ClawHub
Back to skill

Security audit

Document Tools

Security checks for vulnerabilities and agentic risk

Overview

This is a small document-processing skill with disclosed dependencies and no hidden code, though users should be careful with privileged installs and sensitive documents.

Before installing, review the pip packages and system packages, prefer a virtual environment, and only run sudo apt if you trust your OS package sources. Treat documents sent through OCR, conversion, signing, watermarking, or encryption as sensitive and keep backups before modifying originals.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Unpinned Third-Party Dependencies Installed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-29
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Complete Code Snippet:

bash
## 依赖
```bash
pip install python-docx markitdown nano-pdf
sudo apt install tesseract-ocr tesseract-ocr-chi-sim
text

### Technical Analysis

The installation instructions retrieve mutable third-party packages from the package indexes configured on the user's system. The Python dependencies have no exact version constraints, cryptographic hashes, lockfile, or explicit trusted index. Consequently, executing these instructions may install a different release than the one reviewed or expected.

Python package installation can execute package-controlled build or installation logic. If a configured package index, package publisher account, or future package release is compromised, malicious code could run during installation or when the document-processing tools are later invoked.

The operating-system command also uses `sudo`, granting the package manager root-level installation capability. The listed Tesseract packages are consistent with the Skill's OCR purpose, and the file does not configure an untrusted repository; therefore, this portion is not direct evidence of privilege escalation. It nevertheless increases the consequences of a compromised or improperly configured package source.

### Attack Path

1. A user follows the dependency installation instructions.
2. `pip` resolves the unconstrained package names through the environment's configured package index.
3. A compromised publisher release, package index, or future malicious release is selected because no reviewed version or hash is enforced.
4. Package-controlled installation logic or imported runtime code executes with the privileges of the user running `pip`.
5. If an attacker can also affect an operating-system package source configured on the host, the `sudo ap
...[truncated 792 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin every Python dependency to a reviewed exact version.
  • Maintain a lockfile or hash-locked requirements file and install with hash verification, such as pip install --require-hashes -r requirements.txt.
  • Explicitly document the trusted Python package index and prevent fallback to unintended indexes.
  • Review package provenance, maintainers, release history, and transitive dependencies before approving upgrades.
  • Test dependency upgrades in an isolated environment before deployment.
  • Prefer a virtual environment or other isolated, non-privileged Python installation.
  • For operating-system packages, use only authenticated, trusted distribution repositories and review the configured repositories before invoking sudo.
  • Separate privileged package installation from normal Skill execution and clearly explain why elevated access is required.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill's natural-language description and headings are written in Chinese, which imposes a specific language context on users without any opt-in or explanation that the skill is region-specific. This can violate language/locale policy when no alternative language choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises OCR, signing, watermarking, encryption, and broad document conversion without warning that these operations can expose sensitive content, alter originals, or produce irreversible output changes. In an agent setting, users may invoke these capabilities on confidential files without understanding privacy, integrity, or retention implications.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill instructs users to run a command with sudo, which normalizes privileged package installation and can lead to unnecessary root execution in environments where the skill content may be copied verbatim. Encouraging elevation is risky because package installation scripts and system package changes affect the whole host and increase the blast radius of mistakes or supply-chain compromise.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

依赖

bash
pip install python-docx markitdown nano-pdf
sudo apt install tesseract-ocr tesseract-ocr-chi-sim

Static analysis

No suspicious patterns detected.