Docx Chapter Clean

• Outcome: Pass
• Latest audit: Jun 7, 2026 · 6:58 AM UTC
• Version: 0.2.0

Overview

This skill appears to perform its stated DOCX chapter research and verification workflow, with expected use of search tools, LLM calls, DOCX processing, and screenshots.

Install only if you are comfortable with the skill using Tavily/OpenClaw/Claude-style agents, web searches, browser screenshots, and model calls over research excerpts and visible page text. Keep it to public, intended source URLs and do not run the screenshot or smart-matching steps on internal sites, private documents, regulated data, or pages containing secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = [PLAYWRIGHT_PYTHON, str(PURPLE_SCRIPT), fn_url, str(output_file), '--smart', '--keywords-file', args.keywords_file]
            else:
                cmd = [PLAYWRIGHT_PYTHON, str(PURPLE_SCRIPT), fn_url, str(output_file), '--smart'] + keywords
            proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, start_new_session=True)
            try:
                stdout, stderr = proc.communicate(timeout=300)
                if proc.returncode == 0:

• Confidence: 88% confidence
• Finding: This code launches a browser automation helper against attacker-controlled footnote URLs, causing the host running the skill to make arbitrary outbound requests and process untrusted web content. In an agent environment, that can enable SSRF-style access to internal services, local network probing, or dangerous browser interactions if non-HTTP schemes and private-address targets are not blocked by the downstream script.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code changes keyword provenance labels from research to claim solely to satisfy a minimum-count rule, even though the documented semantics say source reflects origin. In a citation-verification pipeline, this can corrupt provenance metadata and cause downstream verification, auditing, or UI logic to treat unsupported claim-derived evidence as if it were genuinely derived from the claim.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The fallback extractor similarly reclassifies non-claim keywords as claim keywords, violating the documented meaning of the source field. Because this skill is part of a mandatory source- and screenshot-verification workflow, incorrect provenance can mislead later stages into accepting evidence alignment that was never actually established from the claim text.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: In smart mode, the script extracts the full visible page text and sends it to an external/invoked LLM process for semantic matching, which goes beyond the stated screenshot-highlighting purpose. If used on sensitive or internal pages, this can exfiltrate page contents, including confidential material, to another model runtime or service without strong minimization or trust guarantees.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The module docstring describes a local highlighting-and-screenshot utility, but the implementation also performs LLM-based semantic analysis via subprocess in smart mode. This mismatch is dangerous because operators may run the tool believing it only manipulates a local browser session, when it may also transmit extracted page content elsewhere.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code sends extracted page text to an external/invoked model in smart mode without a user-facing warning at execution time. In a research and verification pipeline that may process third-party or private source material, silent transmission increases the risk of accidental disclosure and noncompliant handling of sensitive data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function sends excerpt/title content derived from research inputs to an external or separate LLM subprocess without any user-facing notice, consent, or classification of the data being shared. If the chapter or research corpus contains proprietary, sensitive, or regulated material, this silently expands the trust boundary and may leak data through model providers, logs, or telemetry.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.