Security audit

Skywork Document

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate remote document generator, but its broad auto-use instructions, file upload behavior, local downloads, and API-key setup guidance need careful review before installation.

Install only if you are comfortable sending full prompts and selected reference files to Skywork for remote processing. Avoid confidential documents unless your organization approves Skywork, use a protected secret store or carefully permissioned config for SKYWORK_API_KEY, do not print the key in terminal output, and inspect downloaded files before opening or processing them further.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create_doc.py:151
Finding: Unvalidated server-provided URL is downloaded to the local filesystem
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/apikey-fetch.md:27
Finding: API key setup instructions encourage plaintext persistence and secret disclosure
Content: View full analysis
Remediation: View remediation
/dev/null && echo "Configuration is valid JSON" ``` 3. Prefer an operating-system credential store, dedicated secret manager, or runtime secret injection over plaintext persistence. 4. If a plaintext configuration is unavoidable, instruct users to restrict its permissions: ```bash chmod 600 ~/.openclaw/openclaw.json chmod 600 ~/.claude/settings.json ``` 5. Warn users not to paste API keys into support messages, screenshots, logs, source repositories, or shared shell commands. 6. Recommend entering secrets through a non-echoing prompt or protected credential-management command to reduce shell-history exposure. 7. Document immediate key rotation procedures for suspected disclosure. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest markets the skill as a general document generator, but the described behavior materially includes remote upload/parsing of user files and server-side processing that are not foregrounded as the primary operational risk. This mismatch can mislead an orchestrator or user into invoking the skill in situations where sensitive files are exposed to a third party without sufficiently informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger conditions are extremely broad, instructing use for essentially any task that produces a document or any response longer than a short answer. This can cause unintended invocation, leading to unnecessary transmission of user prompts or files to a remote service and expanding the chance of privacy breaches or inappropriate autonomous actions.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/apikey-fetch.md (reported line 60)May include surrounding context.
Option B — Claude Code settings

Add the variable to ~/.claude/settings.json:

json
{

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/apikey-fetch.md (reported line 94)May include surrounding context.
Option B — Claude Code settings

Add the variable to ~/.claude/settings.json:

json
{

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/apikey-fetch.md (reported line 99)May include surrounding context.
Option B — Claude Code settings

Add the variable to ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares access to environment variables, network communication, and local file writing behavior but does not define an explicit tool scope such as permissions or allowed-tools. That makes the skill's effective authority ambiguous and increases the risk of overbroad execution, especially because it uploads user files and writes downloaded outputs locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instructions specify a default language of English when the user does not explicitly state a preference. This imposes a language choice rather than asking the user or clearly limiting the skill to an English-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The parameter documentation states that --language defaults to English, reinforcing a fixed language default. Since the skill is multilingual elsewhere, this default can conflict with user expectations and organizational language-choice policy.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
md
## Important Notes 1. **Intent Recognition First** - Always analyze the user's request before calling scripts. 2. **Web Search Built-In** - The Doc API automatically performs web searches on demand to gather relevant content for document creation. Whether you pre-search for materials externally or not is entirely optional—either approach works fine. 3. **File ID is the Bridge** - `parse_file.py` outputs `file_id` → pass to `create_doc.py` via `--files`. 4. **Server Fetches Content** - No need to paste `parsed_content` manually; the server retrieves it using `file_id`. 5. **Content is Rewrite Query** - Synthesize the user's requirements into a clear, detailed prompt. Even when the user's instructions are long or complex, capture every requirement—don't omit anything.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/apikey-fetch.md (reported line 15)May include surrounding context.
md
- Log in with your Skywork account - Open account / Settings / API Key (**https://skywork.ai/?openApiKeySetting=1**) - Create or copy your **API key** If your organization uses a separate console or test environment, use the URL and credentials your team provides.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide explicitly tells users to run echo "$SKYWORK_API_KEY", which prints a live secret to the terminal. This can expose the key to shoulder-surfing, terminal logging, screen recording, clipboard capture, or shell/session logs, and the document does not warn users about those risks or offer a safer verification method.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script advertises server-side OCR/text extraction of uploaded files, which expands the skill from document generation into remote document ingestion and analysis. That mismatch is dangerous because it enables collection and processing of potentially sensitive file contents under a skill description that does not prominently justify or scope such behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code uploads arbitrary local files to a remote /api/sse/file/parse endpoint, which is a data-exfiltration capability not clearly aligned with the skill's stated purpose of generating document outputs. In an agent setting, users may invoke this skill expecting document creation, while the script can transmit sensitive file contents to a server for parsing, increasing privacy and trust risks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.