ClawHub
Back to skill

Security audit

Docx Tool

Security checks for vulnerabilities and agentic risk

Overview

This is a simple DOCX helper skill whose documented file and dependency operations match its stated purpose.

Install only from a trusted Python environment, consider pinning python-docx to a reviewed version, and use copies or explicit output filenames when modifying important documents.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–13
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code:

markdown
Installed python-docx:
```bash
pip install python-docx
text

### Technical Analysis

The prerequisite instructs users to install `python-docx` from the configured Python Package Index without specifying a reviewed version or verifying an integrity hash. Consequently, dependency resolution is not reproducible, and the package artifact installed later may differ from the artifact originally reviewed.

Although the package name is not an apparent typo and no malicious dependency is embedded in the project, an unsafe future release, compromised package account, compromised package index, or altered index configuration could cause an untrusted distribution to be installed. Package-controlled installation or imported runtime code would then execute with the privileges of the user or environment performing the installation.

### Attack Path

1. An attacker compromises the package publication channel, a configured package index, or a future dependency release.
2. The user follows the documented prerequisite and runs `pip install python-docx`.
3. Because no version or artifact hash is specified, pip resolves and downloads the attacker-controlled or unexpectedly changed distribution.
4. Package-controlled code executes during installation or when the library is subsequently imported.
5. The payload operates with the privileges and accessible resources of the Python installation process.

### Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's privileges. The accessible scope may include files, environment variables, credentials, network resources, and document data available to that user or execution environment. This instruction does not itself request elevated privileges, establish p
...[truncated 111 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin python-docx to a specifically reviewed version rather than allowing unconstrained resolution.
  • Place the dependency in a lock file or requirements file with a verified SHA-256 hash.
  • Install only from an explicitly trusted package index over TLS.
  • Review both direct and transitive dependencies before approving upgrades.
  • Use an isolated virtual environment with minimal filesystem and network privileges.
  • Automate vulnerability and integrity checks in the dependency-update process.

Example hardened installation pattern:

text
python-docx==<reviewed-version> --hash=sha256:<verified-artifact-hash>

The version and hash must be obtained from and validated against the approved package artifact.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

SQP-3 covers natural-language locale policy violations across all file types. The entire skill documentation is presented only in Chinese, and there is no indication that this language constraint is optional, user-selected, or justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This is a markdown file, so SQP-2 applies to user-facing descriptions of behaviors that can affect user data. The section demonstrates modifying an existing document and saving changes, but the surrounding guidance does not warn users to back up files or avoid overwriting important documents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.