ClawHub
Back to skill

Security audit

一个自动化的菲律宾海关编码（HS Code）查询工具，帮助出口商快速找到正确的商品分类编码。｜

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Philippines HS-code helper that downloads/searches tariff PDFs, with some accuracy and transport-security caveats but no hidden persistence, credential use, or unrelated behavior.

Before installing, be aware that results are heuristic and should be verified against the official tariff book or a customs professional for important shipments. Avoid relying on PDFs downloaded through the current wget fallback until TLS verification is fixed, and install dependencies in an isolated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/get_chapter_pdf.py:67
Finding

TLS Certificate Verification Disabled for Google Drive Downloads

Content
View full analysis

Vulnerability Details

File Location: scripts/get_chapter_pdf.py:67-71
Vulnerability Type: Improper TLS certificate validation
Risk Level: Medium

Vulnerable Code

python
download_url = f"https://drive.google.com/uc?export=download&id={file_id}"
result = subprocess.run([
    "wget", "--quiet", "--no-check-certificate",
    "-O", output_path, download_url
], capture_output=True, timeout=120)

Technical Analysis

The large-file fallback invokes wget with --no-check-certificate. This option disables verification of the remote server's TLS certificate, preventing the client from confirming that it is communicating with the legitimate Google Drive service.

An attacker capable of intercepting or modifying the network connection could impersonate Google Drive and return an attacker-controlled file. The script performs a basic %PDF header and minimum-size check, but these checks establish only that the response resembles a PDF; they do not establish its authenticity or integrity.

The downloaded file is subsequently processed using pdfplumber. Consequently, an attacker could manipulate tariff results or expose the local PDF-processing stack to a maliciously crafted document.

Attack Path

  1. The normal curl download fails or returns a Google Drive confirmation page.
  2. download_from_gdrive() invokes download_large_file().
  3. The fallback starts wget with certificate validation disabled.
  4. An attacker with a network interception position impersonates drive.google.com.
  5. The attacker returns a file beginning with %PDF and larger than 10,000 bytes.
  6. The file passes the script's superficial validation and is saved at output_path.
  7. The application later parses the attacker-controlled PDF and may present manipulated HS-code information. Any exploitable defect in the installed PDF-processing stack would also become reachable.

Impact Assessment

The direct impact includes loss of downloaded-d ...[truncated 522 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove --no-check-certificate and require normal certificate-chain and hostname validation.
  • Fail closed when TLS validation fails rather than silently weakening transport security.
  • Prefer a maintained HTTPS library that uses the operating system or certifi trust store and enforces explicit connection and read timeouts.
  • If the publisher provides checksums or signatures, verify the downloaded PDF before processing it.
  • Retain the %PDF and size checks as format sanity checks, but do not treat them as authenticity controls.
  • Download to a temporary file in the destination directory and atomically rename it only after all validation succeeds.
  • Keep pdfplumber and its underlying PDF-processing dependencies patched and process untrusted PDFs in a sandbox where practical.

T08 · Insecure Dependencies

Note
Location
SKILL.md:140
Finding

Third-Party Packages and Browser Artifacts Installed Without Version or Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:140-149
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Low

Vulnerable Code

markdown
## Prerequisites

Install required dependencies:

```bash
# Install Python packages
pip install pdfplumber playwright

# Install Playwright browsers
playwright install chromium
text

  ### Technical Analysis

The installation instructions retrieve the latest available versions of `pdfplumber`, `playwright`, their transitive dependencies, and a Playwright-managed Chromium artifact. No reviewed versions, lock file, package hashes, browser revision, or trusted package-index configuration is specified.

As a result, the components installed by a user can differ from those considered during the Skill review. A compromised upstream release, package repository, dependency account, or altered package-index configuration could introduce executable behavior without any modification to this project.

This is a supply-chain hardening weakness rather than evidence that the named packages are currently malicious.

  ### Attack Path

1. An attacker compromises an upstream package, a transitive dependency, a browser distribution channel, or a package-publisher account.
2. Alternatively, the user's Python package configuration points to an untrusted or compromised index.
3. A user follows the documented commands without specifying reviewed versions or hashes.
4. The package manager resolves and installs the currently available artifacts rather than a reproducible, audited dependency set.
5. The altered dependency is imported by the scripts or the downloaded browser is launched by Playwright.
6. Malicious behavior then runs with the permissions of the user invoking the installation or Skill.

Exploitation requires compromise or manipulation of a dependency source or package-resolution environment; the repository itself does not contain evidence of such a compromise.

  ### Impact Assessment

A mal
...[truncated 448 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin all direct dependencies to reviewed versions in a requirements or lock file.
  • Generate and enforce cryptographic hashes, for example with a hash-locked requirements file and pip install --require-hashes.
  • Lock transitive dependencies rather than pinning only pdfplumber and playwright.
  • Document the approved Python package index and require HTTPS certificate validation.
  • Pin the Playwright version so its corresponding browser revision is deterministic.
  • Record and verify the expected browser artifact source and checksum where supported.
  • Perform dependency vulnerability and provenance checks before updating locked versions.
  • Use an isolated virtual environment and avoid installing the dependencies with administrative privileges.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a user-facing HS code lookup/classification skill that can take product name or image input and search the Tariff Commission website for the correct customs code. The supplied code instead only downloads a PDF for a given tariff chapter (01-97) from a hardcoded URL pattern, with fallback via curl/Playwright. While this is related to the same domain and website, it is only a supporting document retrieval utility, not an HS code search or classification tool. The actual behavior is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared purpose says the skill helps users find Philippines customs HS codes for products, implying product-based search/classification on the Tariff Commission site. The supplied code does not classify products or search for codes at all. Its primary function is to retrieve a specified tariff book chapter PDF by chapter number from the Tariff Commission site, then download the linked PDF from Google Drive. While this is related to the same domain/resource family, it is a materially different function from product-to-HS-code lookup, and the claimed support for product name/image input is absent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose suggests an official Philippines HS-code lookup skill that searches the Tariff Commission website and supports product name/image input. The supplied code instead only parses a local PDF file path provided on the command line, searches text lines for keywords, extracts HS-code-like regex matches, and formats results. There is no network access, no web scraping/API calls to tariffcommission.gov.ph, and no image handling. While the general domain (Philippines HS codes) is related, the described source and capabilities are materially different from the actual implementation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises an official Philippines customs HS code lookup capability tied to tariffcommission.gov.ph and support for product name/image input. The supplied code instead implements an offline rule-based chapter suggester using a static dictionary. It outputs broad chapter recommendations, not full HS codes or official tariff classifications, and contains no network access, no website scraping/API usage, and no image handling. This is a material description-behavior mismatch in both primary purpose and claimed capabilities.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/get_chapter_pdf.py (reported line 65)May include surrounding context.

python
def download_large_file(file_id: str, output_path: str) -> bool:
    """Download large files from Google Drive (requires confirmation)."""
    # For large files, use wget which handles confirmations better
    try:
        download_url = f"https://drive.google.com/uc?export=download&id={file_id}"
        result = subprocess.run([

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Using wget with --no-check-certificate disables server certificate verification, undermining HTTPS transport security. In this skill's context, the tool downloads files from external sites and then exposes them as authoritative customs documents, so tampered content could mislead downstream classification or introduce malicious files into workflows.

Content

Scanner excerpt · scripts/get_chapter_pdf.py (reported line 69)May include surrounding context.

python
try:
        download_url = f"https://drive.google.com/uc?export=download&id={file_id}"
        result = subprocess.run([
            "wget", "--quiet", "--no-check-certificate",
            "-O", output_path, download_url
        ], capture_output=True, timeout=120)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill instructs use of shell commands, network access, and local file handling, but it declares no tool scope or permission boundaries. In an agent environment, that can allow broader-than-expected execution and increase the blast radius if the skill is invoked on untrusted input or modified later.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The sample output uses Chinese field labels such as "查询结果", "源文件", and "HS编码", indicating the skill presents results in a specific language. Because the file does not offer an explicit user opt-in or language choice, this conflicts with the policy against forcing a locale/language without user selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The required output section mandates a single response format, and elsewhere the documented format is Chinese-labeled markdown output. Taken together, this creates a natural-language locale constraint without documenting user choice or justification for a China-specific language format in a Philippines customs lookup skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_tariff_pdf.py (reported line 136)May include surrounding context.

python
output_path = os.path.join(output_dir, f"Chapter_{chapter_padded}.pdf")
    
    try:
        result = subprocess.run([
            "curl", "-s", "-L", "-A", 
            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
            "-o", output_path, pdf_url

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/get_chapter_pdf.py (reported line 37)May include surrounding context.

python
download_url = f"https://drive.google.com/uc?export=download&id={file_id}"
    
    try:
        result = subprocess.run([
            "curl", "-s", "-L", "-A", 
            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
            "-o", output_path, download_url

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

The code invokes wget to fetch remote content while explicitly disabling TLS certificate validation via --no-check-certificate. That permits man-in-the-middle interception or content substitution, so an attacker on the network path could cause the skill to save a malicious or tampered PDF while the code treats it as trusted.

Content

Scanner excerpt · scripts/get_chapter_pdf.py (reported line 68)May include surrounding context.

python
# For large files, use wget which handles confirmations better
    try:
        download_url = f"https://drive.google.com/uc?export=download&id={file_id}"
        result = subprocess.run([
            "wget", "--quiet", "--no-check-certificate",
            "-O", output_path, download_url
        ], capture_output=True, timeout=120)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill searches the official tariffcommission.gov.ph website for Philippines HS codes, but this script only opens and scans a caller-provided local PDF file. While PDF parsing may support HS lookup, the actual behavior here is narrower and materially different from the claimed website-querying functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script emits user-facing messages and markdown headers in Chinese, such as the no-results message and result table labels, without offering any language selection or documenting that the tool is intended only for Chinese-speaking users. This is a natural-language locale policy issue because it imposes a specific language by default rather than using opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest explicitly says the skill supports product name/image input, but the executable interface only accepts a PDF path plus keyword strings. There is no image parsing, OCR, or image-based classification logic anywhere in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The final best-match message uses a Chinese label regardless of user preference or execution context. Because the script does not provide a locale choice or explain a justified region-specific requirement, this constitutes a language-policy violation in natural-language output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.