ClawHub
Back to skill

Security audit

medxpert-l1-batch-study

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local batch document-processing helper that writes summaries and retry task files, with limited user-controlled file access.

Install only if you intend to run a local DSH/qwen batch-reading workflow. Point --inbox, --outbox, --hub, --names, and --outdir at directories you control, and avoid using an output directory containing summary files you need to preserve because matching names can be overwritten.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
描述强调的是“批量精读文档并产出结构化摘要、汇总疑点总表”的内容生成型能力；而给出的代码并不执行文档精读、也不直接调用模型处理文档内容，更没有实现“汇总疑点总表”。它只是一个结果回收与失败自动重投的调度/编排脚本：扫描 outbox 中的 result 文件，成功则落盘，失败则依据 names.json 重新生成任务文件投递到 inbox。虽然任务模板中要求下游模型生成摘要，但该能力并非由此代码本身完成。因此代码的主要行为与声明用途存在实质偏差，且包含描述未提到的自动重投与轮询回收能力。

Vague Triggers

Medium
Confidence
95% confidence
Finding
The markdown states that the skill can be triggered whenever a user asks a question in any of the listed languages, without narrowing the subject matter or providing exclusion conditions. This overlaps with ordinary conversation and makes activation scope unclear, which fits the vague-trigger category for markdown files.

Missing User Warnings

Low
Confidence
76% confidence
Finding
This code unconditionally writes model-generated content to `OUTDIR/<name>_摘要.md`, overwriting any existing file with the same name. Although the script purpose implies recovery/output handling, there is no nearby comment, docstring, or user-facing disclosure at the write site warning that files will be created or replaced.

Scope Creep

Low
Category
Excessive Agency
Content
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.