ClawHub
Back to skill

Security audit

EPLAN Drawing Parser

Security checks for vulnerabilities and agentic risk

Overview

This skill locally parses user-provided EPLAN/CAD PDFs and optional Excel BOM files, with disclosed file outputs and no evidence of hidden network, credential, or destructive behavior.

Install only if you want local processing of engineering drawings and BOM spreadsheets. Review output paths before running commands, especially the Excel checker, because it writes a result workbook by default.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill advertises no declared permissions, yet its documented behavior includes writing output files such as parsed JSON and Excel cross-check workbooks. Undeclared write capability can surprise the host or user, weaken least-privilege controls, and allow unintended file creation or overwriting if invocation paths are not tightly constrained.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The declared purpose focuses on parsing vector PDF electrical drawings, but the skill also processes Excel BOM files, performs UL/vendor completeness checks, exports new Excel workbooks, and reportedly generates preview images. This wider behavior expands the attack surface and can cause users or orchestration systems to grant trust to a skill that handles more data types and performs more side effects than advertised.

Static analysis

No suspicious patterns detected.