ClawHub
Back to skill

Security audit

Graduation Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Chinese graduation-project helper that generates local PDFs and formats Word documents, with no evidence of hidden access, exfiltration, or persistence.

Install this only if you want a Chinese-language graduation-project workflow. Use it in a virtual environment when possible, review or pin the pip dependencies, and check output paths before running the Word-formatting script so you do not overwrite a document unintentionally.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-13
Vulnerability Type: Unconstrained third-party dependency installation
Risk Level: Medium

yaml
metadata:
  openclaw:
    requires:
      bins: [python]
    install:
      - id: python-packages
        kind: pip
        packages: [python-docx, reportlab]

Technical Analysis

The Skill instructs the environment to install python-docx and reportlab without fixed versions, integrity hashes, or a lockfile. Consequently, installation may resolve whichever package versions are available at that time rather than versions that were reviewed with the Skill.

This creates a supply-chain exposure: a compromised package release, package-index account, distribution artifact, or dependency of either package could introduce attacker-controlled code after the Skill itself has been audited. Python packages can execute code during installation and whenever their modules are imported by the included scripts.

No evidence indicates that the currently named packages or included scripts are malicious. The issue is the absence of controls ensuring that installed dependency artifacts remain identical to reviewed artifacts.

Attack Path

  1. An attacker compromises a dependency publisher, its package-index account, a transitive dependency, or a distributed package artifact.
  2. The attacker publishes a malicious version that still satisfies the unconstrained package names.
  3. A user or Agent installs the Skill dependencies at a time when the malicious version is selected.
  4. Attacker-controlled code executes during package installation or when docx or reportlab is imported.
  5. The payload runs with the privileges and environmental access of the process performing the installation or executing the scripts.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing or invoking account. The resulting ...[truncated 314 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin each direct dependency to an explicitly reviewed version, for example:
    yaml
    packages:
  - python-docx==<reviewed-version>
  - reportlab==<reviewed-version>
  2. Maintain a lockfile that also fixes all transitive dependencies.
  3. Require cryptographic hashes for downloaded distributions, such as through a hash-locked requirements file and pip install --require-hashes.
  4. Retrieve packages only from an explicitly configured trusted package index.
  5. Review dependency updates before changing pinned versions and use automated vulnerability and provenance checks.
  6. Install dependencies inside an isolated virtual environment using a non-privileged account.
  7. Prefer reviewed wheel artifacts and prevent unexpected source builds where operationally practical.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description and title are entirely in Chinese and present the workflow as the default mode of operation, with no indication that users may choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file-level docstring presents the tool name and usage entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the policy, language constraints should either offer user choice or be clearly documented as a justified region- or locale-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module docstring presents the tool name and usage only in Chinese, and the rest of the user-facing output follows the same pattern. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.