ClawHub
Back to skill

Security audit

8917 DOCX Official

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly performs document conversion, but its optional PDF mode can compile and load native code in LibreOffice from a shared temp location, so it needs review before installation.

Install only if you trust the publisher and are comfortable with PDF conversion running LibreOffice and potentially loading locally compiled native code. Prefer DOCX-only use when possible, avoid running it with elevated privileges, and be cautious on shared systems where the temporary shim file could be tampered with.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
return str(shim_so)
    src = Path(tempfile.gettempdir()) / "lo_socket_shim.c"
    src.write_text(_SHIM_SOURCE)
    subprocess.run(
        ["gcc", "-shared", "-fPIC", "-o", str(shim_so), str(src), "-ldl"],
        check=True, capture_output=True,
    )
Confidence
94% confidence
Finding
This code compiles native C source at runtime into a shared object in a world-writable temporary directory, then later uses it for process injection. Even though the source is hardcoded, shipping a document-conversion skill with on-demand native compilation materially increases attack surface and can be abused in environments where the tool runs with elevated trust or where temp-file races/symlink attacks are possible.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes local executables (`python3`, `gcc`, `soffice`) and instructs the agent to run a conversion script that reads input files and writes output files, but it does not declare any corresponding permissions. This creates a capability/permission mismatch that can bypass expected guardrails, increasing the risk of unintended shell execution, file access, or abuse if user-controlled paths or content are passed into the workflow.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The skill deliberately compiles and injects an LD_PRELOAD shim into LibreOffice to alter low-level socket behavior. For a markdown-to-docx/pdf formatter, that is an unusually powerful and invasive capability that bypasses normal sandbox assumptions and creates a pathway for native-code execution inside a child process.

Static analysis

No suspicious patterns detected.