ClawHub
Back to skill

Security audit

doc-importer

Security checks across malware telemetry and agentic risk

Overview

This skill converts user-provided documents to markdown and its file access and output behavior match that purpose.

Install this if you want document-to-markdown conversion. Before running it on sensitive files, confirm the exact source and output path, and review converted content because external documents may contain misleading instructions or conversion artifacts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes broad, common terms like "import," "conversion," and "documents," which can cause the skill to activate in many unrelated contexts. Over-broad invocation increases the chance that external-file ingestion and transformation behavior is applied when the user did not explicitly intend it, which can lead to unsafe handling of untrusted content or inappropriate tool/file operations.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The skill instructs writing converted markdown to disk by default in the source directory, but does not clearly require an explicit user confirmation before modifying files. Even though the default path is predictable, silent or assumed file creation can surprise users, overwrite expectations, or create unintended artifacts in sensitive project directories.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.