ClawHub
Back to skill

Security audit

Huo15 Openclaw Plan Form

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently processes user-provided Excel planning files into standardized templates and does not show hidden, destructive, or exfiltrating behavior.

Install only in an environment where it is acceptable to process customer planning spreadsheets locally. Consider pinning dependencies or using a lockfile before production use, and review generated column mappings when processing unfamiliar or multi-sheet workbooks.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Unpinned Dependencies

Low
Category
Supply Chain
Content
# huo15-openclaw-plan-form skill 运行依赖
# 安装: pip install -r requirements.txt
pandas>=1.3
openpyxl>=3.0
xlrd>=2.0      # 读取 .xls（老格式）必需
Confidence
87% confidence
Finding
Using a lower-bounded but unpinned dependency like pandas>=1.3 allows future versions to be installed unpredictably, which can introduce breaking changes or newly disclosed vulnerabilities into the skill without review. In this skill's context, the package processes untrusted customer Excel files, so dependency drift can materially increase the attack surface in parsers and file-handling code.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# huo15-openclaw-plan-form skill 运行依赖
# 安装: pip install -r requirements.txt
pandas>=1.3
openpyxl>=3.0
xlrd>=2.0      # 读取 .xls（老格式）必需
Confidence
92% confidence
Finding
openpyxl>=3.0 permits any newer release to be installed, making builds non-reproducible and potentially pulling in versions with security regressions or behavior changes. This skill explicitly ingests externally supplied Excel documents, so weaknesses in workbook/XML parsing are especially relevant and elevate the practical risk of unpinned parser dependencies.

Static analysis

No suspicious patterns detected.