ClawHub
Back to skill

Security audit

DocToSkill

Security checks across malware telemetry and agentic risk

Overview

This skill locally converts user-supplied documents into an indexed skill package, with no evidence of hidden network access, persistence, or destructive behavior.

Install only if you are comfortable with local document-processing scripts reading the uploaded documents and packaging their extracted text and assets into a reusable skill ZIP. Be careful with sensitive documents because the generated skill archive may contain source Markdown, extracted images, and indexed excerpts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'command' from os.environ.get (line 246, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
str(path),
        str(prefix),
    ]
    result = subprocess.run(command, capture_output=True, text=True, timeout=120, check=False)
    if result.returncode != 0 or not rendered.is_file():
        rendered.unlink(missing_ok=True)
        detail = (result.stderr or result.stdout or "unknown pdftoppm error").strip()
Confidence
84% confidence
Finding
result = subprocess.run(command, capture_output=True, text=True, timeout=120, check=False)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to execute multiple local Python scripts and perform broad file reads and writes within attacker-influenced directories, but it does not declare any permissions or capability boundaries. That mismatch is dangerous because it obscures the real execution and filesystem access required by the skill, reducing review visibility and increasing the chance that an agent or platform will run shell/file operations on untrusted inputs without appropriate sandboxing or user awareness.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.