我的数据分析工具

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:55 AM UTC
• Version: 1.0.0

Overview

This is a local document-search skill with expected access to a private local knowledge base; the main caution is unpinned installation dependencies.

Install this only if you intend to let OpenClaw query your local Chroma knowledge base. Use a virtual environment or container, pin and review Python package versions, verify the Ollama model source where possible, and inspect the referenced rag_mcp_server.py before connecting it to private documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:133

Finding

Unpinned Python Dependencies and Ollama Model

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 133–139
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

pip install mcp chromadb langchain-community langchain-ollama

bash

ollama pull bge-m3

Technical Analysis

The installation instructions reference mutable third-party package and model names without exact versions, cryptographic hashes, a lockfile, or other integrity controls. Consequently, the installed artifacts are determined by external package and model registries at installation time rather than by a reproducible, previously reviewed dependency set.

Python package installation can execute package-controlled build or installation logic. If a referenced package, transitive dependency, package registry, or maintainer account is compromised, following the documented command could execute attacker-controlled code. Future incompatible releases could also introduce vulnerabilities or silently alter behavior.

The Ollama model is likewise retrieved by a mutable name without an immutable digest. A changed or compromised model artifact could affect retrieval integrity and generated behavior, although the audited file does not demonstrate that downloading this model directly executes arbitrary native code.

Attack Path

1. An attacker compromises a referenced package, one of its transitive dependencies, its maintainer account, or the package distribution infrastructure.
2. The attacker publishes a malicious release under a dependency name used by the documented pip install command.
3. A user follows the Skill installation instructions without version or hash verification.
4. pip downloads the currently selected artifact and may execute attacker-controlled build or installation logic.
5. The malicious dependency obtains the privileges of the user performing the installation and can subsequently run inside the RAG or MCP envi ...[truncated 1046 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct Python dependency to an reviewed exact version.
• Generate and commit a dependency lockfile that also resolves transitive dependencies.
• Require cryptographic hashes during installation, such as with a hash-locked requirements file and pip install --require-hashes.
• Configure an explicit, trusted package index and disable unintended additional indexes to reduce dependency-confusion exposure.
• Review package provenance, release signatures, maintainers, and transitive dependency changes before updating pins.
• Perform installation in an isolated virtual environment or container under a non-privileged account.
• Pin the Ollama model to an immutable digest where supported and document a trusted expected digest or checksum.
• Establish a controlled update process that reviews and tests dependency and model changes before deployment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

- 不调用外部云 API
- 不执行危险 Shell 命令
- 不访问 SSH Key
- 不需要 sudo 权限

所有文档均保留在本地 Chroma 数据库中。

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file’s user-facing description and operating instructions are predominantly in Chinese, and there is no indication that the user can choose another language or that Chinese is required for a region-specific purpose. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 60% confidence

Finding

pip install without ==version installs the latest release, which could include malicious changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.