ClawHub
Back to skill

Security audit

Resource Position Analysis

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Excel analysis skill, but it automatically installs unpinned Python packages and documents an unpinned installer command, so users should review it before installing.

Install or run this skill only in a controlled environment, preferably a dedicated virtual environment, and preinstall reviewed, pinned versions of pandas and openpyxl instead of allowing the script to auto-install them. Review input workbooks for confidential business or user data before processing, and avoid following unpinned npx install commands unless you trust the installer source and registry configuration.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/analyze.py:33
Finding

Automatic Installation of Unpinned Runtime Dependencies

Content
View full analysis

Vulnerability Details

File Location: scripts/analyze.py:33-35
Vulnerability Type: Automatic installation of mutable third-party packages
Risk Level: Medium

Vulnerable Code

python
subprocess.check_call(
    [sys.executable, "-m", "pip", "install", "--quiet"] + missing,
)

The associated dependency declarations in requirements.txt:1-2 are also not pinned to exact versions:

text
pandas>=1.5.0
openpyxl>=3.0.0

Technical Analysis

The script automatically invokes pip when pandas or openpyxl is unavailable. This installation occurs during normal script startup without explicit user confirmation or a separate trusted setup phase.

The pip command requests packages by name only. The requirements file uses unrestricted minimum versions and supplies neither exact versions nor cryptographic hashes. Consequently, the packages and their transitive dependencies can change after this project has been reviewed. Package resolution may also be affected by the user's pip configuration, configured mirrors, or package indexes.

This behavior creates a supply-chain execution boundary: installation metadata, build backends, package installation logic, and subsequently imported package code may execute with the permissions of the user running the analysis script.

Attack Path

  1. A user runs scripts/analyze.py in a Python environment where one of the required modules is absent.
  2. The startup dependency check detects the missing module.
  3. The script invokes python -m pip install --quiet with the unpinned package name.
  4. Pip resolves the package and transitive dependencies using the active package index or configured mirror.
  5. A compromised release, dependency, maintainer account, mirror, or build process supplies malicious code.
  6. Malicious installation or import-time code executes with the invoking user's privileges.

Impact Assessment

Successful exploitation co ...[truncated 568 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic package installation from application startup.
  2. If dependencies are missing, terminate with a clear error that directs the user to a separate installation procedure.
  3. Install dependencies inside a dedicated virtual environment rather than modifying the active interpreter environment.
  4. Pin every direct and transitive dependency to an exact reviewed version.
  5. Generate a lock file containing cryptographic hashes and require hash verification during installation.
  6. Use an explicitly trusted package index and prevent unexpected fallback to untrusted indexes or mirrors.
  7. Perform dependency installation as a deliberate setup step, separate from processing user workbooks.
  8. Add automated dependency vulnerability and provenance scanning to the release process.

T08 · Insecure Dependencies

Warning
Location
README.md:59
Finding

Unpinned Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: README.md:59-63
Vulnerability Type: Execution of an unpinned registry package
Risk Level: Medium

Vulnerable Code

bash
## Install

npx clawhub install resource-position-analysis

Technical Analysis

The documented installation command uses npx without selecting a specific reviewed version of the clawhub package or providing an integrity constraint. Depending on local cache and npm configuration, npx may download and execute the current package version from the configured registry.

Because the resolved package can change independently of this audited project, the effective installer code is mutable after review. npm package lifecycle behavior and CLI entry points execute locally with the permissions of the user following the documentation.

Attack Path

  1. A user follows the installation instructions in README.md.
  2. npx resolves clawhub using the user's configured npm registry.
  3. The command downloads a package version that was not fixed or verified by this project.
  4. A compromised maintainer account, registry, mirror, or future malicious release supplies attacker-controlled package code.
  5. npx executes the package's CLI or lifecycle-related code on the user's system.
  6. The attacker-controlled code operates with the invoking user's permissions.

Impact Assessment

Successful exploitation could result in arbitrary code execution as the user running the installation command. This could permit access to user-readable files, development credentials, npm configuration, environment variables, and other resources available to that account. It could also modify files or install additional software within the user's permission boundary.

No evidence was found that the currently referenced package is malicious. The risk arises from executing a mutable and unverified registry package rather than a version reviewed alongside this project ...[truncated 1 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a specific reviewed version, such as npx clawhub@VERSION install resource-position-analysis.
  2. Prefer npx --package=clawhub@VERSION --call ... or an equivalent invocation that makes package resolution explicit.
  3. Document the expected trusted npm registry and advise users to verify their registry configuration.
  4. Publish and document integrity or provenance verification information where supported.
  5. Review the pinned installer package and its dependency tree before updating the documented version.
  6. Consider providing a non-executing package download and verification workflow before installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Executing package-management subprocesses is unrelated to the core business-analysis task and introduces elevated risk compared with normal analytics code. In an agent or automation environment, this can lead to unreviewed package downloads, dependency confusion, hostile mirror exposure, or environment tampering on the machine running the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to run npx clawhub install resource-position-analysis without pinning a specific package version. That can lead to installation of a changed or compromised package version at execution time, creating a supply-chain risk if the upstream package is hijacked or a malicious release is published. In the context of an agent skill installer, this is more dangerous because users are encouraged to execute a remote package directly from documentation.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill instructs the agent to invoke a local Python script and write output files, but the manifest does not declare any explicit tool scope or permissions boundaries. This weakens least-privilege controls and can allow broader shell/file actions than users or the host framework may expect, especially when processing attacker-supplied file paths or arguments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill title and operating instructions are presented only in Chinese, which effectively imposes a specific language/locale on users. The file does not indicate that users may choose another language or that the locale restriction is intentional and justified as region-specific.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

运行前先确定本 SKILL.md 的绝对路径，然后拼出脚本路径：

bash
# 假设 SKILL.md 位于 /path/to/skills/resource-position-analysis/SKILL.md
# 则脚本路径为:
SCRIPT="/path/to/skills/resource-position-analysis/scripts/analyze.py"
python3 "$SCRIPT" <excel_file> --mode <mode> [options]

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown file is entirely written as a Chinese report template and implicitly requires report generation in Chinese. Under the language/locale policy, a skill should not force a specific language unless the user is given an opt-in choice or the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is described as an analytics/reporting tool, but it also performs environment modification by installing Python packages at runtime. This exceeds expected behavior and is dangerous in agent contexts because users may grant execution assuming only local data analysis, not package management or network-dependent changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script auto-installs packages without any explicit confirmation or warning beyond a status message. Silent or implicit installation is risky because it surprises the operator, changes the environment state, and may trigger network access or arbitrary package install hooks in contexts where only data processing was expected.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script invokes pip at runtime via a subprocess to install packages automatically. Even though the package names are hardcoded, this creates an unnecessary code-execution and supply-chain risk surface because execution now depends on network/package-index state and modifies the host environment without explicit user approval.

Content

Scanner excerpt · scripts/analyze.py (reported line 33)May include surrounding context.

python
missing.append("openpyxl")
    if missing:
        print(f"正在安装缺失依赖: {', '.join(missing)} ...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "--quiet"] + missing,
        )

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The README asks users to provide an Excel file containing analytics fields such as exposure, click, and conversion user counts, but it does not warn that such files may contain sensitive or user-level business data. This omission can cause users to upload or process regulated or confidential analytics data without appropriate minimization, anonymization, or handling precautions. The skill context increases relevance because conversion-funnel datasets often originate from production telemetry and may include business-sensitive or privacy-sensitive information even if the listed schema appears aggregated.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency is specified with a lower bound only, which allows builds to resolve to different versions over time and weakens supply-chain reproducibility. While this is not an immediate exploit by itself, it increases the chance of inadvertently installing a vulnerable or breaking release of pandas.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
pandas>=1.5.0
openpyxl>=3.0.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

Because pandas is not pinned, it is impossible to determine from this manifest alone whether an affected version with a known advisory could be installed. The cited issue is disputed and version-dependent, so the immediate risk is limited, but the unresolved version range still leaves exposure assessment and patch assurance incomplete.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The openpyxl dependency is also unpinned, so installations are not deterministic and may pick up unexpected releases. This creates supply-chain risk and makes it harder to verify whether the deployed package version is safe and tested.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
pandas>=1.5.0
openpyxl>=3.0.0

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The manifest does not pin openpyxl, so a version affected by historical XXE-related advisories could be installed without visibility from this file alone. In a skill that may analyze spreadsheet data, spreadsheet-processing libraries are security-relevant because hostile files can be attacker-controlled inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The top-level docstring presents the tool description and usage context in Chinese, and the script also emits Chinese-only user-facing messages. This imposes a single language choice without offering a locale option or documenting that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.