ClawHub
Back to skill

Security audit

Autogen

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AutoGen helper, but its examples show autonomous host-local code execution without clear safety warnings or approval controls.

Review this skill carefully before installing. It does not appear to hide malware or install persistence, but its sample AutoGen configurations may lead users to run agent-generated code directly on their machine without review. Prefer Docker or another sandbox, require human approval before execution, use disposable work directories, remove secrets from the runtime environment, and pin package versions for production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:44
Finding

Unattended Host Execution of Agent-Generated Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-49
Vulnerability Type: Unsandboxed autonomous code execution
Risk Level: High

Vulnerable Code

python
user_proxy = UserProxyAgent(
    name="用户",
    human_input_mode="NEVER",       # NEVER/ALWAYS/TERMINATE
    max_consecutive_auto_reply=10,
    code_execution_config={"work_dir": "coding", "use_docker": False}
)

Technical Analysis

The example combines human_input_mode="NEVER" with use_docker=False. This configuration permits code produced during an LLM-controlled conversation to execute directly on the host without prior human approval or container isolation.

The configured working directory does not constitute a security boundary. Unless additional operating-system restrictions are applied externally, executed code may access other files available to the process, launch subprocesses, inspect environment variables, use network resources, and modify user-accessible data.

This is particularly hazardous when tasks, source files, retrieved content, or conversation messages can contain attacker-controlled instructions. Such content can induce the agent to generate and execute malicious code.

Attack Path

  1. An attacker places malicious instructions in a task, source file, issue description, or other content processed by the agent.
  2. The LLM interprets that content and produces executable code or shell commands.
  3. UserProxyAgent processes the generated code without requesting human approval because human_input_mode is set to NEVER.
  4. AutoGen executes the code directly on the host because Docker isolation is disabled.
  5. The code reads or modifies files, accesses process credentials, launches commands, or communicates over the network within the privileges of the AutoGen process.

Impact Assessment

Successful exploitation grants the generated code the same effective operating-system privileges as the user ru ...[truncated 471 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not combine automatic execution with host-local execution for untrusted or LLM-generated code.
  • Set human_input_mode="ALWAYS" or implement an explicit approval gate that displays the exact code and command before execution.
  • Use a restricted container by default, such as a reviewed and digest-pinned minimal image.
  • Run the container as a non-root user with dropped Linux capabilities, a read-only root filesystem, resource limits, and no-new-privileges.
  • Disable network access unless it is required for the task. If networking is required, restrict destinations through an allowlist.
  • Mount only a dedicated disposable workspace. Do not mount home directories, credential stores, Docker sockets, SSH agents, or unrelated repositories.
  • Remove secrets from the execution environment and provide narrowly scoped, short-lived credentials only when necessary.
  • Document clearly that use_docker=False is suitable only for fully trusted, manually reviewed code.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:82
Finding

Explicit Host-Local Code Execution Example Without Isolation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-85
Vulnerability Type: Unsandboxed code execution configuration
Risk Level: High

Vulnerable Code

python
# 本地执行
user_proxy = UserProxyAgent(name="executor", code_execution_config={
    "work_dir": "workspace", "use_docker": False, "timeout": 60
})

Technical Analysis

The documented local-execution configuration disables Docker isolation. The timeout only limits execution duration; it does not restrict filesystem access, subprocess creation, network communication, credential access, or destructive operations.

Because AutoGen commonly executes LLM-generated code, presenting this configuration without an approval mechanism or prominent trust-boundary warning can lead users to run untrusted output directly under their own account. A working directory limits the intended output location but does not prevent code from traversing to other filesystem paths.

Attack Path

  1. A user adopts the documented local-execution configuration.
  2. The agent receives attacker-influenced content or generates unsafe code due to model error.
  3. The executor runs that code directly on the host.
  4. The code escapes the intended workspace through absolute paths, parent-directory traversal, subprocesses, or operating-system APIs.
  5. It accesses or modifies any resource available to the invoking user before the timeout expires.

Impact Assessment

Exploitation can cause arbitrary code execution with the privileges of the AutoGen process. Potential consequences include disclosure of local source code and credentials, modification or deletion of files, installation of user-level persistence, abuse of accessible cloud or developer credentials, and network access to internal services. The 60-second timeout may constrain long-running operations but does not meaningfully prevent rapid compromise or data exfiltration.

Remediation
View remediation

Remediation Suggestions

  • Remove the host-local example or label it prominently as unsafe for generated or otherwise untrusted code.
  • Replace it with a secure-by-default container configuration using a digest-pinned image and a non-root user.
  • Require explicit human confirmation before every execution when local execution cannot be avoided.
  • Apply operating-system sandboxing, filesystem allowlists, process and memory limits, and outbound network restrictions.
  • Execute tasks in a disposable workspace with no inherited secrets or access to sensitive host paths.
  • Explain that work_dir and timeout are operational settings rather than security controls.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-29
Vulnerability Type: Mutable and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install autogen-agentchat autogen-ext  # 0.4+ 新架构
pip install pyautogen                       # 经典版本 0.2.x

Technical Analysis

The installation instructions do not pin package versions or verify package artifacts with cryptographic hashes. Consequently, the installed code depends on the package versions available from the active pip index at installation time.

This creates non-reproducible installations and exposes users to upstream compromise, malicious replacement through a misconfigured or attacker-controlled package index, and unexpected behavior introduced by future releases. The instructions also show packages from different AutoGen architecture generations without requiring separate virtual environments, increasing the possibility of dependency conflicts or unintended resolution outcomes.

The package names themselves are not demonstrated to be malicious; the issue is the absence of controls that ensure users install specifically reviewed artifacts from a trusted source.

Attack Path

  1. A user follows the installation commands in an environment configured to use the public index, an internal mirror, or another custom index.
  2. Pip resolves the latest package versions and transitive dependencies rather than a reviewed dependency set.
  3. An upstream account compromise, compromised mirror, unsafe index configuration, or malicious future dependency release supplies altered package code.
  4. Pip installs that code into the user environment.
  5. The unreviewed code executes during package use and potentially during build or installation, obtaining the privileges of the user running pip or the resulting application.

Impact Assessment

A compromised dependency can execute arbitrary Python code with the privileges ...[truncated 372 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin all direct dependencies to reviewed versions, for example with exact == constraints.
  • Generate and maintain a lock file that includes all transitive dependencies.
  • Require artifact hashes through a hash-locked requirements file and install with pip install --require-hashes.
  • Document the trusted package index or internal mirror and use TLS-validated repository URLs.
  • Periodically scan pinned dependencies for known vulnerabilities and review upgrades before updating locks.
  • Install the current and classic AutoGen architectures in separate virtual environments unless their compatibility has been explicitly verified.
  • Prefer isolated, non-privileged installation environments and never run pip as root for these examples.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill includes examples that configure AutoGen to execute code autonomously, including local execution with use_docker: False, but does not clearly warn that generated code may modify files, run commands, or otherwise affect the host system. In the context of an agent framework skill that explicitly promotes code execution, this increases the chance that users copy unsafe defaults into real environments and expose their machine or data to unintended actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description and core instructional text force a specific language/locale presentation, and there is no indication that the user can opt into another language. The stated policy requires flagging language or locale constraints unless the skill offers choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.