ClawHub
Back to skill

Security audit

zenTable

Security checks for vulnerabilities and agentic risk

Overview

ZenTable is a disclosed local table-rendering skill with OCR support for screenshot/photo table extraction, and the scanner concerns are mostly documentation or local-deployment false positives.

Install this only if you are comfortable running local Python/Chrome rendering code and, if using OCR, local Docker/FastAPI services. Review the pinned release scripts first, use a sandbox or container for sensitive data, and keep OCR endpoints bound to localhost or a private network unless you intentionally expose them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Credential Access

High
Category
Privilege Escalation
Content
```bash
cd /var/www/html/zenTable/deploy/skill-fastapi
cp .env.example .env
docker compose up -d --build
```
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
Rendering structured table data into PNG images does not inherently require optical character recognition services or OCR-specific API endpoints. The deployment guide shows the skill stack includes OCR infrastructure, which is a materially different capability from visualization/rendering.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest says this skill renders structured table data as PNG images using Headless Chrome. This deployment file documents a separate OCR service, OCR endpoints, and configurable OCR backends, indicating the skill includes optical character recognition capabilities not reflected in the manifest description.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
docker compose up -d --build
curl http://127.0.0.1:8001/health
```

## Skill Hub deployment (two FastAPI containers)
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The README materially expands the skill's apparent scope beyond the declared metadata by advertising OCR-assisted screenshot/photo extraction and TXT/ASCII workflows, while the manifest says the skill is for rendering structured table data as PNG images. This kind of capability mismatch is dangerous because users or orchestrators may invoke or trust the skill for data-ingestion tasks involving images or unstructured content that were not security-reviewed, increasing the chance of unintended data handling, over-privileged use, or hidden processing paths.

Natural-Language Policy Violations

Low
Confidence
76% confidence
Finding
This markdown file contains natural-language text specifying 'English SKILL docs finalized for public distribution.' That can indicate an English-only language constraint without any mention of user choice, which may conflict with language/locale policy requirements when not justified or optional.

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
The deployment guide sets `OCR_LANG=ch`, which imposes a specific language/locale configuration in natural-language documentation. The file does not indicate that users may choose another language or that this constraint is required for a documented region-specific use case.

Static analysis

No suspicious patterns detected.