ClawHub
Back to skill

Security audit

HK Student Portfolio Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate local document generator, but it asks for sensitive information about children without enough privacy guidance.

Install only if you are comfortable entering a child's school-application data into the agent workflow. Redact ID numbers, exact birth dates, addresses, phone numbers, and guardian details unless strictly required by the target school; store generated Word/PDF files in access-controlled locations and delete drafts when no longer needed. Prefer installing dependencies in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:180
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 180
Vulnerability Type: Unpinned runtime dependency
Risk Level: Medium

Complete Code Snippet:

bash
pip3 install python-docx

Technical Analysis

The documented installation command retrieves and installs the package version selected by the configured Python package index at installation time. The project does not provide an exact version constraint, verified package hashes, a lock file, or a trusted-index restriction.

This makes installations non-reproducible and leaves the Skill exposed to supply-chain compromise. If the package, one of its transitive dependencies, or the configured package index is compromised, attacker-controlled code could execute during installation, import, or document generation.

The audit did not find evidence that python-docx is currently malicious. The vulnerability is the absence of dependency integrity and version controls.

Attack Path

  1. A user or AI Agent follows the installation instructions in SKILL.md.
  2. pip3 resolves python-docx and its dependencies through the environment's configured package index.
  3. An attacker compromises a resolved release, a transitive dependency, or the package-index configuration.
  4. The malicious component is downloaded and installed without hash verification.
  5. Attacker-controlled code executes during package installation, import, or later document generation.
  6. During document generation, the compromised component may access the process's files, environment, network capabilities, and student data.

Impact Assessment

Successful exploitation would run code with the privileges of the user executing pip3 or the portfolio generator. The attainable scope depends on that account's permissions and may include:

  • Reading student and guardian information processed by the Skill, including names, birth dates, identity numbers, telephone numbers, email addresses, home addresses, academic records, a ...[truncated 476 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a dependency file containing an exact, reviewed python-docx version.
  2. Record and verify cryptographic hashes for the package and all transitive dependencies.
  3. Install dependencies with hash enforcement:
bash
python3 -m pip install --require-hashes -r requirements.txt
  1. Use a requirements entry in the following form:
text
python-docx==<reviewed-version> --hash=sha256:<verified-hash>
  1. Pin and hash all transitive dependencies rather than only the direct dependency.
  2. Configure installation to use an explicitly trusted package index or an internally reviewed package mirror.
  3. Perform dependency updates through a controlled review process that includes provenance checks, vulnerability scanning, and regression testing.
  4. Prefer an isolated virtual environment with only the filesystem and network permissions required for local document generation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to provide and process a student's personal information, including name, gender, school, ranking, and other profile data, but gives no privacy, consent, minimization, or retention guidance. Because this is a middle-school admissions resume tool involving minors, the absence of handling warnings materially increases the risk of unauthorized collection, oversharing, or unsafe downstream use of sensitive student data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very broad everyday terms such as '升中', '個人檔案', 'portfolio', and '中學面試', which can match ordinary educational conversations and cause the skill to activate unexpectedly. In this skill’s context, unintended invocation is risky because the workflow then solicits and processes sensitive student and family information, increasing privacy exposure and confusing users about which skill is acting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly requests and structures highly sensitive student data, including name, birth date, identification documents, contact details, family background, rankings, and teacher comments, but provides no privacy warning, minimization guidance, or handling notice. That omission can lead users to overshare children's personal data into the agent workflow without understanding retention, storage, or redaction expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This JSON structure hardcodes parallel Chinese and English self-introduction and teacher-comment fields, which implies a fixed language/locale requirement rather than offering a user-selectable language option. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The file-level description and many generated strings force Chinese-language content and formatting tied to Hong Kong school applications. Under the policy, a fixed language or locale without user choice or explicit justified constraint can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The docstring at L134 describes this as a portfolio generator, which is broadly true, but the code populates fields including ID type/number, birthday, phone, email, address, and emergency contact details from L279-L287. Because the documentation frames the tool as document generation without warning that it assembles a full dossier of sensitive personal data, the stated intent understates the actual behavior in a security-relevant way.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code saves a .docx file populated with personal information such as name, birthday, ID number, phone, email, address, and guardian/reference details. While the script prints the output path after saving, there is no prior user-facing warning, comment, or docstring disclosing that sensitive data will be written to a local file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s user-facing description and CLI messages are entirely in Chinese, indicating the skill is designed to operate in a single language without any opt-in or language-selection mechanism. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The schema repeatedly requires paired Chinese and English fields such as name_zh/name_en, self_intro_zh/self_intro_en, and comment_zh/comment_en. This imposes a fixed bilingual language expectation in the data model without any visible user opt-in, alternative locale support, or justification that the skill is specifically limited to Chinese/English users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README promotes Word and PDF output for resumes containing student information but does not warn that these files may persist sensitive data, be copied easily, or include metadata that exposes personal details. In the context of school application materials for minors, this omission can lead users to distribute or store sensitive documents insecurely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The description and invocation guidance are written as Hong Kong Chinese workflow instructions and present the skill as a Hong Kong-specific generator, but they do not explicitly state whether the user can opt into another language for interaction. Since policy requires avoiding language constraints without opt-in or clear justification, this should be made explicit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This JSON file contains many user-facing natural-language fields in Chinese, with some bilingual content, but there is no accompanying indication that Chinese is optional, user-selected, or required for a Hong Kong-specific context. Under the policy rule for language/locale, forcing or assuming a language without opt-in can be a violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The English self-introduction says "a boy who loves learning," which fixes gendered language in a user-facing narrative. Under the policy rule for language/locale-style constraints, this is a natural-language choice imposed by the file rather than offered as a user-selectable phrasing.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This JSON manifest-style template contains extensive student data collection fields but provides no surrounding description of when it should be used, what inputs should trigger it, or any exclusions. For manifest/plain-text scoped review, the absence of trigger specificity can make downstream skill invocation criteria ambiguous if this file is used as part of activation or intake logic.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.