ClawHub
Back to skill

Security audit

WorkBuddy安全稳定运行专家团

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent local security-audit skill, but it deserves review because its scripts can broadly inspect credential-bearing files and copy sensitive WorkBuddy state into a temporary sandbox.

Review the script scope before installing or running it. Use the audit only on WorkBuddy/workspace directories you intend to inspect, and treat generated reports as sensitive because they can reveal secret locations. Run wb_recovery_full.py first in dry-run mode and use --execute only if you accept temporary copying of identity, memory, connector metadata, and snapshot files.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/wb_audit.py:35
Finding

Overly Broad Credential File Discovery and Content Inspection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wb_recovery_full.py:28
Finding

Sensitive Agent State Copied Through a Predictable Temporary Directory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to provide security and stability analysis, but the detected behavior includes generating avatar graphics and writing PNG files—actions unrelated to the declared mission—while lacking implementation for many promised security functions. This mismatch is dangerous because users and platforms may trust the skill with sensitive operational tasks under false assumptions, while hidden or undeclared behaviors can expand attack surface and obscure what the skill actually does.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wb_audit.py (reported line 36)May include surrounding context.

python
TEAMS = ["wb-safe-team"]

# 敏感文件名（凭据官七类位置精简为文件名命中，避免依赖包噪声）
SENSITIVE_NAMES = [".env", ".env.local", "credentials", "credential",
                   "secrets", "token", "tokens", "*.key", "id_rsa", "id_ed25519"]
# 噪声目录（依赖包/缓存），凭据官扫描时剪枝
EXCLUDE_DIRS = {"node_modules", ".git", "site-packages", "__pycache__",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wb_safe_security_test.py (reported line 96)May include surrounding context.

python
TEAMS = ["wb-safe-team"]

# 敏感文件名（凭据官七类位置精简为文件名命中，避免依赖包噪声）
SENSITIVE_NAMES = [".env", ".env.local", "credentials", "credential",
                   "secrets", "token", "tokens", "*.key", "id_rsa", "id_ed25519"]
# 噪声目录（依赖包/缓存），凭据官扫描时剪枝
EXCLUDE_DIRS = {"node_modules", ".git", "site-packages", "__pycache__",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wb_audit.py (reported line 36)May include surrounding context.

python
TEAMS = ["wb-safe-team"]

# 敏感文件名（凭据官七类位置精简为文件名命中，避免依赖包噪声）
SENSITIVE_NAMES = [".env", ".env.local", "credentials", "credential",
                   "secrets", "token", "tokens", "*.key", "id_rsa", "id_ed25519"]
# 噪声目录（依赖包/缓存），凭据官扫描时剪枝
EXCLUDE_DIRS = {"node_modules", ".git", "site-packages", "__pycache__",

Credential Access

High
Category
Privilege Escalation
Confidence
78% confidence
Finding

The scanner opens and reads .env files to determine whether they contain real secret assignments. Although it avoids printing the values, this still accesses raw secret material in memory and processes files under broad home-directory paths, increasing exposure if the tool is run in an over-privileged context or later modified/logged unsafely.

Content

Scanner excerpt · scripts/wb_audit.py (reported line 120)May include surrounding context.

python
tag = _classify(fp)
                if tag is None: continue
                info = "sensitive-name:%s" % pat
                if f.endswith(".env"):
                    # 精确：是否含敏感 key（API_KEY/SECRET/PASSWORD/TOKEN）的真实赋值
                    # 逐行判定，避免 \s 跨行误匹配；读值但绝不输出；URL 配置不算敏感赋值
                    try:

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

The content scan walks the workspace and inspects lines in .md, .txt, .json, .py, and .env files for secret patterns. This is legitimate for secret discovery, but it necessarily reads potential credentials from many files and could surface sensitive line locations in reports, which becomes risky in an agent skill context where users may over-trust 'offline audit' claims.

Content

Scanner excerpt · scripts/wb_audit.py (reported line 137)May include surrounding context.

python
# B2 内容模式（仅工作目录，避免依赖包噪声）
    for root, _, files in os.walk(WB):
        for f in files:
            if f.endswith((".md", ".txt", ".json", ".py", ".env")):
                fp = os.path.join(root, f)
                try:
                    for i, line in enumerate(io.open(fp, encoding="utf-8", errors="ignore"), 1):

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · 安全审计报告.md (reported line 42)May include surrounding context.

md
- 发现次数: 1 次
- 详细列表:
  - `scripts/wb_recovery_full.py:72` — `shutil.rmtree(SB)`：仅删除**自身创建的临时沙箱目录**（`$TEMP/wb_recovery_full_sandbox`），且仅 `--execute` 显式授权后触发，默认 dry-run 不触碰任何数据。删除目标为程序自建的临时目录，非系统/用户路径。**判定：安全（删除范围受控）。**
- 敏感路径读取: `.ssh` / `.gnupg` / `/etc/passwd` / `.aws` / `.gcloud` / 环境变量文件 — **0 命中**。
- 凭据扫描逻辑（`wb_audit.py` cred_scan）只**报告文件位置与行号**，**永不回显密钥值**，且无任何外发通道。**判定：符合「只报位置不回显值」设计，安全。**

### 网络请求检查

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · 安全审计报告.md (reported line 52)May include surrounding context.

md
- **判定：纯本地闭环，零网络行为。**

### 远程脚本深度分析
- 不适用：未发现任何自动下载 + 执行远程脚本的模式（无 `curl | bash`、无 `wget | sh`、无远程 URL）。

### 依赖安装风险检查
- **全局安装检测**: 未发现（无 `pip install` / `npm install -g` / `gem install` 等）

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · 安全审计报告.md (reported line 52)May include surrounding context.

md
- **判定：纯本地闭环，零网络行为。**

### 远程脚本深度分析
- 不适用：未发现任何自动下载 + 执行远程脚本的模式（无 `curl | bash`、无 `wget | sh`、无远程 URL）。

### 依赖安装风险检查
- **全局安装检测**: 未发现（无 `pip install` / `npm install -g` / `gem install` 等）

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises operational behaviors involving local scripts, file access, shell execution, and possible environment-variable handling, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for a host platform or reviewer to bound what the skill may do, increasing the risk of unintended file access, command execution, or credential exposure if the skill is invoked in a permissive runtime.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad and include common operational language, which can cause the skill to activate in situations the user did not intend. In a skill that discusses credentials, recovery, shell-backed scripts, and configuration changes, accidental invocation increases the chance of unnecessary sensitive guidance, confusing actions, or prompting workflows that touch files, secrets, or system state without clear user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module documentation explicitly describes the tool as "纯本地、只读诊断" and the usage comment says normal execution will generate a report and update the baseline. In implementation, the script writes both audit_baseline.json and a markdown report file, which are side effects inconsistent with a read-only claim.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/wb_audit.py (reported line 55)May include surrounding context.

python
def ps(cmd):
    try:
        r = subprocess.run(["powershell", "-NoProfile", "-Command", cmd],
                           capture_output=True, text=True, timeout=30)
        return r.stdout.strip()
    except Exception as e:

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · scripts/wb_audit.py (reported line 107)May include surrounding context.

python
hits = []
    # B1 敏感文件名（.workbuddy 范围），剪枝依赖包噪声 + 分级
    for pat in SENSITIVE_NAMES:
        for root, dirs, files in os.walk(os.path.join(HOME, ".workbuddy")):
            _prune(dirs)
            if "plugins/cache" in root.replace("\\", "/"):  # 第三方包缓存跳过
                continue

Tainted flow: 'dst' from os.environ.get (line 78, credential/environment) → shutil.copy (file write)

Medium
Category
Data Flow
Confidence
89% confidence
Finding

The destination path is derived from the TEMP environment variable via SB and then used for file writes without validating or constraining the resolved path. An attacker who can influence the environment could redirect copies into an unintended location, causing sensitive recovery data to be written outside the expected sandbox and potentially exposed or overwritten.

Content

Scanner excerpt · scripts/wb_recovery_full.py (reported line 84)May include surrounding context.

python
shutil.copytree(s, dst)
            else:
                os.makedirs(os.path.dirname(dst), exist_ok=True)
                shutil.copy(s, dst)
            copied += 1
        except Exception as e:
            print("  复制失败 %s: %s" % (s, e))

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The report claims '0 issues' and a perfect score while later acknowledging command execution and a deletion-capable script. Even if those capabilities are framed as controlled or dry-run, the contradictory audit language can mislead reviewers into underestimating operational risk and approving the package without proper scrutiny.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Describing the package as 'pure teaching/methodology + read-only diagnostic scripts' is inaccurate because the same document states a recovery script can delete a directory when run with an execute flag. This kind of understatement is dangerous because users may trust the package with fewer safeguards than they would apply to tooling that performs destructive filesystem actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown skill file presents all operational instructions in Chinese and does not indicate that users may choose another language or locale. Under the policy rule for natural-language constraints, forcing a specific language without opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains user-facing instructions only in Chinese, which can amount to a language policy issue when no user opt-in or alternative locale is provided. The document also does not state that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file contains all user-visible labels in Chinese, including the title, legend, and category names, with no indication that the skill is region-specific or that users can opt into this locale. The policy explicitly flags language or locale constraints when they are imposed without user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This JSON file contains multiple natural-language labels in Chinese for security dimensions, such as package integrity and credential security, but does not indicate that Chinese is required or provide any user opt-in for locale. Because SQP-3 applies to all file types, this is a language/locale policy concern rather than a code-security issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file is entirely written in Chinese and presents the audit report, findings, and usage guidance in a single fixed language. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.