ClawHub
Back to skill

Security audit

DocToSkill

Security checks for vulnerabilities and agentic risk

Overview

This skill locally converts user-supplied documents into an indexed skill package, with no evidence of hidden network access, persistence, or destructive behavior.

Install only if you are comfortable with local document-processing scripts reading the uploaded documents and packaging their extracted text and assets into a reusable skill ZIP. Be careful with sensitive documents because the generated skill archive may contain source Markdown, extracted images, and indexed excerpts.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'command' from os.environ.get (line 246, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
str(path),
        str(prefix),
    ]
    result = subprocess.run(command, capture_output=True, text=True, timeout=120, check=False)
    if result.returncode != 0 or not rendered.is_file():
        rendered.unlink(missing_ok=True)
        detail = (result.stderr or result.stdout or "unknown pdftoppm error").strip()
Confidence
84% confidence
Finding
The executable path is taken from the PDFTOPPM_BIN environment variable and then executed. In a hostile or multi-tenant execution environment, an attacker who can influence environment variables could cause execution of an arbitrary binary whenever a PDF requiring rendering is processed, turning document conversion into unintended code execution.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to execute multiple local Python scripts and perform broad file reads and writes within attacker-influenced directories, but it does not declare any permissions or capability boundaries. That mismatch is dangerous because it obscures the real execution and filesystem access required by the skill, reducing review visibility and increasing the chance that an agent or platform will run shell/file operations on untrusted inputs without appropriate sandboxing or user awareness.

Static analysis

No suspicious patterns detected.