Dgn To Excel

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:03 AM UTC
• Version: 2.0.0

Overview

This skill has a coherent CAD-conversion purpose, but it under-declares native executable use and gives examples that can write files without clear overwrite safeguards.

Review this skill before installing. Use only a trusted absolute path to the DGN converter, confirm the executable publisher or hash yourself, run it with limited privileges where possible, and direct batch outputs to a dedicated folder to avoid overwriting project files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: claw.json:7

Finding

External Process Execution Is Not Declared in the Skill Permissions

Content

View full analysis

Vulnerability Details

File Location: claw.json:7 and instructions.md:4-7, 26
Vulnerability Type: Permission-model mismatch and undeclared process execution
Risk Level: Medium

The manifest declares only filesystem access:

json

"permissions": ["filesystem"],

However, the operational instructions direct the agent to run an external converter:

text

When the user asks to convert DGN to Excel:
1. Verify the input file path and DGN version (v7 or v8)
2. Run the DGN converter to extract elements, levels, and properties
3. Present the extracted data (element types, levels, cell references)
4. Help filter and analyze the resulting data

The process-execution behavior is also explicitly documented:

text

- subprocess.run() is used solely for invoking the DGN converter CLI tool

Technical Analysis

The Skill's declared permission set does not disclose its intended external process execution. Filesystem access is necessary to read DGN files and write Excel output, but it does not inherently communicate authorization to launch native executables.

This discrepancy violates least-privilege and informed-authorization principles. A host or user evaluating only claw.json could approve the Skill on the assumption that it performs filesystem operations without executing local binaries. The instructions subsequently direct the agent to invoke DgnExporter.exe, extending the effective capability beyond the manifest's declared scope.

The audit did not find evidence that this mismatch is used to escalate operating-system privileges. The risk arises from undeclared native-code execution under the existing privileges of the agent or host process.

Attack Path

1. A user or host reviews the manifest and authorizes the declared filesystem permission.
2. The Skill is loaded through the instructions.md entry point.
3. The user requests conversion of a DGN file.
4. The agent fol ...[truncated 764 chars]

Remediation

View remediation

Remediation Suggestions

1. Add the platform-specific process-execution permission to claw.json.
2. State clearly that conversion launches DgnExporter.exe as a native process.
3. Document the expected executable location, publisher, and required privileges.
4. Request explicit user confirmation before the first executable launch.
5. Restrict execution to the converter and required arguments rather than granting unrestricted command execution.
6. If the platform has no process-execution permission, disable automatic invocation and provide a command for the user to run manually.
7. Keep filesystem authorization scoped to explicitly selected input and output locations.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:132

Finding

Relative Executable Path Allows Local Binary Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:132-148
Vulnerability Type: Untrusted executable resolution
Risk Level: Medium

The documented implementation defaults to a relative executable name, verifies only that the path exists, and then executes it:

python

def __init__(self, exporter_path: str = "DgnExporter.exe"):
    self.exporter = Path(exporter_path)
    if not self.exporter.exists():
        raise FileNotFoundError(f"DgnExporter not found: {exporter_path}")

def convert(self, dgn_file: str) -> Path:
    """Convert DGN file to Excel."""
    dgn_path = Path(dgn_file)
    if not dgn_path.exists():
        raise FileNotFoundError(f"DGN file not found: {dgn_file}")

    cmd = [str(self.exporter), str(dgn_path)]
    result = subprocess.run(cmd, capture_output=True, text=True)

    if result.returncode != 0:
        raise RuntimeError(f"Export failed: {result.stderr}")

Technical Analysis

DgnExporter.exe is a relative path by default. Path.exists() confirms only that a filesystem object with that name exists; it does not verify that the file is the intended converter, originates from a trusted installation, has an approved hash, or is signed by an expected publisher.

If the process runs from an attacker-controlled or writable working directory, an attacker can place a malicious executable named DgnExporter.exe there. The existence check succeeds, and subprocess.run() launches the substituted binary.

The argument list is passed without shell=True, so the reviewed code does not expose ordinary shell metacharacter injection through the DGN filename. The vulnerability instead concerns executable identity and relative-path resolution.

Attack Path

1. An attacker obtains write access to the agent's working directory or influences the directory from which the documented code is run.
2. The attacker places a malicious binary named DgnExporter.exe in that directory. 3 ...[truncated 972 chars]

Remediation

View remediation

Remediation Suggestions

1. Reject relative executable paths and require a canonical absolute path.
2. Resolve the path with strict validation before use and confirm that it is a regular file in an approved installation directory.
3. Verify a pinned cryptographic hash or an expected operating-system code-signing identity before every execution.
4. Ensure the executable and its parent directories are not writable by untrusted users.
5. Store the trusted converter path in administrator-controlled configuration rather than deriving it from the current working directory.
6. Prompt the user before executing a converter that has not previously been approved.
7. Continue using an argument array with shell=False; do not replace the current invocation with a shell command.
8. Apply execution timeouts, constrain input and output paths, and run the converter in a sandbox or low-privilege account where supported.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill repeatedly demonstrates conversions and exports that write .xlsx and .csv files to disk, but it does not warn users that files will be created in-place or may overwrite existing outputs with the same name. In automation or batch contexts, this can lead to unintended data loss, clutter, or disclosure of extracted CAD data to unsafe locations, especially because output paths are derived from input names and examples include recursive processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.