ClawHub
Back to skill

Security audit

Corpus Search

Security checks for vulnerabilities and agentic risk

Overview

This is a local corpus search skill whose code matches its stated purpose, with dependency hygiene issues but no artifact-backed hidden or harmful behavior.

Before installing, consider pinning the Python dependencies in a lockfile, verify the configured ChromaDB corpus path points only to content you want searched, and run it in an environment where downloading the embedding model is acceptable.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Corpus Search - Requirements

# ChromaDB 向量数据库
chromadb>=0.5.0

# 嵌入模型（语义向量化）
sentence-transformers>=2.2.2
Confidence
93% confidence
Finding
Using a lower-bound version specifier for chromadb permits installation of any newer release, including versions with breaking changes or newly introduced vulnerabilities. In supply-chain contexts this weakens reproducibility and can expose deployments to compromised or unsafe dependency versions over time.

Unpinned Dependencies

Low
Category
Supply Chain
Content
chromadb>=0.5.0

# 嵌入模型（语义向量化）
sentence-transformers>=2.2.2

# 配置文件解析
pyyaml>=6.0.1
Confidence
93% confidence
Finding
The unpinned sentence-transformers dependency allows uncontrolled upgrades, reducing build reproducibility and increasing supply-chain risk if a future version is vulnerable or maliciously tampered with. Because this package pulls a substantial ML stack, transitive dependency exposure can be significant.

Unpinned Dependencies

Low
Category
Supply Chain
Content
sentence-transformers>=2.2.2

# 配置文件解析
pyyaml>=6.0.1

# CLI 美化输出
rich>=13.7.0
Confidence
97% confidence
Finding
The requirement pyyaml>=6.0.1 is unpinned, so environments may resolve to different versions over time, undermining reproducibility and potentially introducing vulnerable releases. This is especially important because YAML parsers have a history of unsafe deserialization issues when used improperly.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pyyaml>=6.0.1

# CLI 美化输出
rich>=13.7.0

# 进度条支持
tqdm>=4.65.0
Confidence
88% confidence
Finding
An unpinned rich dependency creates a general supply-chain and reproducibility risk because future versions may introduce vulnerabilities or incompatible behavior. While rich is typically lower risk than parsers or network-facing libraries, exact-version control is still recommended.

Unpinned Dependencies

Low
Category
Supply Chain
Content
rich>=13.7.0

# 进度条支持
tqdm>=4.65.0

# 缓存机制
diskcache>=5.6.3
Confidence
96% confidence
Finding
The unpinned tqdm dependency is risky because known advisories exist for some versions, and the specifier permits resolution to a broad range of releases. This makes it easier for vulnerable versions to enter builds and harder to guarantee safe, repeatable installations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
tqdm>=4.65.0

# 缓存机制
diskcache>=5.6.3
Confidence
92% confidence
Finding
The unpinned diskcache requirement permits arbitrary newer versions, which increases exposure to future vulnerable releases and reduces reproducibility. For a caching library, this becomes more concerning if application code stores or loads complex serialized objects from shared or untrusted storage.

Known Vulnerable Dependency: tqdm — 3 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2016-10075 (TDQM Arbitrary Code Execution); CVE-2016-10075 (The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to e)

High
Category
Supply Chain
Confidence
82% confidence
Finding
The tqdm dependency is associated with published advisories, and because the requirement is not pinned to a verified safe release, vulnerable versions may be introduced depending on resolver behavior and deployment environment. In a CLI-oriented skill, argument-handling issues are more relevant than in a purely internal library context.

Static analysis

No suspicious patterns detected.