ClawHub
Back to skill

Security audit

DocCraft

Security checks for vulnerabilities and agentic risk

Overview

DocCraft mostly matches its document-building purpose, but it needs review because it recommends an unpinned global npm install and uses unbounded Office archive extraction that can affect the local environment.

Install only in an isolated workspace, avoid the global npm install path, and prefer a pinned local docx dependency with a lockfile. Process only trusted Office files or run archive handling with size and time limits, because malicious DOCX/PPTX/XLSX files could exhaust disk, memory, or CPU. Expect the skill to read user-selected source files and write or modify local document outputs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
docx-js.md:8
Finding

Unpinned Global Installation of a Third-Party Node.js Dependency

Content
View full analysis

Vulnerability Details

File Location: docx-js.md:8-9
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

text
Assume docx is installed globally
If not installed: `npm install -g docx`

Technical Analysis

The installation instructions retrieve and globally install the latest available version of the docx package without an exact version, lockfile, or integrity constraint. Consequently, the dependency resolved during installation may differ from the version reviewed or tested by the Skill author.

npm installation can execute package lifecycle scripts. If the package, a transitive dependency, the configured npm registry, or the relevant release channel is compromised, installation may execute attacker-controlled code with the permissions of the user running npm. Global installation also broadens the affected scope beyond an isolated project directory.

No malicious dependency is embedded in the audited project, and no currently compromised package was established during this static audit. The vulnerability is the unsafe and mutable dependency acquisition process.

Attack Path

  1. An attacker compromises the docx package, one of its transitive dependencies, a future release, or the registry path used by the host.
  2. A user follows the Skill documentation and runs npm install -g docx.
  3. npm resolves the mutable latest package version rather than a previously audited version.
  4. Malicious package content or lifecycle scripts execute during installation.
  5. The installed module is subsequently loaded by scripts/generate_docx_from_markdown.cjs, allowing malicious runtime behavior to continue during document generation.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running npm. Depending on those privileges, the attacker could access or modify files available to tha ...[truncated 361 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the global installation instruction with a project-local dependency.
  2. Add a package.json that pins an audited exact version of docx.
  3. Commit a package lockfile and instruct users to run npm ci rather than installing the mutable latest version.
  4. Avoid version ranges such as ^ or ~ for security-sensitive document-generation dependencies.
  5. Verify the expected npm registry and retain lockfile integrity hashes.
  6. Disable lifecycle scripts during installation when compatible with the dependency:
    bash
    npm ci --ignore-scripts
  7. Run dependency auditing and provenance verification before publishing the Skill.
  8. Remove the recommendation to install the module globally, thereby limiting any compromise to the Skill workspace.

T09 · Insecure Skill Coding Practices

Warning
Location
ooxml/scripts/unpack.py:17
Finding

Unbounded Extraction and Parsing of Untrusted Office Archives

Content
View full analysis

Vulnerability Details

File Locations:

  • ooxml/scripts/unpack.py:17-24
  • ooxml/scripts/validation/base.py:890-891
  • ooxml/scripts/validation/docx.py:200-205
  • ooxml/scripts/validation/redlining.py:69-70

Vulnerability Type: Unrestricted archive extraction and decompression resource exhaustion
Risk Level: Medium

Vulnerable Code

The primary unpacking workflow extracts every archive member and then recursively parses extracted XML files:

python
output_path = Path(output_dir)
output_path.mkdir(parents=True, exist_ok=True)
zipfile.ZipFile(input_file).extractall(output_path)

# Format all XML files
xml_files = list(output_path.rglob("*.xml")) + list(output_path.rglob("*.rels"))
for xml_file in xml_files:
    content = xml_file.read_text(encoding="utf-8")
    dom = defusedxml.minidom.parseString(content)
    xml_file.write_bytes(dom.toprettyxml(indent="  ", encoding="ascii"))

Validation also extracts an original document without inspecting archive limits:

python
with zipfile.ZipFile(self.original_file, "r") as zip_ref:
    zip_ref.extractall(temp_path)

The redlining validator contains the same extraction pattern:

python
try:
    with zipfile.ZipFile(self.original_docx, "r") as zip_ref:
        zip_ref.extractall(temp_path)
except Exception as e:
    print(f"Failed - error extracting original docx: {e}")
    return False

Technical Analysis

DOCX, PPTX, and XLSX files are ZIP archives and are expected to be supplied as task inputs. The affected workflows call extractall() without first enforcing limits on:

  • Archive member count
  • Individual uncompressed member size
  • Total uncompressed size
  • Compression ratio
  • XML input size
  • Nested or duplicate archive paths
  • Extraction duration or storage quota

A malicious Office file can therefore contain highly compressed data that expands to a very large size. After extraction, `un ...[truncated 1803 chars]

Remediation
View remediation

Remediation Suggestions

Implement a centralized safe Office archive extraction function and use it in all unpacking and validation paths.

Before extracting any member:

  1. Reject absolute paths, parent-directory traversal components, invalid normalized paths, and entries that resolve outside the destination.
  2. Reject symbolic links and other unsupported special file types.
  3. Enforce a maximum archive member count.
  4. Enforce maximum compressed and uncompressed sizes per member.
  5. Enforce a maximum cumulative uncompressed size.
  6. Reject suspicious compression ratios.
  7. Reject duplicate or conflicting normalized paths.
  8. Validate that required OOXML files exist and that unrelated oversized entries are not processed.

Extract files individually only after validation rather than calling extractall() directly. Track the actual number of bytes copied so misleading ZIP metadata cannot bypass limits.

Additional hardening should include:

  • Maximum XML file sizes before read_text() or DOM parsing
  • Process memory, CPU, and execution-time limits
  • A quota-controlled temporary directory
  • Cleanup on all error paths
  • Tests containing high-ratio, high-member-count, traversal, duplicate-path, and oversized-XML archives

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (52)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a high-level document-authoring skill: generating complete professional documents from existing materials, then editing, reviewing, and redlining final .docx files. The supplied code does not perform any content generation, drafting, document assembly from mixed sources, review, or redlining. Instead, it is a low-level OOXML packaging tool: it copies an extracted Office document directory, condenses XML by removing whitespace/comments, zips it into an Office file, and optionally validates the result by invoking soffice. This is a materially different primary purpose from the declared authoring workflow. While related to Office files, it is an implementation utility for packaging/validation rather than a document-production skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description describes a high-level document-generation and editing skill for producing professional deliverables from source materials and managing review-ready .docx workflows. The supplied code does not draft, edit, review, redline, or generate finished documents. Instead, it is a low-level utility for unpacking OOXML-based Office files and pretty-printing their internal XML structure, with an additional RSID suggestion for .docx files. That behavior is materially different from the declared primary purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description emphasizes generating and editing professional Word documents from source materials, including drafting, formatting, review, and redlining workflows. The actual code does not create, edit, transform, or assemble documents from source materials at all. Instead, it validates the internal XML structure of unpacked Office files against schemas and redlining rules. This is a materially different primary purpose: QA/validation rather than authoring or document production. The code also supports .pptx validation, which is not aligned with the described focus on producing formal .docx deliverables. While redlining validation is loosely related to review workflows, the overall behavior is not accurately represented by the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a content-authoring and document-production skill focused on generating, editing, reviewing, and redlining professional .docx documents from source materials. The supplied code does not perform drafting, document synthesis, formatting, redlining, or output generation. Instead, it validates internal OOXML package structure and XML correctness for Office files, including Word, PowerPoint, and Excel. This is a materially different primary purpose and introduces undeclared capabilities related to low-level package validation and schema checking. While such validation might support document workflows, this code chunk itself is not an implementation of the declared writing/editing skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a high-level authoring and review tool for producing professional Word documents from source materials. The supplied code does not generate, draft, edit, or redline documents at the user-workflow level. Instead, it is a specialized validation module for checking the internal OOXML/XML structure of DOCX files, including schema validation and specific WordprocessingML invariants. This is a materially different primary purpose and includes undeclared capabilities involving archive extraction and XML inspection. Therefore the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about producing and editing professional Word documents from mixed source materials. The supplied code does not perform document generation, conversion, drafting, formatting, redlining, or .docx editing. Instead, it validates unpacked PPTX presentation XML files and their relationships against structural rules and XSD schemas. This is a materially different primary purpose and domain: PowerPoint validation versus Word-document creation workflows. No evidence in the code supports the declared long-form document drafting capability.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

There is a clear description-behavior mismatch. The declared purpose claims substantial document-authoring and Word-processing functionality, but the provided code chunk is only an empty init.py with a comment about package structure for testing. No implementation related to creating, editing, reviewing, formatting, or transforming documents is present. This is not merely an incomplete supporting detail; the actual code shown has a materially different and minimal purpose compared with the broad document-workflow description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a broad document-production skill for creating professional long-form deliverables from multiple source formats and producing/reviewing final .docx documents. The supplied code does not implement those capabilities. It only merges existing Markdown files in filename order, optionally adds a title, and emits merged Markdown. This is a materially narrower and different primary purpose than the declared skill, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a full document-drafting and Word-document workflow for producing formal deliverables from mixed source materials. The supplied code does not implement any document creation, editing, formatting, review, or redlining behavior. Instead, it recursively scans provided paths, filters some files, infers simple metadata from filenames/paths, and emits a manifest table or JSON list. While such a manifest could be a supporting preprocessing step in a larger drafting pipeline, this code chunk’s actual primary purpose is source inventorying, not professional document generation. Therefore the description materially overstates and misrepresents the behavior of this code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises a comprehensive long-form document workflow: turning existing materials into structured professional deliverables and generating/editing/reviewing final .docx files. The supplied code only constructs a default brief dictionary, allows a few fields to be overridden via CLI flags, renders that brief as Markdown or JSON, and outputs it to stdout or a file. This is a narrow setup/helper script for initializing planning metadata, not the described end-to-end document creation and Word-processing capability. The file write behavior is consistent with a CLI tool and not itself problematic, but the primary purpose and capabilities are materially different from the declaration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This code chunk’s actual function is narrowly limited to initializing and rendering a default Word format profile for confirmation/record-keeping. It accepts a few CLI flags, tweaks profile metadata, and emits Markdown or JSON. That is materially different from the declared purpose of transforming mixed project sources into complete, source-grounded professional documents and handling final Word document generation/edit/review workflows. While formatting profiles could be a supporting component of a document workflow, this chunk by itself does not implement the declared primary capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description focuses on drafting and editing professional Word documents from source materials, including formatting and review workflows. The actual code does none of that. Instead, it implements a command-line script for packaging a skill folder into a ZIP file. This is a materially different primary purpose and an undeclared capability unrelated to document generation or .docx manipulation. No document creation, parsing, editing, review, or redlining behavior appears in the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description promises an end-to-end professional document authoring and Word-file workflow: turning source materials into proposals/reports, generating or editing final .docx files, and supporting review/redline processes. The supplied code does something much more limited and different in primary purpose: it validates whether a job brief/profile contain required fields, infers package components like cover/TOC/appendices from scope text, and outputs a status report. This is at most a preparatory planning/check step for such a workflow, not the workflow itself. There are no capabilities for parsing PDFs/DOCX/TXT/Markdown, drafting content, modifying Word documents, formatting documents, or producing review-ready .docx artifacts. Therefore the description materially overstates and misrepresents the implemented behavior.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
When the job is ready, generate the file with [scripts/generate_docx_from_markdown.cjs](scripts/generate_docx_from_markdown.cjs). Feed it the merged Markdown bo

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

md
When the job is ready, generate the file with [scripts/generate_docx_from_markdown.cjs](scripts/generate_docx_from_markdown.cjs). Feed it the merged Markdown bo

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ooxml.md (reported line 49)May include surrounding context.

文本格式

xml
<!-- 粗体 -->
<w:r><w:rPr><w:b/><w:bCs/></w:rPr><w:t>粗体</w:t></w:r>
<!-- 斜体 -->
<w:r><w:rPr><w:i/><w:iCs/></w:rPr><w:t>斜体</w:t></w:r>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ooxml.md (reported line 196)May include surrounding context.

md
</pic:nvPicPr>
              <pic:blipFill>
                <a:blip r:embed="rId5"/>
                <!-- 添加以保持纵横比的拉伸填充 -->
                <a:stretch>
                  <a:fillRect/>
                </a:stretch>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ooxml.md (reported line 246)May include surrounding context.

md
</w:r>
</w:hyperlink>

<!-- 书签目标 -->
<w:bookmarkStart w:id="0" w:name="myBookmark"/>
<w:r><w:t>目标内容</w:t></w:r>
<w:bookmarkEnd w:id="0"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ooxml.md (reported line 246)May include surrounding context.

md
</w:r>
</w:hyperlink>

<!-- 书签目标 -->
<w:bookmarkStart w:id="0" w:name="myBookmark"/>
<w:r><w:t>目标内容</w:t></w:r>
<w:bookmarkEnd w:id="0"/>

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
80% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/build_manifest.py (reported line 72)May include surrounding context.

python
def detect_kind(path: Path) -> str:
    name = path.name.lower()
    full = str(path).lower()
    if any(token in name for token in ("框架", "模板", "目录", "outline", "template")):
        return "outline"
    if any(token in full for token in ("/draft/", "/chapters/")):
        return "draft"

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
80% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/build_manifest.py (reported line 76)May include surrounding context.

python
def detect_kind(path: Path) -> str:
    name = path.name.lower()
    full = str(path).lower()
    if any(token in name for token in ("框架", "模板", "目录", "outline", "template")):
        return "outline"
    if any(token in full for token in ("/draft/", "/chapters/")):
        return "draft"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill clearly instructs use of shell commands and local scripts, but it declares no explicit tool scope or permission boundaries. That creates an avoidable trust gap: an orchestrator or reviewer cannot tell up front that the skill may read, write, and execute against the local filesystem, which increases the chance of overbroad access or unsafe invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description explicitly lists document types partly in Chinese (for example, 'technical方案' and '申报材料'), which signals a language/locale-specific behavior in the skill's natural-language instructions. The file does not state that language choice is user-selected or that the locale constraint is limited to a justified region-specific use case.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
78% confidence
Finding

Instructing the agent to read a referenced file 'fully' and 'without truncation' can force excessive context consumption and create denial-of-service style behavior through prompt bloat or oversized local resources. In a skill that may operate over local files, this also increases the chance of ingesting unnecessary sensitive content beyond what is needed for the task.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md
### Create a new `.docx`

Before writing any code, fully read [docx-js.md](docx-js.md) without truncation.

Use the bundled `docx` JavaScript workflow when:

Unbounded Output

Medium
Category
Output Handling
Confidence
78% confidence
Finding

This repeats the same unbounded-ingestion pattern for OOXML editing instructions. An attacker could exploit oversized or adversarial reference content to consume context, degrade performance, or crowd out higher-priority safety instructions during execution.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md
### Edit an existing `.docx`

Before editing, fully read [ooxml.md](ooxml.md) without truncation.

Use the bundled OOXML workflow when:

Static analysis

No suspicious patterns detected.