ClawHub
Back to skill

Security audit

compress-file-sorter

Security checks for vulnerabilities and agentic risk

Overview

This archive-sorting skill is coherent, but its file-handling flaws could let crafted archives or rules write, move, or delete files outside the folder the user chose.

Install only after review or fixes. Use this skill with trusted archives and trusted classification rules, avoid the 7z/unrar command-line fallback for sensitive or untrusted archives, do not use password-protected archives where process arguments may be visible, and require explicit confirmation before execute or overwrite behavior.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
data/file_sorter.py:125
Finding

External 7-Zip and RAR extraction occurs before path validation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
data/file_sorter.py:198
Finding

Classification rules can move files outside the requested output directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
data/file_sorter.py:94
Finding

Predictable and reusable temporary directories enable file collisions and unsafe cleanup

Content
View full analysis
` beside the archive, or two operations begin in the same second. 3. `mkdir(..., exist_ok=True)` accepts the existing directory rather than creating an exclusive workspace. 4. Extraction and recursive file discovery operate on mixed pre-existing and newly extracted content. 5. Pre-existing files may be reported or moved as though they came from the archive. 6. In execute mode, `shutil.rmtree(dest)` recursively removes the reused directory after processing. ### Impact Assessment The issue can cause unintended file movement, mixing of files between concurrent jo ...[truncated 279 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
data/file_sorter.py:132
Finding

Archive passwords are exposed through external command-line arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:181
Finding

Dependency installation guidance does not pin versions or package integrity

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md
## 安全机制

脚本在解压前对所有归档成员执行路径安全校验：
- 拒绝绝对路径成员（如 `/etc/passwd`）
- 拒绝包含 `..` 的路径遍历成员（如 `../../etc/passwd`）
- 校验解压目标路径确实在指定目录内（resolve 后比较前缀）
- TAR 格式额外跳过符号链接和特殊文件（设备文件等）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md
## 安全机制

脚本在解压前对所有归档成员执行路径安全校验：
- 拒绝绝对路径成员（如 `/etc/passwd`）
- 拒绝包含 `..` 的路径遍历成员（如 `../../etc/passwd`）
- 校验解压目标路径确实在指定目录内（resolve 后比较前缀）
- TAR 格式额外跳过符号链接和特殊文件（设备文件等）

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · data/file_sorter.py (reported line 177)May include surrounding context.

python
for kw in rule["keywords"]:
            kw_lower = kw.lower()
            if mode == "contains" and kw_lower in name_lower:
                return rule["name"]
            elif mode == "startswith" and name_lower.startswith(kw_lower):
                return rule["name"]
            elif mode == "endswith" and name_lower.endswith(kw_lower):

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · data/file_sorter.py (reported line 179)May include surrounding context.

python
for kw in rule["keywords"]:
            kw_lower = kw.lower()
            if mode == "contains" and kw_lower in name_lower:
                return rule["name"]
            elif mode == "startswith" and name_lower.startswith(kw_lower):
                return rule["name"]
            elif mode == "endswith" and name_lower.endswith(kw_lower):

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · data/file_sorter.py (reported line 181)May include surrounding context.

python
for kw in rule["keywords"]:
            kw_lower = kw.lower()
            if mode == "contains" and kw_lower in name_lower:
                return rule["name"]
            elif mode == "startswith" and name_lower.startswith(kw_lower):
                return rule["name"]
            elif mode == "endswith" and name_lower.endswith(kw_lower):

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · data/file_sorter.py (reported line 183)May include surrounding context.

python
for kw in rule["keywords"]:
            kw_lower = kw.lower()
            if mode == "contains" and kw_lower in name_lower:
                return rule["name"]
            elif mode == "startswith" and name_lower.startswith(kw_lower):
                return rule["name"]
            elif mode == "endswith" and name_lower.endswith(kw_lower):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents use of Bash, file reads/writes, and archive extraction, but the manifest declares no explicit tool scope or permission boundaries. That increases the chance the agent invokes shell and filesystem capabilities more broadly than intended, especially since the skill persists rules and moves files on disk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text says to use this skill whenever the user mentions archive handling terms like '解压', which is broad enough to activate on common benign conversations. Over-broad invocation can cause unintended access to local files, archive contents, or shell-based processing when the user did not clearly request those actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow examples include vague prompts like '分类这个文件' or '整理这个压缩包', which do not ensure the file is actually an archive or that the user intended filesystem modification. In an agent setting, ambiguous triggers can lead to accidental execution of extraction and movement operations on sensitive user data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's user-facing docstrings, CLI help text, status messages, and warnings are consistently hardcoded in Chinese, making the skill effectively operate in a single language without user opt-in. The policy allows locale constraints only when documented and justified or when users are given a choice, which is not present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill's stated purpose is archive parsing and file classification, but this code can invoke general system binaries for extraction when Python modules are unavailable. That broadens capability and trust assumptions: a file-sorting skill now depends on host-installed executables, which can be abused indirectly through malicious archives or unsafe local binary resolution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
83% confidence
Finding

The code invokes external archive utilities (7z/unrar) via subprocess.run, expanding the skill's execution surface beyond pure in-process file sorting. Although arguments are passed as a list rather than through a shell, reducing classic command-injection risk, this still executes attacker-influenced inputs (archive path, password, output path) in third-party binaries that may have their own parsing quirks or memory-safety vulnerabilities.

Content

Scanner excerpt · data/file_sorter.py (reported line 163)May include surrounding context.

python
def _run_cmd(cmd):
    import subprocess
    cmd = [c for c in cmd if c]  # 去掉空字符串
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        raise RuntimeError(f"命令失败: {' '.join(cmd)}\n{r.stderr}")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The value "_未分类" sets a specific language/locale in natural-language content within the configuration. For all file types, forcing a locale-specific label without offering user choice or documenting a region-specific justification can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.