ClawHub
Back to skill

Security audit

Description: Turn vague product ideas into AI-ready specs. Bilingual requirement closure checker for non-technical builders.把模糊的产品想法变成 AI Coding 能读懂的需求文档。面向没有产品背景的创作者，通过五步追问完成需求闭环。

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small requirements-checking helper with a disclosed Python dependency and no evidence of hidden access, persistence, or data exfiltration.

Install only from a trusted package index and consider pinning or locking Pydantic before use. The skill itself appears limited to checking requirement text and returning JSON task metadata; review any downstream FileEditor task before allowing an agent to write files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Mutable Third-Party Dependency Without Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned third-party dependency and missing package integrity verification
Risk Level: Medium

The installation guidance in SKILL.md:25 also directs users to install Pydantic without selecting an exact reviewed version:

text
Pydantic v2 (`pip install pydantic` or `uv pip install pydantic`)

The dependency declaration is:

text
pydantic>=2.0,<3

Technical Analysis

The project permits any Pydantic release from version 2.0 up to, but excluding, version 3.0. It provides neither a lock file nor package hashes. Consequently, dependency resolution is mutable: two installations performed at different times can install different code despite using the same project revision.

protocol.py imports and executes the installed dependency at lines 14 and 123. If a future matching release, package-index response, or distribution artifact were compromised, its code could execute during installation or import. The broad version range also allows an unreviewed but defective release to change input-validation behavior.

This is a supply-chain hardening issue. The reviewed project does not itself retrieve code from arbitrary URLs, and exploitation requires compromise or manipulation of the configured package source or a matching upstream release.

Attack Path

  1. An attacker compromises a matching Pydantic release or manipulates the package source used by the victim.
  2. The attacker publishes or serves a malicious distribution whose version satisfies pydantic>=2.0,<3.
  3. A user installs the project dependencies without a lock file or hash verification.
  4. The package manager resolves and installs the attacker-controlled artifact.
  5. Malicious package code runs during installation or when protocol.py imports Pydantic.
  6. The payload operates with the privileges and environmental access of the installing or ...[truncated 623 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Pydantic to an exact version that has been reviewed and tested, rather than accepting every release in the major-version range.
  2. Generate a reproducible lock file containing cryptographic hashes for every direct and transitive dependency.
  3. Enforce hash verification during installation, such as with pip install --require-hashes -r requirements.txt.
  4. Use only an explicitly configured, trusted package index and prevent unexpected fallback to untrusted indexes.
  5. Add automated dependency vulnerability and provenance scanning to the release process.
  6. Test and deliberately approve dependency upgrades before updating the lock file and hashes.
  7. Update SKILL.md so its installation command uses the same pinned, hash-verified dependency set instead of installing the latest matching Pydantic release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
Zip the **folder** that contains `SKILL.md`, `protocol.py`, `requirements.txt`, and `test_protocol.py` (same directory level), or use the ClawHub CLI per curren

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring presents the skill as a requirement closure checker, and the manifest states five closure rules including actor, scenario, goal, and actionable path. In code, _five_principles_check only implements four checks—who, scenario, goal, and path—with no fifth rule present, creating an active mismatch between documented intent and actual behavior.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · protocol.py (reported line 6)May include surrounding context.

python
Input: dict with key raw_text; optional runtime: Python 3.10+, pydantic v2.
Output: logic_bridge_protocol() → JSON dict (ok | error).
Links: —
Note: Published alongside skills/logic-bridge-protocol/SKILL.md for ClawHub.
"""

from __future__ import annotations

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The docstring states that gaps are returned only in the same language as the input, and the implementation uses _is_chinese to switch between Chinese and English responses. This enforces a language policy based on detected script rather than explicit user opt-in or choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill that validates requirements against closure rules and returns follow-up questions or FileEditor-ready JSON tasks when ready. However, the implementation goes further by prescribing a specific file output path and instructing creation of a Markdown task brief with additional content, which is a concrete task-authoring behavior not implied by simple validation and readiness assessment.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency specification uses a broad range (>=2.0,<3) rather than pinning to a known-safe version, so builds may resolve to a release affected by one of several published Pydantic advisories. This creates supply-chain uncertainty and can expose consumers to denial-of-service or parsing-related vulnerabilities depending on the resolved version and how the package is used.

Content

No source excerpt is available for this finding.