ClawHub
Back to skill

Security audit

文档格式化排版

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious with medium confidence because scanners report a mismatch between its stated document-formatting purpose and some observed behavior, including text rewrites that may conflict with a text-preservation guarantee.

Consider the suspicious verdict and Skillspector’s do-not-install recommendation before installing. The main reported concerns are the mismatch between the advertised purpose and observed operations, unclear file access scope, and reported text changes. Coverage is marked partial: all listed components were scanned, but some local references were unresolved, so the evidence is incomplete.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared primary purpose is to transform documents, but this script's workflow is to inspect a document and report findings. Its only explicit file-writing operation writes a report, not a formatted DOCX. Compliance checking could support a larger formatting skill, but the supplied chunk alone implements a materially different primary function. No unrelated network access or other suspicious capabilities are visible.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
83% confidence
Finding

The visible command specifies a Markdown report as its output, not a formatted DOCX, and exposes no Markdown-input conversion or formatting operation. Checking could support a larger formatting workflow, but no such workflow appears in the supplied chunk. This assessment is limited to the visible invocation; the underlying script's behavior cannot be verified.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/format.py (reported line 219)May include surrounding context.

python
# 读取 + 识别 + 改写
    doc = open_doc(str(src))
    paragraphs_view = list(__import__("lib_docx").iter_paragraphs(doc))
    log(f"   共 {len(paragraphs_view)} 个段落，开始识别角色…")

    classified = classify_paragraphs(paragraphs_view)

The formatter rewrites document text despite its explicit style-only, text-preservation guarantee.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

Despite the style-only guarantee, formatting unconditionally rewrites HEADER text and attachment/copy-recipient punctuation, while date rewriting is enabled by default. These transformations can alter official identifiers or misclassified content without authorization, and the text-replacement helper removes subsequent runs, potentially deleting embedded content; this is especially consequential for official documents whose wording must remain exact.

Content

No source excerpt is available for this finding.