ClawHub
Back to skill

Security audit

GLM-V-Doc-Based-Writing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed cloud document-writing helper that sends user-provided documents to Zhipu for processing, with some documentation and dependency cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable sending the selected documents and writing requirements to Zhipu's API. Use a dedicated API key where possible, avoid sensitive or regulated documents unless approved, install PyMuPDF in a virtual environment with a pinned version, and be aware that `--output` writes or overwrites the chosen local file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:37
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:37
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet:

bash
pip install PyMuPDF

Technical Analysis

The documentation directs users to install PyMuPDF from the configured Python package index without specifying a reviewed version, cryptographic hashes, a lockfile, or another integrity-verification mechanism.

PyMuPDF is functionally necessary for converting local PDF pages into images. However, the unrestricted installation command is not reproducible and permits the selected package version to change after the Skill has been reviewed. If the package publisher, distribution account, package index, or configured index mirror is compromised, users could install attacker-controlled code.

This finding does not establish that PyMuPDF itself is malicious. The risk arises from installing an unpinned dependency without artifact verification.

Attack Path

  1. An attacker compromises the dependency publisher account, package distribution channel, or a package-index mirror used by the victim.
  2. The attacker publishes or substitutes a malicious package release.
  3. A user follows the Skill documentation and executes pip install PyMuPDF.
  4. The package manager retrieves the currently selected release without enforcing an audited version or expected artifact hash.
  5. Malicious installation or runtime code executes under the privileges of the user or environment performing the installation.
  6. The malicious dependency may access files, environment variables, API credentials, or network resources available to that process.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user installing or importing the package. The accessible scope may include the current Python environment, user-owned files, documents processed by ...[truncated 607 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin PyMuPDF to a specifically reviewed version, for example through a version-constrained requirements file.
  2. Generate and enforce cryptographic hashes for approved package artifacts, such as with pip install --require-hashes -r requirements.txt.
  3. Commit a lockfile or equivalent dependency manifest to make installation reproducible.
  4. Review and update pinned versions through a controlled dependency-management process.
  5. Recommend installation in a dedicated virtual environment rather than the system Python environment.
  6. Warn users not to install dependencies with administrator or root privileges.
  7. Use a trusted package index and protect against untrusted index overrides or dependency-confusion sources.
  8. Document the reviewed package version and its provenance.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The documented purpose does not cleanly match the described behavior: local PDF page-to-image conversion, mixed URL/local handling, and stray HR/resume-screening semantics suggest the skill may do more or something different than users are told. Security-wise, description/behavior drift is dangerous because users may consent to one kind of processing while the skill performs additional data transformations or reuses repurposed logic with unintended side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill description does not clearly warn that uploaded document contents are sent to an external third-party model service, and local PDFs may be converted into images before transmission. This is a significant privacy and consent issue because users may provide confidential documents without understanding that full content leaves the local environment.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
95% confidence
Finding

The mandatory instruction to display the complete model output exactly as returned disables useful safety mediation such as summarization, redaction, warning banners, or filtering. In a document-ingestion skill, this increases the risk of prompt-injection-driven exfiltration, disclosure of sensitive source content, or verbatim emission of unsafe/manipulative model output to the user.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
> **Local PDF / 本地 PDF:** Local PDF files are converted page-by-page into images (base64) before sending to the model. `PyMuPDF` is required (`pip install PyMuPDF`). URL files support full formats including pdf/docx/txt.
> 本地 PDF 会自动逐页转为图片（base64）传给模型，需要安装 `PyMuPDF`（`pip install PyMuPDF`）。URL 文件支持 pdf/docx/txt 等全格式。

### 📋 Output Display Rules (MANDATORY)

After running the script, **you must display the complete content (Markdown format) exactly as returned**. Do not summarize, truncate, translate, comment, or only say "Writing Completed!".

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises network, environment-variable, and file-write capabilities but does not declare an explicit tool scope or permissions boundary. That makes operator review and runtime enforcement weaker, increasing the chance that the skill is invoked with broader access than users expect, especially because it handles documents and an API key.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match many generic writing, summarization, translation, and planning requests. Over-broad activation can route sensitive documents or user prompts into this external-model skill unexpectedly, increasing unintended data exposure and making prompt-injection from supplied documents more likely in normal use.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
## Resource Links

| Resource        | Link                                                                                                                              |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Get API Key** | [https://bigmodel.cn/usercenter/proj-mgmt/apikeys](https://bigmodel.cn/usercenter/proj-mgmt/apikeys)                              |
| **API Docs**    | [Chat Completions / 对话补全](https://docs.bigmodel.cn/api-reference/%E6%A8%A1%E5%9E%8B-api/%E5%AF%B9%E8%AF%9D%E8%A1%A5%E5%85%A8) |

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

This duplicate finding identifies the same underlying issue: guidance to persist and share a single API key across skills increases credential exposure and cross-skill compromise risk. The risk is amplified because the skill also performs network operations on user-supplied content.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
This script reads the key from the `ZHIPU_API_KEY` environment variable and shares it with other Zhipu skills.
脚本通过 `ZHIPU_API_KEY` 环境变量获取密钥，与其他智谱技能共用同一个 key。

**Get Key / 获取 Key：** Visit [Zhipu Open Platform API Keys / 智谱开放平台 API Keys](https://bigmodel.cn/usercenter/proj-mgmt/apikeys) to create or copy your key.

**Setup options / 配置方式（任选一种）：**

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

This duplicate finding identifies the same underlying issue: guidance to persist and share a single API key across skills increases credential exposure and cross-skill compromise risk. The risk is amplified because the skill also performs network operations on user-supplied content.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
This script reads the key from the `ZHIPU_API_KEY` environment variable and shares it with other Zhipu skills.
脚本通过 `ZHIPU_API_KEY` 环境变量获取密钥,与其他智谱技能共用同一个 key。

**Get Key / 获取 Key:** Visit [Zhipu Open Platform API Keys / 智谱开放平台 API Keys](https://bigmodel.cn/usercenter/proj-mgmt/apikeys) to create or copy your key.

**Setup options / 配置方式(任选一种):**

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The default system and user prompts are written to direct the model primarily in Chinese, and the generated markdown headings/output are also Chinese-centric. The file does not offer an explicit language choice or require user opt-in before imposing this locale, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The screen function docstring says it 'Screen[s] resumes', refers to 'Resume file URLs', 'Screening requirements', and a 'consistent evaluation' temperature, which contradicts the manifest and the implementation that constructs a writing prompt and returns generated written content. This is active documentation drift about the skill's core intent, not just an omitted detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill transmits user-supplied document contents and prompts to a third-party API, including full local PDF pages converted to base64 images or remote file URLs, without any explicit user-facing privacy warning or confirmation. In a document-writing skill, inputs are likely to contain sensitive business, academic, or personal information, so silent external transmission increases the risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This code makes an outbound request to an external model API containing user documents, prompts, and potentially sensitive content. External transmission is expected for this skill's functionality, but it still represents a real data-exposure surface; in this context, the danger is not the existence of the network call itself, but the absence of strong transparency, trust-boundary messaging, and data-handling controls around it.

Content

Scanner excerpt · scripts/doc_based_writing.py (reported line 250)May include surrounding context.

python
}

    try:
        response = requests.post(
            API_BASE_URL, headers=headers, json=payload, timeout=180
        )
    except requests.exceptions.Timeout:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Several help strings and comments describe unrelated behavior: the model help says default glm-4.6v though DEFAULT_MODEL is glm-5v-turbo, the system prompt help says 'professional HR assistant', and a later comment says 'extract just the table/content' even though the output is a written markdown draft. These statements contradict the actual writing-oriented prompt and behavior, creating clear intent-code divergence.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples at L093-L105 use --criteria, but the declared CLI syntax at L119 and parameter table at L125 say the required argument is --requirements. This is an active documentation contradiction about how to invoke the skill, not just an omission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The parameter table says the default system prompt is professional HR assistant, while the skill is documented throughout as a document-based writing tool for papers, articles, reports, reviews, and similar content. That default-role description contradicts the declared intent of the skill and could mislead users about what the code actually instructs the model to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script writes generated results to a user-specified local file when --output is provided. While the flag implies saving, there is no explicit warning that content will be persisted locally and may overwrite an existing file, which is relevant for safety and data-handling transparency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.