ClawHub
Back to skill

Security audit

Global AI Governance Landscape（全球AI治理版图）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local AI-governance reference handbook with an optional read-only lookup script; the scanner concerns are real code-execution notes for optional tests but do not show hidden, destructive, network, credential, or data-collection behavior.

Installers should understand that this is mostly a reference pack, but running its optional verification scripts or CLI executes local Python code. The inspected version does not access credentials, call the network, install dependencies, or modify files outside its own verification output, but users should still verify policy facts against official sources because the subject matter changes quickly.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def check_tools():
    items = []
    try:
        r = subprocess.run([PYTHON, TOOL, "org", "--name", "waico"], capture_output=True, text=True, timeout=60)
        out = r.stdout or ""
        items.append({"name": "org 命令执行", "pass": r.returncode == 0 and "WAICO" in out and "29" in out})
        r2 = subprocess.run([PYTHON, TOOL, "initiative", "--actor", "cn"], capture_output=True, text=True, timeout=60)
Confidence
88% confidence
Finding
The script executes another Python file via subprocess during verification. Although arguments are hardcoded and shell injection is not present, invoking an external script still executes repository-controlled code and expands the attack surface: a tampered tools/global_ai_toolkit.py can run arbitrary local code when verification is launched.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
r = subprocess.run([PYTHON, TOOL, "org", "--name", "waico"], capture_output=True, text=True, timeout=60)
        out = r.stdout or ""
        items.append({"name": "org 命令执行", "pass": r.returncode == 0 and "WAICO" in out and "29" in out})
        r2 = subprocess.run([PYTHON, TOOL, "initiative", "--actor", "cn"], capture_output=True, text=True, timeout=60)
        items.append({"name": "initiative 命令执行", "pass": r2.returncode == 0 and "全球人工智能治理倡议" in (r2.stdout or "")})
        r3 = subprocess.run([PYTHON, TOOL, "region", "--name", "eu"], capture_output=True, text=True, timeout=60)
        items.append({"name": "region 命令执行", "pass": r3.returncode == 0 and "AI Act" in (r3.stdout or "")})
Confidence
88% confidence
Finding
This verification step launches the toolkit in a separate Python process. The immediate call uses fixed arguments, so command injection risk is low, but it still causes code execution from repository content and can trigger arbitrary behavior if the tool script is modified.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
items.append({"name": "org 命令执行", "pass": r.returncode == 0 and "WAICO" in out and "29" in out})
        r2 = subprocess.run([PYTHON, TOOL, "initiative", "--actor", "cn"], capture_output=True, text=True, timeout=60)
        items.append({"name": "initiative 命令执行", "pass": r2.returncode == 0 and "全球人工智能治理倡议" in (r2.stdout or "")})
        r3 = subprocess.run([PYTHON, TOOL, "region", "--name", "eu"], capture_output=True, text=True, timeout=60)
        items.append({"name": "region 命令执行", "pass": r3.returncode == 0 and "AI Act" in (r3.stdout or "")})
        r4 = subprocess.run([PYTHON, TOOL, "timeline"], capture_output=True, text=True, timeout=60)
        out4 = r4.stdout or ""
Confidence
88% confidence
Finding
Running the region subcommand through subprocess executes code from tools/global_ai_toolkit.py rather than only validating static reference content. In a skill advertised as a local reference handbook, this makes verification dependent on executable code that could perform unintended local actions if altered.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
items.append({"name": "initiative 命令执行", "pass": r2.returncode == 0 and "全球人工智能治理倡议" in (r2.stdout or "")})
        r3 = subprocess.run([PYTHON, TOOL, "region", "--name", "eu"], capture_output=True, text=True, timeout=60)
        items.append({"name": "region 命令执行", "pass": r3.returncode == 0 and "AI Act" in (r3.stdout or "")})
        r4 = subprocess.run([PYTHON, TOOL, "timeline"], capture_output=True, text=True, timeout=60)
        out4 = r4.stdout or ""
        items.append({"name": "timeline 命令执行", "pass": r4.returncode == 0 and "2026-07-16" in out4 and "2019" in out4})
        r5 = subprocess.run([PYTHON, TOOL, "assess"], capture_output=True, text=True, timeout=60)
Confidence
88% confidence
Finding
The timeline check invokes a separate Python process, which is a genuine code-execution sink. There is no shell=True issue, but repository-local script execution still presents supply-chain and trust-boundary risk because verification will run whatever code is present at the TOOL path.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
r4 = subprocess.run([PYTHON, TOOL, "timeline"], capture_output=True, text=True, timeout=60)
        out4 = r4.stdout or ""
        items.append({"name": "timeline 命令执行", "pass": r4.returncode == 0 and "2026-07-16" in out4 and "2019" in out4})
        r5 = subprocess.run([PYTHON, TOOL, "assess"], capture_output=True, text=True, timeout=60)
        items.append({"name": "assess 命令执行", "pass": r5.returncode == 0 and "机制化" in (r5.stdout or "")})
    except Exception as e:
        items = [{"name": f"执行失败: {e}", "pass": False}]
Confidence
88% confidence
Finding
This assess command is another instance of executable verification logic rather than data-only validation. An attacker who can modify the toolkit script can obtain arbitrary code execution when a reviewer runs the verification file, making the subprocess call security-relevant.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
items = []
    for name, expects in cases:
        try:
            r = subprocess.run([PYTHON, TOOL, "org", "--name", name], capture_output=True, text=True, timeout=60)
            ok = r.returncode == 0 and all(e in (r.stdout or "") for e in expects)
            items.append({"name": f"org({name})→{expects[0]}", "pass": ok})
        except Exception as e:
Confidence
83% confidence
Finding
Although the org names are drawn from a fixed local list, this line still executes the external toolkit script repeatedly. The danger is not argument injection but the trust placed in local executable content during verification, which can be abused if the repository is modified.

Lp3

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding
The skill advertises executable local-tool usage via `python tools/global_ai_toolkit.py ...` and states it is '零依赖本地工具', yet no permissions are declared. This creates a capability/permission mismatch: an agent or reviewer may treat the skill as low-privilege while it implicitly expects shell execution and filesystem access, which weakens trust boundaries and can enable unintended local actions if the referenced tooling is modified or abused.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The verification script for a supposedly local handbook executes a separate Python tool, so the artifact is not purely passive reference content. That mismatch matters because users may reasonably expect a documentation-style skill to be safe to inspect or verify, while running this file actually executes code with the user's local permissions.

Static analysis

No suspicious patterns detected.