Pandoc Rust

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 1.0.0

Overview

This skill is a document converter, but it tells users to download and run a changeable external WebAssembly file with access to their document folder.

Install only if you trust the external WASM source and are comfortable granting it access to a narrowly chosen working directory. Prefer a dedicated temporary folder containing only the files to convert, avoid granting home or project roots, and check output paths before running conversions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/USAGE.md:16

Finding

Unpinned Remote WebAssembly Payload Is Downloaded and Executed with Host Filesystem Access

Content

View full analysis

Vulnerability Details

File Location: references/USAGE.md, lines 16-40
Vulnerability Type: Unpinned remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown

## WASM File

**Download URL:** `https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/pandoc-rs/files/pandoc-component.wasm`

**Local cached path:** `~/.openclaw/wasm/pandoc-component.wasm`

**Download command:**
```bash
openclaw wasm-sandbox download \
  "https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/pandoc-rs/files/pandoc-component.wasm" \
  ~/.openclaw/wasm/pandoc-component.wasm

Tool: wasm-sandbox-run

Required command structure:

bash

openclaw wasm-sandbox run <wasm-file> \
  --work-dir <directory> -- \
  <command> [args...]

text

### Technical Analysis

The instructions download an executable WebAssembly component from a mutable `main` branch in an external personal GitHub repository. The project does not provide an immutable release reference, cryptographic checksum, or trusted signature for this component. Consequently, the effective code executed by users can change after the skill itself has been reviewed.

The downloaded component is saved to a persistent, trusted-looking cache path and subsequently executed by `openclaw wasm-sandbox run`. Execution is explicitly granted access to a host directory through `--work-dir`. Although WebAssembly provides an isolation boundary, the component can exercise whatever filesystem capabilities the sandbox grants. The external binary is not included in the audited project, so its implementation and behavior cannot be verified from the available source files.

This is primarily a remote payload retrieval and execution vulnerability rather than merely a documentation defect: the skill directs users to obtain executable code from an unpinned source and run it with access to user-
...[truncated 1687 chars]

Remediation

View remediation

Remediation Suggestions

1. Use an immutable artifact: Reference a versioned release whose contents cannot be changed, or vendor the reviewed WebAssembly binary directly in the skill package.
2. Enforce integrity verification: Publish a SHA-256 or stronger digest and verify it before every execution. Abort execution on any mismatch.
3. Add signature verification: Sign release artifacts with a trusted, documented key and verify the signature independently of the artifact host.
4. Avoid mutable branch URLs: Do not retrieve executable artifacts from main, master, or another moving branch reference. If GitHub raw content must be used, pin it to a reviewed commit hash in addition to verifying its digest.
5. Apply least-privilege filesystem access: Create a dedicated temporary working directory and copy only the required input files into it. Do not grant a home directory, project root, or other broad parent directory.
6. Separate input and output handling: Where supported, mount input files read-only and grant write access only to a dedicated output directory.
7. Secure the cache: Record the verified artifact version and checksum alongside the cached binary, revalidate it before use, and avoid silently replacing a previously verified component.
8. Audit the executable component: Include the component source, reproducible build instructions, and security review information so the binary's behavior can be independently verified.
9. Document sandbox boundaries: Clearly state the component's effective filesystem, network, environment, and process capabilities so users can make an informed permission decision.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes this skill as a document conversion tool supporting bidirectional format conversion. However, the usage documentation presents additional top-level commands for document analysis (stats), structural checking (validate), and plugin listing (plugins), which are materially broader than pure conversion behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/USAGE.md (reported line 131)May include surrounding context.

Example 1: Analyze a Markdown Document

bash

# Create test file
echo '# Hello World\n\nThis is **bold** text.' > /tmp/test.md

# Analyze document (note: --work-dir /tmp grants access to /tmp)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The conversion examples write an output file inside the granted work directory without clearly warning that existing files may be created or overwritten. In a workflow where agents choose output paths automatically, this can cause unintended modification or loss of user data within the sandbox-accessible directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.