Security audit

Shuke Document Formatting

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to perform the promised Shuke-style document formatting and PDF generation, but it can make persistent local font changes and create extra local output files.

Install only if you need this specific Shuke-style document formatting workflow. Keep originals, use narrow input and output folders, review any use of sudo before running the font installer, and delete generated *_debug.html files when processing confidential documents.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation advertises commands and capabilities that read and write files and invoke shell-based operations, including system font installation and verification. Because no permissions are declared, an agent or reviewer may underestimate the skill's actual access needs, increasing the chance of unexpected filesystem modification or command execution in a sensitive environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The documented behavior goes beyond simple document formatting and PDF generation to include system font installation under /usr/share/fonts, font cache refresh, document generation, direct DOCX modification, and writing extra report/debug artifacts. This mismatch is dangerous because users may grant trust based on the narrow description while the skill performs broader system-changing and data-writing actions than expected.

Description-Behavior Mismatch

Low

Confidence: 95% confidence
Finding: The tool writes a second debug HTML file containing the converted document content next to the requested PDF without explicit consent. That can unintentionally persist sensitive document contents in an additional, easier-to-open artifact, increasing exposure on shared systems or synced folders.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script exceeds a typical document-formatting skill boundary by requiring root and installing fonts system-wide under `/usr/share/fonts`. In an agent or automation context, this broadens the blast radius from a per-task formatting helper to a host-modifying installer, which can unexpectedly alter the environment for all users and workflows.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Executing system font-management commands is not inherently malicious, but it is a context-inappropriate capability for a formatting skill if done automatically and with elevated privileges. In agent environments, such capabilities can be abused or can violate least-privilege expectations by modifying shared host state beyond the immediate formatting task.

Context-Inappropriate Capability

Low

Confidence: 90% confidence
Finding: Writing a CSS file into a hard-coded `/root/.openclaw/workspace/` path is unexpected for a font installer and assumes root-owned environment details that may not belong to the user. In agent contexts, hard-coded writes into privileged locations can overwrite files, leak assumptions about runtime layout, and create side effects outside the declared purpose of the skill.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list contains broad phrases such as '生成PDF' and '文档格式化' that can match many ordinary user requests beyond the intended 数科/company-specific formatting workflow. This can cause the skill to activate in unintended contexts, leading to overbroad document handling, unexpected execution of formatting/conversion utilities, or inappropriate interception of unrelated requests.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script silently writes a debug HTML file containing document content, which can leak sensitive material beyond the user-expected PDF output. In a document-formatting skill, users may process internal or confidential files, so creating an undisclosed duplicate materially increases confidentiality risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script writes directly under `/root` without a clear high-level warning or user-selected destination. In a privileged execution context, silent writes to root-owned paths can create unintended persistence and make the script unsafe to run in shared or automated environments.

Static analysis

No suspicious patterns detected.