explicitly directs the Agent to read .env files during ordinary project analysis. These files commonly contain API tokens, database passwords, private service endpoints, signing secrets, and cloud credentials.

Reading the values of these secrets is not necessary to identify configuration structure or third-party dependencies. The analysis can normally use .env.example, configuration schemas, or environment-variable names with values redacted.

Although no network exfiltration or deliberate credential theft was found, placing secrets in the Agent context creates unnecessary exposure. The values may be retained in conversation logs, tool traces, generated documentation, or model-provider processing systems. They may also be reproduced accidentally when the Agent discusses configuration or deployment.

Attack Path

  1. A user provides a project directory containing a real .env file.
  2. The Skill enters its mandatory deep-code-analysis stage.
  3. Following SKILL.md:85, the Agent opens and reads the .env file.
  4. Secret values enter the Agent's context and associated execution logs.
  5. The Agent may inadvertently quote, summarize, or place those values in generated showcase or deployment documentation.
  6. Anyone with access to the conversation, logs, or generated files could recover the exposed credentials.

Impact Assessment

The potential scope depends on the credentials stored in the environment file. Exposure could provide access to:

  • Appli ...[truncated 385 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to read .env files by default.
  2. Prefer .env.example, .env.template, configuration schemas, and documented variable lists.
  3. If inspection of a real environment file is essential, obtain explicit user consent first.
  4. Read only environment-variable names and replace every value with a fixed marker such as [REDACTED].
  5. Add an explicit rule prohibiting credentials from appearing in prompts, analysis results, generated documents, logs, or code examples.
  6. Detect common secret formats before processing configuration content and redact matching values.
  7. Restrict configuration analysis to files inside the user-approved project root.
  8. Recommend immediate credential rotation if a secret is accidentally exposed.

T08 · Insecure Dependencies

Note
Location
README.en.md:57
Finding

Unpinned Third-Party Dependencies Installed from the Active Python Package Index

Content
View full analysis

Vulnerability Details

File Locations:

  • README.en.md:57-58
  • README.md:64-65
  • README.md:298-299
  • README.zh-CN.md:63-64
  • scripts/parse_file.py:21
  • scripts/parse_file.py:29

Vulnerability Type: Unpinned and unverifiable dependency installation
Risk Level: Low

Vulnerable Code and Instructions

bash
# Optional dependencies used to parse resume files
pip install pdfplumber python-docx pypdf

The parser also returns installation guidance without version or integrity constraints:

python
return "[Error] Install pdfplumber: pip install pdfplumber"
python
return "[Error] Install python-docx: pip install python-docx"

Technical Analysis

The documented command installs mutable package versions from whichever Python package index is active in the user's environment. It does not specify reviewed versions, verify package hashes, use a lock file, or require an isolated virtual environment.

The listed package names appear consistent with the imported libraries, and no typosquatting was identified. However, the installation remains non-reproducible and inherits trust from the current pip configuration. A compromised upstream release, malicious dependency update, or attacker-controlled package index could introduce code that executes during installation or when the parser imports the package.

The parser imports these dependencies when processing user-provided PDF or DOCX files. Consequently, dependency code executes with the same operating-system privileges as the Agent or user invoking the parser.

Attack Path

  1. A user requests PDF or DOCX résumé parsing.
  2. A required parser dependency is absent.
  3. The documentation or parser error instructs the user to run the unpinned pip install command.
  4. Pip resolves packages and transitive dependencies through the environment's configured index.
  5. A compromised release, dependency, or configured index s ...[truncated 825 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed requirements file containing exact versions, for example:

    text
    pdfplumber==<reviewed-version>
python-docx==<reviewed-version>
pypdf==<reviewed-version>

  2. Generate and verify hashes for all direct and transitive dependencies using a lock-file workflow such as pip-tools.

  3. Document installation with hash enforcement:

    bash
    python -m pip install --require-hashes -r requirements.txt

  4. Require installation inside a dedicated virtual environment rather than the system Python environment.

  5. Use an explicitly trusted package index and review pip configuration for unexpected mirrors or additional indexes.

  6. Run dependency vulnerability and provenance checks before publishing updated lock files.

  7. Replace the parser's inline unpinned installation messages with a reference to the reviewed requirements file.

  8. Consider isolating document parsing in a low-privilege process because PDF and DOCX parsers handle complex, attacker-controlled inputs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s stated purpose is project-codebase analysis and showcase generation, but it also instructs the agent to parse arbitrary resume files from local paths via a separate script. That expands the skill’s effective capability from scoped project analysis into general local document extraction, which can expose unrelated sensitive data and violates least-privilege expectations for users invoking a portfolio helper.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/showcase-template.md (reported line 120)May include surrounding context.

md
{安装命令}

# 3. 配置环境变量
cp .env.example .env
# 编辑 .env 填入必要配置

# 4. 启动服务

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/showcase-template.md (reported line 121)May include surrounding context.

md
# 3. 配置环境变量
cp .env.example .env
# 编辑 .env 填入必要配置

# 4. 启动服务
{启动命令}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_project.js (reported line 130)May include surrounding context.

js
// ── 配置文件模式 ────────────────────────────────────
const CONFIG_PATTERNS = [
  '.env', '.env.local', '.env.development', '.env.production',
  '.env.example', '.env.template',
  'application.yml', 'application.yaml', 'application.properties',
  'application-dev.yml', 'application-prod.yml',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_project.js (reported line 130)May include surrounding context.

js
// ── 配置文件模式 ────────────────────────────────────
const CONFIG_PATTERNS = [
  '.env', '.env.local', '.env.development', '.env.production',
  '.env.example', '.env.template',
  'application.yml', 'application.yaml', 'application.properties',
  'application-dev.yml', 'application-prod.yml',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_project.js (reported line 130)May include surrounding context.

js
// ── 配置文件模式 ────────────────────────────────────
const CONFIG_PATTERNS = [
  '.env', '.env.local', '.env.development', '.env.production',
  '.env.example', '.env.template',
  'application.yml', 'application.yaml', 'application.properties',
  'application-dev.yml', 'application-prod.yml',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_project.js (reported line 130)May include surrounding context.

js
// ── 配置文件模式 ────────────────────────────────────
const CONFIG_PATTERNS = [
  '.env', '.env.local', '.env.development', '.env.production',
  '.env.example', '.env.template',
  'application.yml', 'application.yaml', 'application.properties',
  'application-dev.yml', 'application-prod.yml',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README describes capabilities that inspect project code, README content, resumes, and JD files, but it does not prominently warn users that these inputs will be read and processed. In this context, that omission increases the risk of users supplying sensitive source code, credentials in config files, or personal employment data without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough that the skill may activate when a user casually mentions analyzing or presenting a project, causing the agent to begin reading local code or related documents without sufficiently explicit intent. In this skill’s context, unintended invocation is more sensitive because the workflow is designed to inspect project directories and optionally parse resume/JD files, which can expose proprietary source code and personal data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are generic enough to overlap with ordinary conversation about projects, resumes, or interview prep, which can cause the skill to activate in contexts where the user did not intend deep code or document analysis. In this skill, unintended activation is more dangerous because activation may lead to ingestion of local project paths, README content, source code, resumes, and JD documents, expanding privacy and data-exposure risk without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README states that the skill parses resumes and ingests project code and README content, but it does not clearly warn users that these inputs may contain personal, confidential, or proprietary data. In this context, the omission is security-relevant because the skill is explicitly designed to collect sensitive artifacts and send them through analysis workflows, so users may disclose data without understanding retention, scope, or minimization expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README defines very broad natural-language triggers such as '分析一下我的项目', '帮我把这个项目推演到商用', and '生成一份项目展示文档'. In a chat-driven agent platform, vague trigger phrases can cause accidental activation during ordinary conversation, which may lead the skill to request project paths, parse uploaded files, or start analyzing local codebases without the user intending to invoke this workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The triggering language is broad enough to match routine requests like 'analyze my project' or 'help me write a project intro,' causing the skill to activate in situations where the user may not expect deep local scanning or auxiliary file parsing. Over-broad invocation increases the risk of unnecessary data access and unintended execution of higher-privilege behaviors.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest and body are written entirely in Chinese, and the instructions do not state that language should follow the user’s preference or offer an opt-in choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Including resume-file parsing is a scope expansion beyond the core function of analyzing a project codebase and generating project showcase materials. Because resumes commonly contain sensitive personal information, this capability increases the chance that the skill collects or processes unrelated private data under a broad project-help prompt.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The reference trigger phrases are ambiguous and cover common assistance requests without making clear that the skill may inspect directories, read configuration files, or process supplemental documents. In context, that ambiguity makes the skill more dangerous because it couples broad activation with capabilities that touch local data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire markdown template is written as a fixed Chinese interview-prep artifact, with no indication that users may choose another language or locale. Under the policy, a skill should not impose a specific language by default unless it offers opt-in or clearly documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring is entirely in Chinese, and the script's usage/help text is presented only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Multiple returned error messages and the command-line usage output are hard-coded in Chinese, with no alternate locale or user opt-in. This creates a consistent Chinese-only interaction model without documenting a justified region- or language-specific scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The scanner reads README content and includes up to 5000 characters in its JSON output without any minimization, redaction, or explicit consent boundary. README files often contain internal architecture notes, deployment instructions, URLs, example credentials, or operational details that may be unintentionally exposed to downstream LLMs or logs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are very broad and include common requests like '分析我的项目' or '帮我写项目介绍', which can cause the skill to activate in situations where the user did not intend to invoke this workflow. In an agent ecosystem, overbroad activation can lead to unnecessary repository scanning, unintended exposure of project context, or the skill taking over generic writing/analysis tasks that should have been handled by a narrower tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown template presents all headings and instructions in Chinese and does not indicate that the language is optional, configurable, or intended only for a China-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language description and usage strings are written only in Chinese, which forces a specific language experience without any visible user opt-in or documented locale limitation. This can violate language/locale policy where skills should not impose a language unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script extracts package metadata, script names, and merged dependency lists from package.json and emits them wholesale. While less sensitive than secrets, this still discloses internal technology choices and operational commands that can aid fingerprinting or reveal private project details when sent to external consumers.

Content

No source excerpt is available for this finding.