ClawHub
Back to skill

Security audit

Markdown to Word Converter

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Markdown-to-Word converter with limited, disclosed file read/write behavior.

Before using the skill, make sure the Markdown source file is clearly identified and review the output path so it does not overwrite an existing DOCX unintentionally. Installing python-docx may be required if it is not already present.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrases include broad terms like "export to docx" and "save as word document," which can match many unrelated requests and cause the skill to activate outside a clear Markdown-to-Word context. In an agent environment, overbroad invocation can lead to the wrong file being selected or transformed, increasing the chance of unintended file access or modification based on ambiguous user intent.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The conversation guidance says to "convert current/mentioned file" even when no explicit file is identified, which leaves room for the agent to guess a target file from context. That ambiguity can cause unintended processing of the wrong document, including sensitive files in the working directory, especially when combined with broad trigger phrases.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.