ClawHub
Back to skill

Security audit

wm-report-extract

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed financial-report PDF extractor that downloads user-specified reports and writes local cache/results, with no evidence of hidden data theft or destructive behavior.

Install only if you are comfortable with a skill that can download PDFs, call the optional WinMale filing service in symbol mode, process local report files, and keep extracted financial-report artifacts in a local cache. Review generated quality.json/review.json before relying on extracted numbers, and keep WM_REPORT_CACHE_DIR pointed at a dedicated cache directory if you use cache clean commands.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and documents substantial capabilities to read environment variables, fetch remote PDFs over the network, and read/write local cache and result files, yet it declares no permissions. That mismatch creates a confused-deputy risk: a host or reviewer may treat the skill as low-privilege while it can access external content and local data, increasing the chance of unintended data exposure, unsafe file writes, or unauthorized network access.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The skill goes beyond passive PDF extraction and includes local mutation and workflow-orchestration features such as applying agent-produced task files, mutating manifests/gaps/quality state, and allowing industry confirmation overrides. In an agent setting, this expands the attack surface: a malicious or mistaken downstream step can persist incorrect classifications or workflow state to disk, potentially causing downstream consumers to trust tampered extraction results.

Static analysis

No suspicious patterns detected.