Security audit

Document Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but it can publish generated documents to a public HTTP URL and has an unsafe slug path that may write outside its intended docs folder.

Install only if you are comfortable with generated documents being written persistently under the docs directory and potentially reachable through the listed public HTTP URLs and index. Do not use it for confidential, personal, credential-bearing, or internal-only content unless access controls and HTTPS are added, and fix slug validation before allowing untrusted or arbitrary slug input.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/doc-manager.py:39
Finding: User-Controlled Slug Enables Path Traversal and File Overwrite
Content: View full analysis
5 else None ``` Path separators and `..` traversal components can therefore become part of `doc_folder`. The `pathlib` `/` operator does not prevent traversal, and `mkdir(exist_ok=True)` does not verify that the resolved destination remains beneath `/home/node/clawd/docs`. Beca ...[truncated 2168 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/doc-manager.py:14
Finding: Generated Documents Are Published Through Predictable Plaintext HTTP URLs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill advertises direct HTTP access to stored documents on a public IP address but does not warn users that document contents may become publicly accessible. This can lead to accidental disclosure of sensitive reports, internal analyses, credentials, or personal data if users assume the storage is private.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly advertises direct URL publication of generated documents and exposes a public base URL without any warning about access control, discoverability, or sensitive-data handling. In a document-generation skill, this context makes the issue more dangerous because users may assume outputs are private while the skill is designed to publish them to a reachable HTTP endpoint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file explains that the skill will create timestamped folders, generate metadata files, store content, and update a master index, all of which modify user/system files. The description does not include any warning that using the skill will write to disk or alter existing index state.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes behaviors that require reading and writing local files, but it does not declare any explicit tool scope or permissions boundary. This creates ambiguity about what filesystem access is intended and increases the risk of over-broad file operations, unauthorized writes, or accidental access beyond the document directory.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation language is broad enough to match many generic writing, analysis, and storage requests, which can cause the skill to trigger in situations where users did not clearly intend persistent storage or publication workflows. In this skill, that matters because activation can lead to file creation, index updates, and URL exposure of generated content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow states that the skill will create folders, write multiple files, and update or remove entries from INDEX.md without warning users about these local state changes. Hidden persistence and mutation of local storage can surprise users, overwrite expectations, and make recovery or auditing harder, especially when archival operations alter discoverability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The archive_document function renames document directories into the archive location, which changes user data on disk. Although the CLI prints the result afterward, there is no prior confirmation prompt or in-code warning comment/docstring indicating this mutating operation for users invoking the archive command.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The README gives a Chinese-only example trigger phrase for listing documents, which suggests a locale-specific interaction pattern. The file does not state that multiple languages are supported or that Chinese is a deliberate, justified requirement for this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The only explicit example invocation for listing documents is written in Chinese, which may imply a language-specific interaction expectation without stating that other languages are supported. The file does not offer user language choice or justify a locale-specific constraint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module docstring says the skill manages 'creation, indexing, versioning, and archival,' but the code only creates documents, updates an index, lists documents, returns URLs, and archives folders. There is no version history, revision tracking, or version-specific storage logic, so the documentation overstates what the code actually does.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest describes creating, storing, indexing, and returning URLs for documents, but does not mention altering document lifecycle state by moving documents into an archive. Archival is related to document management, yet it expands behavior beyond the specifically advertised capabilities in the manifest description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.