ClawHub
Back to skill

Security audit

评优激励通报分析2.0

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local spreadsheet and Word-document analysis tool whose file reads and report generation are mostly disclosed and purpose-aligned, with some path-safety and dependency-hygiene caveats.

Install only if you intend the agent to process local business Excel and Word files. Set YJ_SRC, YJ_DOC_DIR, and output variables to explicit safe folders, review generated files before sharing them, and consider pinning dependencies before use in a controlled environment.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'OUT' from os.environ.get (line 18, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
}
        out.append(entry)
        print('OK', d['short'], '| 段落', len(items), '| 表格', len(tables), '| 章节', ' / '.join(sections))
    with open(OUT, 'w', encoding='utf-8') as f:
        json.dump(out, f, ensure_ascii=False, indent=1)
    print('索引已保存:', OUT)
Confidence
92% confidence
Finding
The script writes JSON to a path taken from the YJ_DOC_OUT environment variable without validating or constraining the destination. If an attacker can influence the runtime environment, they can redirect output to arbitrary filesystem locations, causing file overwrite, data corruption, or clobbering files the process has permission to modify.

Tainted flow: 'path' from os.environ.get (line 80, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
}

def save_term_map(path):
    with open(path, 'w', encoding='utf-8') as f:
        json.dump(TERM_MAP, f, ensure_ascii=False, indent=1)
    print('术语映射已保存:', path)
Confidence
87% confidence
Finding
save_term_map writes to a caller-supplied path, and in this script that path is derived from os.path.dirname(OUT), which ultimately depends on the YJ_DOC_OUT environment variable. This extends the same arbitrary file-write risk to term_map.json, allowing an attacker controlling configuration to place or overwrite files in unintended locations.

Tainted flow: 'OUT_HTML' from os.environ.get (line 61, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
'<div style="color:#888;font-size:13px;margin-bottom:20px">数据来源：2026年3季度合作伙伴评优激励通报20260811 · 渠道完成情况通报表</div>'
            f'<div style="display:flex;gap:10px;flex-wrap:wrap;margin-bottom:28px">{card_html}</div>'
            f'{imgs}</div></body></html>')
    with open(OUT_HTML, 'w', encoding='utf-8') as f:
        f.write(html)
    return OUT_HTML
Confidence
91% confidence
Finding
The output HTML path is derived from the YJ_CHART_OUT environment variable and is written without validation or restriction. If an attacker can influence the process environment, they can redirect output to arbitrary writable paths, causing unintended file overwrite or clobbering of application data; in this skill context, the script routinely generates files, so path-based abuse is plausible even though there is no code execution here.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs use of environment variables and direct file generation/modification capabilities, but no explicit permission model is declared. That creates a gap between documented behavior and enforceable controls, increasing the chance the agent reads unintended local paths or writes files in sensitive locations when given adversarial or ambiguous input.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions include broad everyday phrases and generic spreadsheet/policy-analysis requests, so the skill may activate in conversations where the user did not intend this specific workflow. Mis-triggering is risky here because the skill can access local files via environment variables and produce writes/exports, potentially causing unintended data handling.

Vague Triggers

Medium
Confidence
87% confidence
Finding
Mode 0 explicitly activates on vague phrases like '帮我分析' or '开始', which are too ambiguous for a capability that can read local documents and generate output artifacts. An attacker or accidental prompt context could steer the agent into this skill without the user's informed intent, expanding the attack surface for unintended file operations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openpyxl>=3.0
python-docx>=0.8.11
matplotlib>=3.5
Confidence
91% confidence
Finding
The dependency is specified with only a lower bound, so builds may resolve to different future versions over time. This creates supply-chain and reproducibility risk: a later upstream release could introduce a vulnerability, breaking change, or malicious compromise and be pulled automatically into the skill environment.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openpyxl>=3.0
python-docx>=0.8.11
matplotlib>=3.5
Confidence
91% confidence
Finding
Using an unpinned minimum version for python-docx means the installed package can vary between environments and over time. If a compromised or vulnerable upstream release is published, deployments may silently consume it, increasing supply-chain exposure and making incident reproduction harder.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openpyxl>=3.0
python-docx>=0.8.11
matplotlib>=3.5
Confidence
91% confidence
Finding
A non-exact requirement for matplotlib allows automatic installation of newer versions that have not been validated for security or compatibility. This is primarily a dependency hygiene and supply-chain hardening issue rather than an immediate exploit, but it can still lead to vulnerable or malicious code being introduced through upstream changes.

Static analysis

No suspicious patterns detected.