ClawHub
Back to skill

Security audit

military bidding fetcher

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real procurement-scraping tool, but it needs review because it writes untrusted web data into Excel reports without formula hardening and accepts implicit local configuration that can alter network routing and output paths.

Install only if you are comfortable with a tool that contacts the named procurement websites and saves an Excel report locally. Open generated spreadsheets carefully because remote website text is not formula-sanitized, and avoid running it from untrusted directories since a local .env file can change proxy and output settings.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
milb_fetcher/fetcher.py:773
Finding

Untrusted Remote Data Written to Spreadsheet Formula Contexts

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
pyproject.toml:6
Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Updates

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (27)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 6)May include surrounding context.

python
"""
配置加载模块 (milb-fetcher)

按优先级读取 .env 配置，缺失时使用默认值：
  1. ~/.config/milb-fetcher/.env  （用户全局配置）
  2. ./.env                        （当前运行目录，最高优先级）
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 7)May include surrounding context.

python
"""
配置加载模块 (milb-fetcher)

按优先级读取 .env 配置，缺失时使用默认值：
  1. ~/.config/milb-fetcher/.env  （用户全局配置）
  2. ./.env                        （当前运行目录，最高优先级）
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 8)May include surrounding context.

python
"""
配置加载模块 (milb-fetcher)

按优先级读取 .env 配置，缺失时使用默认值：
  1. ~/.config/milb-fetcher/.env  （用户全局配置）
  2. ./.env                        （当前运行目录，最高优先级）
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 25)May include surrounding context.

python
"""
配置加载模块 (milb-fetcher)

按优先级读取 .env 配置，缺失时使用默认值：
  1. ~/.config/milb-fetcher/.env  （用户全局配置）
  2. ./.env                        （当前运行目录，最高优先级）
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 38)May include surrounding context.

python
"""
配置加载模块 (milb-fetcher)

按优先级读取 .env 配置，缺失时使用默认值：
  1. ~/.config/milb-fetcher/.env  （用户全局配置）
  2. ./.env                        （当前运行目录，最高优先级）
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 39)May include surrounding context.

python
"""
配置加载模块 (milb-fetcher)

按优先级读取 .env 配置，缺失时使用默认值：
  1. ~/.config/milb-fetcher/.env  （用户全局配置）
  2. ./.env                        （当前运行目录，最高优先级）
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 40)May include surrounding context.

python
"""
配置加载模块 (milb-fetcher)

按优先级读取 .env 配置，缺失时使用默认值：
  1. ~/.config/milb-fetcher/.env  （用户全局配置）
  2. ./.env                        （当前运行目录，最高优先级）
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 62)May include surrounding context.

python
"""
配置加载模块 (milb-fetcher)

按优先级读取 .env 配置，缺失时使用默认值：
  1. ~/.config/milb-fetcher/.env  （用户全局配置）
  2. ./.env                        （当前运行目录，最高优先级）
"""

Credential Access

High
Category
Privilege Escalation
Confidence
66% confidence
Finding

Loading configuration from the current working directory's .env file can allow untrusted local project directories to override application behavior, including proxy settings and output paths. In an agent context that may be executed inside user-controlled workspaces, this increases the risk of configuration injection and unintended routing of network traffic through attacker-specified infrastructure.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 46)May include surrounding context.

python
Dict: 合并后的配置字典
    """
    candidates = [
        Path.home() / '.config' / 'milb-fetcher' / '.env',
        Path.cwd() / '.env',
    ]
    config = {}

Credential Access

High
Category
Privilege Escalation
Confidence
66% confidence
Finding

Including a .env from the current directory means whoever controls the working directory can influence runtime configuration. In this skill, that could steer requests through an attacker-controlled proxy or redirect file output, which is more dangerous because the tool fetches external data and may run in shared or semi-trusted agent workspaces.

Content

Scanner excerpt · milb_fetcher/config.py (reported line 47)May include surrounding context.

python
"""
    candidates = [
        Path.home() / '.config' / 'milb-fetcher' / '.env',
        Path.cwd() / '.env',
    ]
    config = {}
    for path in candidates:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises capabilities consistent with file access, networking, and shell execution but does not declare any explicit tool scope or permission boundaries. That creates an authorization gap where a broadly triggered skill could perform sensitive actions without clear least-privilege constraints or user visibility.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description includes broad trigger phrases such as '抓取商机', '查新', and '采集招标', which can overlap with ordinary user requests and cause the skill to activate unexpectedly. Because the skill performs network collection and file output, accidental invocation can lead to unrequested external access and local artifact creation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill description and activation phrases are presented only in Chinese, and the trigger conditions are defined solely using Chinese phrases. This can amount to a language policy violation if the skill implicitly requires a specific language without documenting user choice or opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The standalone trigger list ('抓取、采集、爬虫、查新、每日商机') is highly ambiguous and lacks context boundaries, increasing the chance of matching unrelated conversations. In a skill with network and filesystem effects, this raises the risk of unintended automation and data collection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains natural-language docstrings and console output in Chinese, including the module description and test output strings. Under the policy, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains user-facing natural-language content such as the module docstring and later help text entirely in Chinese. Under the policy, forcing a specific language without opt-in is a violation unless the skill offers language choice or clearly documents a justified regional constraint, which this file does not.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · milb_fetcher/fetcher.py (reported line 176)May include surrounding context.

python
# 获取当前时间戳
    try:
        result = subprocess.run(['date', '+%s%3N'], capture_output=True, text=True)
        _t = result.stdout.strip()
    except:
        _t = str(int(datetime.now().timestamp() * 1000))

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · milb_fetcher/fetcher.py (reported line 606)May include surrounding context.

python
# 获取当前时间戳
    try:
        result = subprocess.run(['date', '+%s%3N'], capture_output=True, text=True)
        _t = result.stdout.strip()
    except:
        _t = str(int(datetime.now().timestamp() * 1000))

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The help text says --yesterday is the default and shows python fetcher.py as fetching yesterday, but main() leaves target_date = None and auto_latest = True unless date options are passed. That causes fetch_all_bidding to auto-detect latest dates for some sources and use today's date for another, contradicting the documented default behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill writes Excel output to disk by default but does not clearly warn the user in the description that files will be created locally. This can surprise users, lead to unwanted storage of potentially sensitive procurement data, and reduce informed consent around persistent artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The test output shown in the main block uses only Chinese labels, which enforces a specific language for anyone running the file directly. There is no indication that users can choose a different language or that the restriction is intentionally justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a web-scraping and Excel-reporting tool for procurement notices. Calling subprocess.run(['date', '+%s%3N']) introduces process-execution capability that is unnecessary for this purpose, since the code already has a Python fallback for generating the same timestamp.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

In _get_weain_latest_date, the skill again executes the system date command only to build a request timestamp. This expands the skill's capabilities beyond straightforward network fetching and file output, without being required by the stated procurement-fetching purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description is written only in Chinese ("军工采购商机自动抓取工具"), which can create a language/locale policy issue if users are not given a choice or the locale restriction is not documented. The file provides no indication that this skill is intentionally limited to Chinese-speaking users or a specific region.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The manifest declares the requests dependency without any version bounds or pinning, so deployments may resolve to vulnerable or incompatible releases depending on environment and install time. Because this skill fetches remote content from external procurement sites, an outdated HTTP client could expose credential leakage, TLS/verification flaws, or other network-facing issues if a bad version is installed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.