ClawHub
Back to skill

Security audit

Li_doc_answer - 通用文档 AI 答案生成

Security checks for vulnerabilities and agentic risk

Overview

This is a local Word/Markdown processing skill with no hidden network or persistence behavior, though its “AI answer generation” is overstated and users should treat outputs as templates.

Install dependencies in a virtual environment, prefer pinned package versions, and run the scripts only on documents you intend to process locally. Treat the generated answers as placeholders/templates, not authoritative AI-generated solutions, and review output filenames before batch or overwrite-prone runs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:101
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 101
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip3 install python-docx mammoth

The same installation command also appears in:

  • README.md, line 51
  • README_EN.md, line 51

Technical Analysis

The documented installation command resolves python-docx and mammoth from the active Python package index without specifying reviewed versions or cryptographic hashes. No lock file or hash-validated requirements file is provided.

Consequently, the code installed by users can change independently of the audited project. A compromised package release, dependency account, package index, or configured mirror could introduce arbitrary code during installation or runtime. Python packages may execute build backend or setup logic as part of installation, and imported dependencies execute initialization code when the document-processing scripts start.

This finding does not establish that the named packages are currently malicious. It identifies the absence of controls needed to make dependency resolution reproducible and resistant to supply-chain compromise.

Attack Path

  1. An attacker compromises a dependency release channel, maintainer account, package index, or package mirror used by the victim.
  2. The attacker publishes or serves a malicious version of python-docx, mammoth, or one of their transitive dependencies.
  3. A user follows the project documentation and runs:
    bash
    pip3 install python-docx mammoth
  4. Pip resolves the attacker-controlled version because no version or hash constraints are present.
  5. Malicious package code executes during installation, import, or document processing.
  6. The payload acts with the privileges and data access of the user running pip or the project scripts.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's accou ...[truncated 360 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed requirements file with exact versions for direct and transitive dependencies.
  2. Generate and verify cryptographic hashes for every package artifact.
  3. Require hash validation during installation, for example:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  4. Use a dependency-locking tool such as pip-tools to produce reproducible dependency sets.
  5. Install dependencies in a dedicated virtual environment rather than the system Python environment.
  6. Document the approved package index and avoid untrusted mirrors or extra indexes.
  7. Add automated dependency vulnerability and integrity scanning to the release process.
  8. Update SKILL.md, README.md, and README_EN.md so all installation instructions use the secured requirements file.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language content of this skill file is entirely Chinese, including the title, description, usage guidance, and safety notes. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation unless the locale restriction is explicitly justified, which this file does not do.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The header describes the tool as an "AI intelligent answer generator" that automatically generates reference answers. In practice, generate_answer returns fixed hard-coded template text based only on question type, with no AI service call, model invocation, or content-based reasoning beyond simple string substitution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file’s natural-language description and all user-facing messages are written exclusively in Chinese, presenting the tool as a general-purpose document answer generator rather than a region-specific or explicitly Chinese-only skill. Under the policy, language constraints should be opt-in or clearly justified; here no alternative language choice or locale justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring and all user-facing messages indicate the tool is designed to operate only in Chinese, but there is no user choice or explanation that it is intentionally restricted to a Chinese-speaking context. This is a natural-language locale policy issue because the skill imposes a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file’s user-facing description and CLI output indicate a fixed language/locale choice rather than allowing user opt-in or documenting why Chinese is required. This matches the policy concern for forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains natural-language descriptions and user-facing output exclusively in Chinese, including the module docstring and later console messages. The policy scope includes language or locale constraints across all file types, and there is no indication that users can choose another language or that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring describes the tool as a '通用文档答案生成器' (general document answer generator), suggesting it generates answers from documents. In practice, the implementation reads .doc/.docx text, reproduces it in a new document, and merely appends a placeholder section saying '在此处添加参考答案或备注...', without generating any answers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring and all user-facing CLI messages are exclusively in Chinese, which forces a language choice on users. Under the stated policy, language-specific behavior should either offer a choice or clearly justify the locale restriction.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_generate_answers.py (reported line 29)May include surrounding context.

python
def read_doc(filepath):
    """读取 doc 文件内容（需要 antiword）"""
    try:
        result = subprocess.run(['antiword', filepath], capture_output=True, text=True)
        return result.stdout
    except FileNotFoundError:
        print("⚠️  未找到 antiword，请安装：sudo apt-get install antiword")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_all_answers.py (reported line 28)May include surrounding context.

python
def read_doc(filepath):
    """读取 doc 文件内容（需要 antiword）"""
    try:
        result = subprocess.run(['antiword', filepath], capture_output=True, text=True)
        return result.stdout
    except FileNotFoundError:
        print("⚠️  未找到 antiword，请安装：sudo apt-get install antiword")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_answers.py (reported line 28)May include surrounding context.

python
def read_doc(filepath):
    """读取 doc 文件内容（需要 antiword）"""
    try:
        result = subprocess.run(['antiword', filepath], capture_output=True, text=True)
        return result.stdout
    except FileNotFoundError:
        print("⚠️  未找到 antiword，请安装：sudo apt-get install antiword")

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ai_generate_answers.py (reported line 32)May include surrounding context.

python
result = subprocess.run(['antiword', filepath], capture_output=True, text=True)
        return result.stdout
    except FileNotFoundError:
        print("⚠️  未找到 antiword，请安装：sudo apt-get install antiword")
        return None

def detect_file_type(filepath):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate_answers.py (reported line 31)May include surrounding context.

python
result = subprocess.run(['antiword', filepath], capture_output=True, text=True)
        return result.stdout
    except FileNotFoundError:
        print("⚠️  未找到 antiword，请安装：sudo apt-get install antiword")
        return None

def detect_file_type(filepath):

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The banner prints 'Li_doc_answer - 通用文档处理工具', and the surrounding branding implies an answer-generation skill. However, the code path in process_document only reads source content, writes it to a new .docx, and adds an optional empty answer area; no answer derivation or generation occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

文件主体从标题到操作说明均默认使用中文，直到末尾才提供英文版链接。按照语言/区域政策视角，这种默认单一语言呈现而未在开头明确提供语言选择，可能构成轻微的语言偏好约束。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

该 README 说明处理后会“保留原文档所有内容”“为每题生成参考答案”“保存为 .docx 格式”，表明技能会基于用户文档生成带新增内容的新文件。虽然文档描述了输出结果，但缺少更直接的用户警示，例如会创建修改版副本、批量处理可能影响大量文件内容，属于对用户数据变更影响提示不足。

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README_EN.md (reported line 7)May include surrounding context.

md
**Li_doc_answer** is a **universal Word document processing tool** with AI-powered answer generation. It supports batch processing, conversion, and automatic answer generation for any doc/docx format documents.

> ⚠️ **Note:** This skill is not limited to specific topics or subjects - it can process any Word document (educational question banks, office documents, reports, etc.)

## 🎯 v3.0 Core Feature: AI Answer Generation

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains natural-language strings that effectively force a specific language/locale for users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The program prints "正在生成参考答案" and then calls create_answer_document, which in turn uses generate_answer to insert boilerplate placeholders such as "请分析..." and "详细阐述...". This is an intent mismatch in inline/user-visible documentation because the code does not generate substantive answers from the document content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This is a code file, so natural-language strings in docstrings and print statements must still comply with language/locale policy. The file presents all instructions and status messages only in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The top-level documentation says the tool 'supports arbitrary doc/docx document batch processing,' which implies broad handling of such documents. In practice, the implementation only scans one specified directory with os.listdir and processes files whose extensions are exactly .doc or .docx, so the claim overstates the implemented scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code performs a file write via doc.save(output_file), which affects user data on disk. Although the script prints the saved path after completion, it does not warn beforehand about the write behavior or possible overwrite implications when an output path is supplied.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.