ClawHub
Back to skill

Security audit

智能办公本助手

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its Doxent assistant purpose, but it can automatically install and update a downloaded local CLI, keep it running, persist it into the user environment, and modify real Doxent data.

Install only if you trust the Doxent publisher and want this skill to manage both your Doxent data and the local CLI. Be aware it may download and replace an executable, keep a background daemon running, edit your user shell or environment settings, upload specified files or URLs into Doxent/cloud workflows, and perform real note/task/calendar changes after agent interpretation. Prefer explicit prompts, review destructive confirmations carefully, and consider disabling environment persistence if you do not want profile or PATH changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
shared/scripts/doxent_api.py:32
Finding

Automatic Retrieval and Execution of an Unpinned Remote CLI

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
shared/scripts/doxent_api.py:280
Finding

Cross-Session Persistence Through Shell and User Environment Modification

Content
View full analysis
>> Doxent CLI >>>" marker_end = "# <<< Doxent CLI <<<" install_directory = os.path.dirname(executable) block = "\n".join([ marker_start, "export DOXENT_CLI_PATH={}".format(shlex.quote(executable)), "case \":$PATH:\" in *:{0}:*) ;; *) export PATH={0}:\"$PATH\" ;; esac".format(shlex.quote(install_directory)), marker_end, ]) try: existing = "" if os.path.isfile(profile): with open(profile, "r", encoding="utf-8") as handle: existing = handle.read() pattern = re.compile(re.escape(marker_start) + r"[\s\S]*?" + re.escape(marker_end)) updated = pattern.sub(block, existing) if pattern.search(existing) else existing.rstrip() + "\n\n" + block + "\n" with open(profile, "w", encoding="utf-8") as handle: handle.write(updated.lstrip("\n")) except OSError: pass ``` ```python def persist_cli_path(executable): """保存用户级环境变量，并同步当前进程，后续 Codex/终端可直接发现 CLI。""" os.environ["DOXENT_CLI_PATH"] = executable install_directory = os.path.dirname(executable) current_path = os.environ.get("PATH", "") if install_directory not in current_path.split(os.pathsep): os.environ["PATH"] = install_directory + os.pathsep + current_path if os.environ.get("DOXENT_DISABLE_ENV_PERSISTENCE") == "1": return if platform.system().lower() != "windows": persist_posix_cli_environment(executable) return try: ...[truncated 2403 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
shared/scripts/doxent_api.py:774
Finding

Bearer Token Exposure Through Command-Line Arguments

Content
View full analysis
`. 2. The operating system records the token as part of the process argument vector. 3. A local process monitor, diagnostic collector, privileged process, or same-user observer reads the argument vector while the client is running. 4. The observer extracts the token. 5. The observer uses the token to invoke the local Doxent API with the victim's authorization. ### Impact Assessment The exposed capability depends on the bearer token's scope. It may allow reading note contents, viewing schedules, cr ...[truncated 241 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
shared/scripts/doxent_api.py:177
Finding

Unauthenticated Loopback Service Can Receive Tokens and Business Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (34)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
**强制，无例外**：先把当前已加载 `SKILL.md` 所在目录解析为 `DOXENT_SKILL_ROOT`，再调用其中的脚本；不得假设项目内存在固定的 Skill 副本，也不得要求用户查找或输入 Skill 安装路径。

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger rules are intentionally over-broad and instruct the agent to route many ordinary time-related utterances directly into a skill that performs real Doxent schedule/task operations. In this context, ambiguous user language could be misinterpreted as authorization to create, modify, complete, move, or delete actual data, increasing the risk of unintended state-changing actions.

Content

No source excerpt is available for this finding.

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · shared/scripts/doxent_api.py (reported line 56)May include surrounding context.

python
"""按当前系统选择上传产物；macOS 默认使用跨 arm64/x64 的 universal 单文件。"""
    generic_override = normalize_path(os.environ.get("DOXENT_CLI_DOWNLOAD_URL"))
    if generic_override:
        return generic_override
    system = platform.system().lower()
    arch = normalized_machine()
    if system == "windows":

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · shared/scripts/doxent_api.py (reported line 375)May include surrounding context.

python
def cli_environment():
    """把自动发现的 Node 注入子进程环境，使 SFX 和旧 BAT 都能零配置启动。"""
    environment = os.environ.copy()
    node_runtime = resolve_node_runtime()
    if node_runtime:
        environment["DOXENT_NODE"] = node_runtime

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs use of shell, file, environment, and network capabilities to install, launch, update, and operate a local CLI, but it declares no explicit tool scope or allowed-tools boundary. That creates an authorization and review gap: an agent may invoke powerful capabilities not transparently constrained by the manifest, increasing the chance of unintended file changes, command execution, network access, or persistence behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description and display name are entirely Chinese, and later instructions prescribe a fixed Chinese response structure. There is no indication that users may choose another language or that the locale restriction is limited to a justified region-specific context, which creates a language/locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file specifies a required output structure using Chinese headings such as '结果', '命中项', and '补充说明', and required link-label formats in Chinese. This is a natural-language locale constraint that is not presented as optional or justified by a documented regional limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is authorized to access and modify real Doxent notes, books, schedules, reminders, and tasks, but the activation guidance is broad and loosely bounded. Ambiguous triggers can cause the agent to invoke this skill for requests that are only conversational or insufficiently explicit, increasing the risk of unintended reads, writes, deletions, or CLI-side effects on real user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill enables local file import and remote URL upload against a real note/book system, but it does not require any user-facing confirmation or warning about data access, outbound transfer, or privacy implications. In this context, the agent may access sensitive local files or send remote content into Doxent services without making the trust boundary explicit, increasing the risk of unintended data disclosure or surprising system-side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes this skill as operating on Doxent notes, folders, reminders, tasks, and Doxent CLI lifecycle actions. This file documents uploading local files and importing remote URLs into a bookshelf/book service, which is a materially different capability not covered by the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The upload API supports both local file ingestion and remote URL download, then explicitly copies/downloads content locally and uploads it to the cloud, but the documentation does not require an explicit user-consent or privacy warning before performing that action. In an agent context, this can lead to unintended exfiltration of sensitive local files or fetching attacker-controlled remote content on the user's behalf without sufficiently informed confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill explicitly supports destructive operations such as deleting and moving notes or folders, but the user-facing description does not warn about irreversible data impact or require explicit confirmation. In an agent setting, this increases the risk of accidental or ambiguous execution of destructive actions against real user data, especially because the skill targets live Doxent content rather than a sandbox.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises and enables destructive operations on real schedules and tasks, but it does not require user-facing warnings or explicit confirmation for data-changing actions such as create, update, delete, move, or complete. In a skill connected to live personal data, this omission can lead to accidental modifications or deletions based on misunderstood prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The response style section mandates fixed Chinese headings such as '结果', '命中项', '补充说明', and '下一步'. This imposes a specific language/locale behavior without documenting user opt-in or offering an alternative, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation exposes state-changing task operations such as complete, uncomplete, and move without an explicit safety warning that these actions modify real user data and should only occur after clear user confirmation. In this skill’s context, the agent is intended to operate on real Doxent schedule/task data, so ambiguity around these write actions increases the risk of unintended task completion or relocation through misunderstood or overly broad prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file is written as a prescriptive rule set entirely in Chinese, beginning with a Chinese-only title and instructions, with no indication that users may choose another language or that the rule is limited to a Chinese-language or region-specific context. Under the policy, forcing a specific language without user opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document authorizes the skill to automatically download, install, update, stop, replace, and restart a local CLI/daemon as part of ordinary data operations. That exceeds the expected scope of note/calendar access and creates a software-supply-chain and local execution risk, especially because these actions can occur without an explicit user-triggered maintenance flow or separate consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation describes silently downloading, replacing, and restarting local components without clear risk disclosure or user confirmation. Even if intended for convenience, hidden lifecycle changes reduce user awareness and control, increasing the chance of unsafe updates, unexpected service interruption, or abuse through social engineering or compromised update sources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Cloud-based version checks combined with automatic binary replacement grant the skill authority to change executable code on the host, which is not necessary for standard note or schedule access. If the update channel, metadata, or distribution path is compromised, this mechanism could deliver untrusted code and achieve local code execution under the user's account.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · shared/scripts/doxent_api.py (reported line 146)May include surrounding context.

python
"ForEach-Object { $_.CommandLine }",
    ]
    try:
        result = subprocess.run(
            command,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill persists PATH/DOXENT_CLI_PATH changes into shell profiles and the Windows user registry, creating lasting system modifications beyond the immediate Doxent request. In an agent-skill context, this expands blast radius: a compromised or replaced CLI can remain discoverable and executable in future sessions, turning a transient action into durable persistence.

Content

No source excerpt is available for this finding.

Tainted flow: 'profile' from os.environ.get (line 283, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · shared/scripts/doxent_api.py (reported line 300)May include surrounding context.

python
existing = handle.read()
        pattern = re.compile(re.escape(marker_start) + r"[\s\S]*?" + re.escape(marker_end))
        updated = pattern.sub(block, existing) if pattern.search(existing) else existing.rstrip() + "\n\n" + block + "\n"
        with open(profile, "w", encoding="utf-8") as handle:
            handle.write(updated.lstrip("\n"))
    except OSError:
        # 当前进程已能启动 CLI；配置文件不可写时不破坏已完成的用户级安装。

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · shared/scripts/doxent_api.py (reported line 387)May include surrounding context.

python
def cli_version(executable):
    """读取 CLI 帮助首屏中的版本号；旧版没有 --version，因此不能依赖该参数。"""
    try:
        result = subprocess.run(
            cli_command(executable, ["--help"]),
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · shared/scripts/doxent_api.py (reported line 490)May include surrounding context.

python
def stop_cli_for_update(executable):
    """请求当前 daemon 退出，让 Windows 可以原子替换正在使用的 CLI 文件。"""
    try:
        subprocess.run(
            cli_command(executable, ["--stop"]),
            stdin=subprocess.DEVNULL,
            stdout=subprocess.DEVNULL,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This code launches an executable discovered from environment variables, config files, or downloaded artifacts without a strong trust boundary such as signature pinning or an allowlisted install source. An attacker who can influence DOXENT_CLI_PATH, app_launch.json, or the downloaded binary source can cause arbitrary local code execution under the user's account.

Content

Scanner excerpt · shared/scripts/doxent_api.py (reported line 679)May include surrounding context.

python
# 不传不存在的 background 参数，避免把旧版 Ainote 约定误传给 Doxent。
            # CLI 由 Skill 作为后台服务唤醒，不能继承 Codex/Agent 的控制台；登录页由 CLI
            # 自己打开浏览器，控制台窗口对用户没有价值，反而会造成误以为需要手工操作。
            subprocess.Popen(command, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, close_fds=True, creationflags=hidden_creation_flags(new_process_group=True), env=cli_environment(), shell=False)
            return True
        except (OSError, subprocess.SubprocessError):
            # 一个候选入口失败时继续尝试安装目录中的其他入口。