T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib_xlsx.py:187- Finding
Untrusted spreadsheet values are written as executable formulas
- Content
View full analysis
- Remediation
View remediation
Security audit
Huo15 Openclaw Plan Form
Security checks for vulnerabilities and agentic risk
Overview
The skill broadly does what it claims, but it can carry unsafe spreadsheet formulas from customer input into generated Excel files.
Install only if you are comfortable processing spreadsheets from trusted sources or after adding formula sanitization at the XLSX write boundary. Pin dependencies for reproducible installs, and write outputs to a dedicated work/out directory to avoid accidental overwrites.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:3- Finding
Dependencies are installed from mutable, unpinned version ranges
- Content
View full analysis
=1.3 openpyxl>=3.0 xlrd>=2.0 # 读取 .xls（老格式）必需 ``` ### Technical Analysis The dependency file specifies only lower version bounds. Running the documented installation command can therefore resolve any later release available from the configured package index. No lock file or package hashes constrain the artifacts being installed. This does not demonstrate that any currently named dependency is malicious, and no typo-squatted or unauthorized package source was identified. The security weakness is that the reviewed project does not define a reproducible dependency set: future installations may execute package installation code or import runtime code that was not part of this audit. ### Attack Path 1. A user follows the project documentation and runs: ```bash pip install -r requirements.txt ``` 2. Pip queries the configured package index and selects versions satisfying the broad `>=` constraints. 3. The resolved versions may differ from those originally tested or audited. 4. If a future release, distribution artifact, dependency, or configured package index is compromised, installation or later import can execute attacker-controlled code with the privileges of the user running pip. 5. Because no hashes are present, pip has no project-provided artifact integrity requirement with which to reject an unexpected but otherwise valid package artifact. ### Impact Assessment Successful supply-chain exploitation would execute in the context of the user or environment performing installation or running the scripts. The possible scope includes files and credentials accessible to that account and any data processed by the Skill. The present repository does not establish that such compromise has occurred. The immediate impact is reduced installation integrity, ...[truncated 112 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full Excel normalization and diffing workflow for user-supplied planning/scheduling spreadsheets. However, this code chunk only builds clean empty template files from schema metadata using write_form(..., rows=None, dates=[], blank_placeholder=True). Its stated docstring explicitly says these are blank reference templates and that actual conversion output is handled elsewhere (fill_template.py). Therefore, the chunk’s primary behavior is template generation, which is only tangentially related and does not implement the main promised capabilities. This is a material description-behavior mismatch for the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad end-to-end Excel processing workflow: recognize varied input formats, map them into one of three standard templates, melt/standardize content, populate a unified template, and compare versions for differences. The actual code chunk only implements the first narrow step: heuristic classification of a file into one of three template categories based on header text and date-column patterns. It reads limited rows, scores templates using configured keywords, and prints a recommendation plus confidence. There is no code for content extraction into standardized fields, workbook rewriting, template population, multi-file consolidation beyond independent classification, or old-vs-new diffing. Thus the supplied code materially under-implements the declared purpose, so the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
该代码块的核心功能是 Excel 表单抽取与规范化：自动选 sheet、猜测表头、识别日期列和标识列、提取数值时间序列，并将结果写为 JSON。这与声明中的“熔解内容”部分有一定重合，但声明描述的是更完整的端到端技能：自动在三个标准模板中归类、转成统一模板、合并多个表，并对比旧版本差异。当前代码没有归类逻辑（模板由命令行参数强制指定），没有差异比较逻辑，也没有生成标准模板文件，只是产生中间规范化结果。因此声明明显高于代码实际能力，属于实质性描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个端到端的 Excel 标准化与差异比对技能：读取各种格式的 Excel、自动识别类型、统一映射到三种模板，并与旧版本比对。当前代码块的职责明显更窄，只是后处理/输出环节：读取 extract_form.py 产出的规范化 JSON，合并数据、可选去重、推断日期范围并写出模板化 xlsx。虽然“合并多个表并填充标准模板”这一部分与声明有部分重叠，但声明中的核心能力——原始 Excel 自动识别归类、复杂表结构解析、以及新旧版本差异标注——在该代码中完全不存在。因此该代码行为仅覆盖声明流水线中的一部分，且实际输入类型也与声明面向的 Excel 上传场景不一致，构成明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises an end-to-end Excel standardization and diffing skill for production plans and demand sheets. The provided code only inspects workbook structure: it reads files, enumerates sheets, samples rows, and guesses header/date columns. Its own docstring says it is for helping an agent decide sheet/header/column mapping. There is no logic here for mapping to the three declared templates, content fusion, template filling, old-version retrieval, or cell-level difference marking. Reading Excel files is consistent with the general domain, but the primary behavior is materially narrower and different from the declared purpose, so this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
代码块仅实现“把规范化后的数据按模板渲染输出为干净 Excel”的下游写出功能，属于声明能力链条中的一个支持性子模块。它依赖外部已提供的 template、rows、dates 等规范化输入，没有任何读取/分析用户上传 Excel、格式识别、中英文混杂处理、模板分类、跨表融合或差异比较的实现。虽然声明的最终产品可能需要这样的写出库作为组成部分，但就这段代码本身而言，其实际行为明显窄于且不同于声明的核心用途，因此应判定为描述与代码行为不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/extract_form.py "<file>" --template <id> --out work/<name>.norm.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/extract_form.py "<file>" --template <id> --out work/<name>.norm.json
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to create output files and write normalized JSON/XLSX artifacts, but the manifest does not declare any explicit tool scope such as allowed file-write permissions or path restrictions. In an agent environment, undeclared write capability increases the chance of unintended file modification, overwriting existing data, or writing sensitive transformed content to unsafe locations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains natural-language docstrings and console output entirely in Chinese, which imposes a specific language on users. The policy allows locale constraints only when users are given a choice or the constraint is clearly documented and justified, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script prints classification notes, status lines, and errors in Chinese, which creates a fixed-language experience for all users. There is no mechanism to choose another language and no justification that this skill is region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains its primary docstring, CLI help text, warnings, and status messages entirely in Chinese. The policy only permits locale-specific behavior when the user is given a language choice or the restriction is clearly documented and justified; neither appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s primary natural-language instructions and runtime messages are written in Chinese, which imposes a specific language on users without any documented opt-in or alternative. The policy explicitly flags language or locale constraints when no user choice is offered.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language strings in the module docstring, comments, worksheet labels, and font selection are fixed to Chinese, such as Chinese title/note text and the use of 微软雅黑. This enforces a specific language/locale behavior without any visible opt-in or configuration path for users who may require another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest description is primarily in Chinese but embeds the English directive 'Use when ...', effectively prescribing the skill description in specific languages without stating any user-selectable language or locale option. This can be a natural-language policy concern when a skill implicitly fixes its interaction language rather than documenting a choice or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file contains user-facing classification guidance exclusively in Chinese and does not mention that the skill is Chinese-only, region-specific, or that another language option is available. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language comment at L002 is entirely in Chinese and describes this schema as the single source of truth for related scripts, which can impose a language expectation on maintainers and users. There is no indication that the skill is region-specific or that alternative language support is available, so this appears to be a locale-policy concern under the stated rules.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown workflow is written entirely in Chinese and does not indicate any language choice, opt-in, or locale justification. Under the policy rule for natural-language constraints, forcing a specific language without user opt-in is a policy concern.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency specification uses a lower-bound only version constraint for pandas, which makes builds non-reproducible and can unintentionally pull in vulnerable or incompatible releases over time. In this skill, pandas processes user-supplied Excel data, so supply-chain drift or installation of an affected version increases risk around parsing untrusted files.
- Content
text # huo15-openclaw-plan-form skill 运行依赖 # 安装: pip install -r requirements.txt pandas>=1.3 openpyxl>=3.0 xlrd>=2.0 # 读取 .xls（老格式）必需
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
The manifest does not pin pandas, so it is impossible to verify whether the deployed version includes a release affected by the cited advisory. While the specific pandas CVE is disputed and may require unsafe deserialization usage beyond what is shown here, leaving the version unconstrained still creates avoidable uncertainty in a component that handles untrusted input.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
openpyxl is specified with an unpinned minimum version, allowing environments to resolve to different releases, including ones with historical security issues. Because this skill ingests externally provided Excel files, parser behavior matters: an unsafe or regressed openpyxl version could expose the system to malicious spreadsheet content or XML-related attacks.
- Content
text # huo15-openclaw-plan-form skill 运行依赖 # 安装: pip install -r requirements.txt pandas>=1.3 openpyxl>=3.0 xlrd>=2.0 # 读取 .xls（老格式）必需
Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The openpyxl dependency is not pinned, so the installed version may fall into historically vulnerable ranges affected by XXE-related issues. This is more concerning in this skill because it processes customer-uploaded spreadsheets, making document parsing a direct attack surface if an unsafe version is installed.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains its docstring and user-facing console messages entirely in Chinese, which imposes a specific language on users without any visible opt-in or explanation that the skill is intended only for a Chinese-speaking or region-specific context. The policy allows locale constraints when justified, but no such justification appears in this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s top-level docstring and surrounding natural-language guidance are entirely in Chinese and present the skill as operating in a Chinese-language context, but there is no indication that this locale is optional or intentionally limited to a China-specific workflow. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This Python code performs a file write via wb.save(path), which can overwrite or create a spreadsheet on disk. Within this file there is no confirmation prompt, visible user disclosure, or warning comment/docstring specifically alerting users that the operation writes to the provided path.
- Content
Static analysis
No suspicious patterns detected.