ClawHub
Back to skill

Security audit

Code To Skill 1.0.6 Selfcontained

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent document-conversion purpose, but it needs Review because it creates agent-loadable skills from untrusted PDFs while its bundled safety scan misses key generated files and optional dependency installation can change the host environment.

Install only if you intend to generate persistent skills from building-code documents. Use an isolated workspace and virtual environment, avoid `--install-missing yes`, do not let an agent run `sudo`, and manually review every generated `clauses/`, `tables/`, and index file before loading or publishing the generated skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
tools/scan_generated_skill.py:125
Finding

Generated Clause Files Bypass the Prompt-Injection Scanner

Content
View full analysis
-.md tables/.md cross-refs.md mandatory-map.md terminology.md ``` ### Technical Analysis The generated-Skill scanner uses an allowlist that only includes: - `SKILL.md` - `glossary.md` - `patterns.md` - `cheatsheet.md` - Markdown files immediately under `chapters/` The audited Skill's primary generated content is stored under `clauses/`, not `chapters/`. The scanner also omits generated table Markdown, cross-reference files, the mandatory-force map, and terminology files. Extracted document text is untrusted input. Unicode sanitization removes selected invisible characters, but it does not and cannot make visible natural-language instructions safe. If a source document contains an instruction such as a role reassignment, fake system message, tool-use request, or instruction to ignore prior rules, that t ...[truncated 1645 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
book_to_skill/dependencies.py:83
Finding

Unpinned Third-Party Packages Can Be Installed at Runtime

Content
View full analysis
bool: if not packages: return True print(f"Installing missing Python package(s): {', '.join(packages)}") try: result = subprocess.run( [sys.executable, "-m", "pip", "install", *packages], text=True, timeout=600, ) except Exception as exc: print(f"Package installation failed: {exc}", file=sys.stderr) return False importlib.invalidate_caches() return result.returncode == 0 ``` The installed package identifiers are not version- or hash-pinned: ```python PYTHON_DEPENDENCIES = { "docling": "docling", "pypdf": "pypdf", "pdfminer": "pdfminer.six", "ebooklib": "ebooklib", "bs4": "beautifulsoup4", "docx": "python-docx", "striprtf": "striprtf", } ``` ### Technical Analysis The extractor can invoke pip inside the active Python interpreter and install the latest package versions resolved by the configured package index. No exact versions, artifact hashes, trusted-index restriction, or isolated target environment is specified. The default documented workflow uses `--install-missing ask`, which requires interactive approval before installation when a terminal is present. This consent control reduces accidental installation but does not establish the integrity of the packages that pip subsequently resolves. A compromised upstream release, compromised package-index account, malicious mirror, or vulnerable transitive dependency can therefore change the effective code executed by the audited project without any change to the reviewed repository. Source distributions may execute ...[truncated 1359 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
book_to_skill/config.py:5
Finding

Predictable Shared Temporary Workspace Allows File Clobbering and Cross-Run Data Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The second description-behavior mismatch similarly creates trust confusion: the skill claims PDF extraction and standards conversion, yet the documented flow includes additional scanning and filesystem behaviors not disclosed in the headline purpose. Security-relevant hidden complexity makes it harder for users to assess risk before enabling the skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The second description-behavior mismatch similarly creates trust confusion: the skill claims PDF extraction and standards conversion, yet the documented flow includes additional scanning and filesystem behaviors not disclosed in the headline purpose. Security-relevant hidden complexity makes it harder for users to assess risk before enabling the skill.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
78% confidence
Finding

The HTML comment contains cross-agent operational notes, filesystem locations, and execution hints that are hidden from normal rendering but still influence agent behavior. Hidden instructions are risky because they can bypass user visibility and shape tool usage or path selection in ways the operator does not notice.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
compatibility: "OpenClaw 0.5+ / 通用技能运行时；需本地 Python 3.8+，可选 poppler-utils(pdftotext) 提升提取质量；本 skill 自带 scripts/extract.py + book_to_skill/ 自包含引擎，无需外部安装。"
---

<!--
Cross-agent notes (informational; ignored by host agents):
  - Compatible skill roots: OpenClaw (<workspace>/skills/),
    GitHub Copilot CLI (~/.copilot/skills, ~/.agents/skills),

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The skill instructs use of rm -rf /tmp/book_skill_work, a forceful recursive deletion command. Even though the target is a temp path, destructive shell deletion is dangerous in agent workflows because variable/path confusion, symlink abuse, or copy-paste modification can turn cleanup into unintended data loss.

Content

Scanner excerpt · SKILL.md (reported line 508)May include surrounding context.

清理提取临时文件（通过 exec 或文件工具删除 <tempdir>/book_skill_work/）：

bash
rm -rf /tmp/book_skill_work

输出报告：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The skill instructs use of rm -rf /tmp/book_skill_work, a forceful recursive deletion command. Even though the target is a temp path, destructive shell deletion is dangerous in agent workflows because variable/path confusion, symlink abuse, or copy-paste modification can turn cleanup into unintended data loss.

Content

Scanner excerpt · SKILL.md (reported line 508)May include surrounding context.

清理提取临时文件（通过 exec 或文件工具删除 <tempdir>/book_skill_work/）：

bash
rm -rf /tmp/book_skill_work

输出报告：

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 590)May include surrounding context.

md
| `SKILL.md` | 本技能主说明（frontmatter + 全流程 Step 0–10 指令） |

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description and usage instructions are entirely in Chinese, which imposes a language/locale requirement on users without any opt-in or alternative language path. The policy allows locale constraints only when they are explicitly offered as a choice or clearly justified as region-specific; this README does neither.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares and instructs use of shell, file read/write, environment-dependent paths, and package-install-related operations without any explicit tool scope or permission boundaries. In a multi-agent/runtime environment, this increases the chance that an agent executes filesystem or shell actions more broadly than the user intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs creation of directories under host skill locations and later cleanup of temporary paths, which exceeds simple document transformation and can modify the agent's broader execution environment. Broad write/delete instructions are risky because path variables may be mis-resolved, and host skill directories are sensitive trust boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill includes file-creation and cleanup steps but does not front-load a clear warning that local files and directories will be created or deleted. Lack of explicit notice can cause unintended destructive changes, especially when users believe they are only requesting analysis of a PDF.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Recommending sudo apt install poppler-utils without a strong warning about elevated privileges and system modification can lead agents or users to make unnecessary privileged changes. In skill contexts, package installation is especially sensitive because it expands attack surface and can alter the host system outside the task scope.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
96% confidence
Finding

The presence of sudo indicates privileged execution guidance. Even if presented as optional, encouraging root-level commands in a skill materially raises risk because an agent or user may execute them inappropriately, leading to system-wide changes or abuse if the command path is ever extended.

Content

Scanner excerpt · SKILL.md (reported line 584)May include surrounding context.

md
| 安全扫描工具 | `tools/scan_generated_skill.py` | 自带的生成检查工具 |

如需提取更高质量（含表格布局），可在服务器安装 `poppler-utils`（pdftotext）：
`sudo apt install poppler-utils`。缺省时自动回退到 pypdf / pdfminer，功能仍可用。

## 参考文件 / References

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · book_to_skill/dependencies.py (reported line 20)May include surrounding context.

python
"modules": ["pypdf", "pdfminer"],
        "any_of_modules": True,
        "any_tool_suffices": True,
        "system": [("pdftotext", "poppler-utils", "sudo apt install poppler-utils")],
        "note": "any one of pdftotext / pypdf / pdfminer is enough",
    },
    {

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · book_to_skill/utils.py (reported line 573)May include surrounding context.

python
"modules": ["pypdf", "pdfminer"],
        "any_of_modules": True,
        "any_tool_suffices": True,
        "system": [("pdftotext", "poppler-utils", "sudo apt install poppler-utils")],
        "note": "any one of pdftotext / pypdf / pdfminer is enough",
    },
    {

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The metadata claims the skill is self-contained and needs no external installation, but this module can install Python packages and relies on external tools such as pdftotext and Calibre. This discrepancy is security-relevant because operators may trust the skill to be non-mutating and self-contained when it can actually alter the environment and depend on additional binaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

A document-conversion skill generally should not change the execution environment during normal operation, yet this code can install packages dynamically. That creates avoidable risk from package supply-chain compromise, privilege misuse, nondeterministic behavior, and persistence of changes beyond the current run.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

This code can modify the host environment by invoking pip to install packages at runtime. Although it does not use a shell and the package names come from an internal mapping rather than direct user input, automatic dependency installation introduces supply-chain and integrity risks, can unexpectedly change the runtime, and may execute package installation hooks.

Content

Scanner excerpt · book_to_skill/dependencies.py (reported line 89)May include surrounding context.

python
print(f"Installing missing Python package(s): {', '.join(packages)}")
    try:
        result = subprocess.run(
            [sys.executable, "-m", "pip", "install", *packages],
            text=True,
            timeout=600,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · book_to_skill/parsers/calibre.py (reported line 16)May include surrounding context.

python
output_path = OUTPUT_DIR / "ebook-convert-output.txt"
    try:
        input_path = os.path.abspath(input_path)
        result = subprocess.run(
            ["ebook-convert", input_path, str(output_path)],
            capture_output=True, text=True, timeout=300
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · book_to_skill/parsers/pdf.py (reported line 55)May include surrounding context.

python
return None
    try:
        pdf_path = os.path.abspath(pdf_path)
        result = subprocess.run(
            ["pdftotext", "-layout", pdf_path, "-"],
            capture_output=True, text=True, timeout=120,
            encoding="utf-8", errors="replace",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · book_to_skill/parsers/pdf.py (reported line 128)May include surrounding context.

python
if shutil.which("pdfinfo"):
        try:
            pdf_path = os.path.abspath(pdf_path)
            result = subprocess.run(
                ["pdfinfo", pdf_path], capture_output=True, text=True, timeout=15
            )
            for line in result.stdout.splitlines():

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file contains substantive changelog entries in Chinese, but provides no indication that the skill is intentionally region-specific or that users can choose their preferred language. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The code writes extracted content and metadata to OUTPUT_TEXT and OUTPUT_META, which can overwrite or create files on disk. Although the behavior is inferable from variable names and final status prints, there is no prior warning, confirmation prompt, or inline user-facing disclosure in this file before performing the writes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.