Security audit

DocsForAI

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it uses broad persistent crawling behavior, shared memory writes, and an unsafe/unpinned dependency install path that deserve review before installation.

Install only if you trust the docsforai PyPI package and are comfortable with third-party documentation URLs being crawled and saved locally. Prefer an isolated, pinned uv install, avoid the pip --break-system-packages fallback, and review or remove cached docs and MEMORY.md entries if you do not want crawl history retained across sessions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:7
Finding: Unpinned Third-Party Package Installation with Unsafe System Python Fallback
Content: View full analysis
Remediation: View remediation

other

Note

Location: SKILL.md:49
Finding: Unnecessary Persistent Modification of Shared Agent Memory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
**Always use `multi-md` format.** It preserves the site's original chapter hierarchy as individual files, so you can navigate to exactly the section you need without loading the entire documentation into context. **Output rule:** docsforai writes directly to `<output>/<site-name>/` — no extra subdirectory is created. **Docs are persistent.** Once crawled, they live on disk across sessions. Check before crawling; never re-crawl what already exists.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates updating a section titled in Chinese (「已下载文档（DocsForAI）」) and effectively imposes a locale-specific convention without user opt-in. While not directly code-execution related, this can create confusing or inaccessible persistent state, increasing the chance of misuse, missed review, or operational errors in multilingual environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation text is very broad and can trigger on common requests like 'check the documentation' or 'learn how to use X', causing the agent to invoke external crawling and local persistence in situations where the user did not clearly consent to those side effects. In this skill, that risk is amplified because activation can lead directly to network access and durable writes under the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to crawl arbitrary documentation sites and persist results on disk, but it does not require a user-facing warning or confirmation about network requests, storage location, and long-lived cached data. That creates a side-effect vulnerability where normal use can unexpectedly contact third-party domains and leave persistent artifacts across sessions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 95% confidence
Finding: The skill explicitly requires persistent cross-session recording of crawled sites in MEMORY.md and says to always append, creating durable state that can accumulate user activity and external URLs over time. In context, this is more dangerous because the data is tied to browsing/documentation interests and file paths, and there is no minimization, expiry, or consent flow.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
| vitepress | ~/.openclaw/workspace/skills/docsforai/docs/vitepress/ | 2026-04-02 |

text
Never overwrite existing rows — always append. ### Step 3 — Map the structure

Static analysis

No suspicious patterns detected.