ClawHub
Back to skill

Security audit

import-export-router

Security checks for vulnerabilities and agentic risk

Overview

This is a small disclosed decision-support CLI for medical-device import/export routing, with no evidence of hidden access, persistence, or data exfiltration.

Installers should treat the tool as a reference aid only: verify current NMPA, FDA, and EU MDR requirements independently, and note that the CLI/documentation are primarily Chinese and contain minor argument-name inconsistencies.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
Line L19 states that the documentation is available in Chinese, but the README does not indicate any alternative language option or user choice. This is a natural-language locale policy concern because it constrains documentation language by default without opt-in or justification.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The natural-language content presented to users is effectively forced to Chinese, including the title, warnings, usage notes, FAQ, and surrounding documentation. The policy allows locale constraints only when the skill offers user choice or clearly documents and justifies the restriction; this file does neither.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The module docstring, CLI description, argument help text, and user-facing errors are all written exclusively in Chinese, indicating a fixed language experience. The file does not offer any language/locale opt-in or explain that the tool is intentionally restricted to Chinese users or a China-only regulatory context as a documented policy exception.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
allok = False
                print(json.dumps({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2}, ensure_ascii=False))
        sys.exit(0 if allok else 2)
    args = {k: getattr(ns, k) for k in argnames}
    if not any(v not in (None, "") for v in args.values()):
        # 无参数时打印帮助
        p.print_help()
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.