T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scraper.py:183- Finding
Server-Side Request Forgery Through User-Controlled URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Novel Scraper Pro
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real novel-scraping skill, but it has review-worthy unsafe edges around arbitrary URL fetching and output file writing.
Review this skill before installing. It is not showing clear malicious intent, but only run it on URLs you trust, avoid internal/private network addresses, be cautious with --force-spa, and do not use --output values containing paths or traversal. Treat the cleanup commands as permanent deletion commands and consider pinning dependencies before installation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/merge_novels.py:139- Finding
Arbitrary File Overwrite Through Output Path Traversal
- Content
View full analysis
end_target or end < start_target: continue with open(filepath, 'r', encoding='utf-8') as f: content = f.read() # 提取本文件中的章节 file_chapters = extract_chapters_from_file(filepath) # 只保留目标范围内的章节 for ch in file_chapters: if start_target <= ch <= end_target: chapters_found.add(ch) merged_content.append(content) if merged_content: output_file = NOVELS_DIR / f"{book_name}_{output_name}" with open(output_file, 'w', encoding='utf-8') as f: f.write("\n".join(merged_content)) ``` The affected value originates from the command-line argument declared at `scripts/merge_novels.py:47`: ```python parser.add_argument("--output", "-o", help="输出文件名（可选）") ``` ### Technical Analysis The `--output` value is placed directly into a filesystem path without rejecting directory separators, `..` components, or absolute-path-like input. The final path is neither normalized nor checked to ensure that it remains under `NOVELS_DIR ...[truncated 1592 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:4- Finding
Unpinned and Redundant Python Dependencies
- Content
View full analysis
=4.12.0 bs4>=0.0.1 ``` ### Technical Analysis Both dependencies use unrestricted lower-bound constraints. Installation can therefore resolve to future package releases that were not included in this audit. No hashes or lock file are supplied to verify package integrity or make installation reproducible. The `bs4` package is a compatibility package that depends on `beautifulsoup4`; listing both is redundant. Retaining unnecessary direct dependencies increases the number of package artifacts that must be trusted and reviewed. No evidence was found that either named package is malicious. The risk is caused by open-ended resolution and the unnecessary dependency entry, rather than a confirmed malicious package. ### Attack Path 1. A user installs the Skill dependencies using `pip install -r requirements.txt`. 2. The package installer resolves the latest versions satisfying the lower-bound constraints from its configured package index. 3. Those versions may differ from the versions reviewed when the Skill was published. 4. If a future release, configured package index, or dependency artifact is compromised, its installation code or imported code executes with the privileges of the installing or Skill-running account. ### Impact Assessment A compromised dependency could execute code with the privileges of the account performing installation or running the Skill. Potential impact would include access to that account's files, environment, and network connectivity. The current repository does not demonstrate such compromise. This finding represents avoidable supply-chain exposure and lack of reproducible dependency management. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (27)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file claims network scraping, BeautifulSoup/curl usage, pagination handling, and TXT output workflows that static analysis indicates are not present. In a skill that already references shell commands and file paths, this discrepancy increases operational risk because users may run cleanup or data-handling commands under false assumptions about what the tool actually created or consumed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The file claims network scraping, BeautifulSoup/curl usage, pagination handling, and TXT output workflows that static analysis indicates are not present. In a skill that already references shell commands and file paths, this discrepancy increases operational risk because users may run cleanup or data-handling commands under false assumptions about what the tool actually created or consumed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file claims network scraping, BeautifulSoup/curl usage, pagination handling, and TXT output workflows that static analysis indicates are not present. In a skill that already references shell commands and file paths, this discrepancy increases operational risk because users may run cleanup or data-handling commands under false assumptions about what the tool actually created or consumed.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The skill instructs users to delete a progress file directly with
rm, which is a shell-side destructive action presented as routine troubleshooting. In context this is not inherently malicious, but it conditions unsafe manual filesystem mutation and could cause loss of recovery state or mistakes if users adapt the path incorrectly.- Content
Q: 如何清空进度重新抓取？
bash rm ~/.openclaw/workspace/skills/novel-scraper-pro/state/progress.json python3 scripts/scraper.py --chapters "1-100" --book "书名"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Using
rm -rfwith a wildcard in documentation is risky because it normalizes a powerful destructive shell pattern that users may modify or execute in the wrong context. While the target is a cache directory, the combination of recursive force deletion and globbing raises the chance of accidental data loss if the path is empty, expanded unexpectedly, or edited incorrectly.- Content
/tmp/novel_scraper_cache/
清理缓存
rm -rf /tmp/novel_scraper_cache/*
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Using
rm -rfwith a wildcard in documentation is risky because it normalizes a powerful destructive shell pattern that users may modify or execute in the wrong context. While the target is a cache directory, the combination of recursive force deletion and globbing raises the chance of accidental data loss if the path is empty, expanded unexpectedly, or edited incorrectly.- Content
/tmp/novel_scraper_cache/
清理缓存
rm -rf /tmp/novel_scraper_cache/*
text
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and instructs use of capabilities that include network access, local file writes, file reads, and shell command execution, yet it declares no explicit tool scope or permissions boundary. This creates an authorization/expectation gap: a reviewer or runtime may underestimate what the skill can do, increasing the chance of unintended filesystem modification or external access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description promotes scraping and saving output files but does not clearly warn about external network access and local filesystem writes. For a skill that targets user-provided URLs and writes under user directories, missing warnings reduce user awareness of privacy, compliance, and overwrite risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation includes deletion commands for state and cache without an explicit warning that they are destructive and should be reviewed before running. Even though the paths appear specific, copy-pasted shell cleanup commands can lead to accidental data loss, especially if variables, globs, or paths are modified.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a novel scraping tool that uses curl and BeautifulSoup for fetching and parsing, so network access itself is expected. However, spawning an external process via subprocess.run adds command-execution capability that is broader than necessary for the stated purpose of scraping chapters and saving TXT output.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-A", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", url, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=35) return result.stdout if result.returncode == 0 else None
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-A", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", url, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=35) return result.stdout if result.returncode == 0 else None
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest promises a full-featured novel scraper with automatic pagination handling, resume support, memory monitoring, chapter content downloading, and formatted TXT output. This file only retrieves one fixed book's catalog, analyzes chapter URL gaps, and saves catalog metadata as JSON plus a URL list text file, which does not match the claimed end-user behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring is entirely in Chinese, and the command help strings throughout the file are also Chinese-only, which imposes a language choice on users without offering an alternative or opt-in. This matches the policy category for language or locale constraints expressed in natural-language content.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring states '分页检测（默认检测，补全需启用 --complete）', implying completion is opt-in. However,
scrape_urlsalways collectsincomplete_chaptersand later automatically completes them, and no--completeargument exists in the CLI, so the documentation contradicts actual behavior.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This scraper expands its capability from passive HTTP fetching to driving an external browser tool against attacker-controlled URLs. In skill contexts, that increases attack surface because malicious pages can trigger browser-based requests, script execution, internal-network access, or other side effects through the external tool, even if the Python code itself avoids shell injection.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def fetch_with_browser(url): """使用浏览器工具获取页面（SPA 支持）""" try: result = subprocess.run( ["openclaw", "browser", "fetch", "--url", url, "--wait", "2000"], capture_output=True, text=True,
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Automatically launching another Python script as recovery behavior introduces hidden execution flow that users may not expect from a scraper. In an agent-skill environment, chaining to adjacent scripts increases the blast radius if the helper script is modified, compromised, or behaves unsafely, and it creates additional code-execution capability beyond the declared core task.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python catalog_script = Path(__file__).parent / "fetch_catalog.py" logger.info(f"📚 运行目录页脚本：{catalog_script}") result = subprocess.run( ["python3", str(catalog_script)], capture_output=True, text=True,
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains substantial user-facing natural language in Chinese across multiple entries, but it does not indicate that the language is optional or intentionally localized. Under the language/locale policy rule, forcing a specific language without user opt-in can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This JSON configuration contains user-facing natural-language strings exclusively in Chinese, such as the site name and notes, with no indication that the skill offers locale selection or is intentionally limited to Chinese-speaking users. The policy calls for flagging language or locale constraints when they are imposed without user opt-in or explicit justification.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency specifier uses a lower-bound only constraint, which allows installation of any newer release of beautifulsoup4, including versions with breaking changes or a compromised upstream release. While this file alone does not prove exploitation, unpinned dependencies weaken supply-chain integrity and reduce build reproducibility.
- Content
text # Novel Scraper - Python Dependencies # Install: pip3 install -r requirements.txt --user beautifulsoup4>=4.12.0 bs4>=0.0.1
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The bs4 package is also specified with only a minimum version, so installs may resolve to any later release without review. In a tool that scrapes untrusted websites, predictable and reviewed dependency versions are important because parser/library behavior changes or supply-chain compromise could affect runtime safety and reliability.
- Content
text # Install: pip3 install -r requirements.txt --user beautifulsoup4>=4.12.0 bs4>=0.0.1
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This file contains natural-language usage instructions exclusively in Chinese, which can constitute a language/locale policy violation when a skill forces a specific language without user opt-in. No alternative language option or justification for the locale constraint is documented in the file.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The top-level documentation describes a general-purpose catalog mapping tool, suggesting comprehensive handling of chapter URLs. In practice, main() is specialized to book_id "4" and additionally generates an output restricted to chapters numbered 116 and above, which contradicts the broad wording of the documentation.
- Content
Static analysis
No suspicious patterns detected.