ClawHub
Back to skill

Security audit

Claw Presenter

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently prepares presentation narration, but users should understand it installs dependencies and stores extracted slide content locally.

Install this only if you are comfortable with it installing presentation/PDF processing dependencies and writing slide images, extracted text, speaker notes, and narration scripts into your workspace. For confidential decks, run it in a trusted local environment, review generated files, and consider pinning dependencies before setup.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
setup.sh:7
Finding

Automatic Installation of Unpinned Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: setup.sh:7-9, requirements.txt:1-4, and SKILL.md:160-163
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

setup.sh:7-9:

bash
# 1. Python packages
echo "📦 Installing Python packages..."
pip3 install --quiet python-pptx Pillow pdf2image pdfplumber

requirements.txt:1-4:

text
python-pptx
Pillow
pdf2image
pdfplumber

SKILL.md:160-163:

bash
pip3 install python-pptx Pillow pdf2image pdfplumber

Technical Analysis

The setup routine installs four third-party packages without exact version constraints or integrity hashes. Consequently, each setup execution resolves whatever package versions are available from pip's configured package index at that time.

This makes installations non-reproducible and leaves the effective dependency code outside the reviewed project subject to future upstream changes. If an upstream release or configured package index is compromised, package installation logic or imported runtime code can execute attacker-controlled instructions. The project metadata identifies setup.sh as the setup routine, making this installation behavior part of the expected skill deployment process.

The package names are consistent with the modules used by the parser, and the audit found no evidence of typosquatting, dependency confusion involving a private package name, or a currently malicious release. The risk arises from automatically trusting mutable, unverified future releases.

Attack Path

  1. An attacker compromises the release process or account of one of the listed upstream packages, or controls a package index configured in the execution environment.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user or automated agent runs setup.sh as directed by the skill metadata.
  4. pip3 install resolves the unpinned package to t ...[truncated 1236 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed exact version in requirements.txt, for example:

    text
    python-pptx==REVIEWED_VERSION
Pillow==REVIEWED_VERSION
pdf2image==REVIEWED_VERSION
pdfplumber==REVIEWED_VERSION

  2. Generate and verify cryptographic hashes for all direct and transitive dependencies. Use a fully resolved lock file and install it with:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  3. Replace the duplicated package list in setup.sh with installation from the locked requirements file:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  4. Update SKILL.md so that its manual installation instructions also use the same locked dependency file rather than installing mutable latest releases.

  5. Review dependency updates before changing pins, run vulnerability scanning against the resolved dependency graph, and regenerate hashes only after validating release provenance.

  6. Run setup and document parsing as an unprivileged account in an isolated environment. Avoid running pip as root or combining Python dependency installation with unnecessary elevated privileges.

  7. Configure pip to use an explicitly approved HTTPS package index and prevent untrusted environment configuration from silently redirecting dependency resolution to another index.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · setup.sh (reported line 23)May include surrounding context.

sh
sudo dnf install -y poppler-utils
elif command -v pacman &>/dev/null; then
    echo "📦 Installing poppler via pacman (Arch)..."
    sudo pacman -S --noconfirm poppler
else
    echo "⚠️  Please install poppler-utils manually for PDF→image conversion"
fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs the agent to run shell commands, read presentation files, and write output files, but it declares no explicit tool scope such as allowed-tools or permissions. That creates unnecessary ambient authority: if invoked, the agent may perform filesystem and shell actions beyond a tightly constrained boundary, increasing the blast radius of mistakes or prompt-trigger abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad natural-language requests such as preparing narration or scripts, which could match routine conversation and invoke the skill unintentionally. Because the skill can read user-supplied files and write generated outputs, accidental invocation can lead to unintended file processing and side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented examples include ambiguous phrases like '帮我准备演讲稿' and '生成演讲词' without requiring a concrete file path or presentation context. In an agent environment, these broad examples can over-expand the situations in which the skill activates, making unintended shell/file operations more likely.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/parse-presentation.py (reported line 98)May include surrounding context.

python
return False
    try:
        prefix = os.path.join(slides_dir, 'slide')
        result = subprocess.run(
            [pdftoppm, '-png', '-r', str(dpi), pdf_path, prefix],
            capture_output=True, timeout=600
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/parse-presentation.py (reported line 148)May include surrounding context.

python
# Use a persistent temp dir (not auto-cleaned) so the PDF survives
        tmpdir = tempfile.mkdtemp(prefix='claw-presenter-')
        print(f'Converting PPTX → PDF via LibreOffice...', file=sys.stderr)
        result = subprocess.run(
            [soffice, '--headless', '--convert-to', 'pdf', '--outdir', tmpdir, filepath],
            capture_output=True, timeout=300
        )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script automatically extracts full slide text, speaker notes, and rendered images, then writes them into a predictable workspace directory without any warning, consent checkpoint, retention control, or access restriction. In this skill's context, presentations often contain confidential business data or sensitive notes, so persisting that material to disk can create unintended data exposure to other users, tools, logs, backups, or later agent steps.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md
brew install poppler 2>/dev/null || echo "  poppler already installed"
elif command -v apt-get &>/dev/null; then
    echo "📦 Installing poppler via apt (Debian/Ubuntu)..."
    sudo apt-get install -y poppler-utils
elif command -v dnf &>/dev/null; then
    echo "📦 Installing poppler via dnf (Fedora/RHEL)..."
    sudo dnf install -y poppler-utils

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md
brew install poppler 2>/dev/null || echo "  poppler already installed"
elif command -v apt-get &>/dev/null; then
    echo "📦 Installing poppler via apt (Debian/Ubuntu)..."
    sudo apt-get install -y poppler-utils
elif command -v dnf &>/dev/null; then
    echo "📦 Installing poppler via dnf (Fedora/RHEL)..."
    sudo dnf install -y poppler-utils

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
brew install poppler 2>/dev/null || echo "  poppler already installed"
elif command -v apt-get &>/dev/null; then
    echo "📦 Installing poppler via apt (Debian/Ubuntu)..."
    sudo apt-get install -y poppler-utils
elif command -v dnf &>/dev/null; then
    echo "📦 Installing poppler via dnf (Fedora/RHEL)..."
    sudo dnf install -y poppler-utils

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
brew install poppler 2>/dev/null || echo "  poppler already installed"
elif command -v apt-get &>/dev/null; then
    echo "📦 Installing poppler via apt (Debian/Ubuntu)..."
    sudo apt-get install -y poppler-utils
elif command -v dnf &>/dev/null; then
    echo "📦 Installing poppler via dnf (Fedora/RHEL)..."
    sudo dnf install -y poppler-utils

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 17)May include surrounding context.

sh
brew install poppler 2>/dev/null || echo "  poppler already installed"
elif command -v apt-get &>/dev/null; then
    echo "📦 Installing poppler via apt (Debian/Ubuntu)..."
    sudo apt-get install -y poppler-utils
elif command -v dnf &>/dev/null; then
    echo "📦 Installing poppler via dnf (Fedora/RHEL)..."
    sudo dnf install -y poppler-utils

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 20)May include surrounding context.

sh
brew install poppler 2>/dev/null || echo "  poppler already installed"
elif command -v apt-get &>/dev/null; then
    echo "📦 Installing poppler via apt (Debian/Ubuntu)..."
    sudo apt-get install -y poppler-utils
elif command -v dnf &>/dev/null; then
    echo "📦 Installing poppler via dnf (Fedora/RHEL)..."
    sudo dnf install -y poppler-utils

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 23)May include surrounding context.

sh
brew install poppler 2>/dev/null || echo "  poppler already installed"
elif command -v apt-get &>/dev/null; then
    echo "📦 Installing poppler via apt (Debian/Ubuntu)..."
    sudo apt-get install -y poppler-utils
elif command -v dnf &>/dev/null; then
    echo "📦 Installing poppler via dnf (Fedora/RHEL)..."
    sudo dnf install -y poppler-utils

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 37)May include surrounding context.

sh
brew install poppler 2>/dev/null || echo "  poppler already installed"
elif command -v apt-get &>/dev/null; then
    echo "📦 Installing poppler via apt (Debian/Ubuntu)..."
    sudo apt-get install -y poppler-utils
elif command -v dnf &>/dev/null; then
    echo "📦 Installing poppler via dnf (Fedora/RHEL)..."
    sudo dnf install -y poppler-utils

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
65% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · setup.sh (reported line 23)May include surrounding context.

sh
sudo dnf install -y poppler-utils
elif command -v pacman &>/dev/null; then
    echo "📦 Installing poppler via pacman (Arch)..."
    sudo pacman -S --noconfirm poppler
else
    echo "⚠️  Please install poppler-utils manually for PDF→image conversion"
fi

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency list does not pin a specific version for python-pptx, so builds are not reproducible and may pull in newer or compromised releases unexpectedly. In a skill that processes user-supplied presentation files, dependency drift increases supply-chain risk and can silently introduce vulnerable transitive code over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
python-pptx
Pillow
pdf2image
pdfplumber

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
99% confidence
Finding

Pillow is unpinned, and the manifest gives no assurance which release will be installed. This is more dangerous here because the skill converts slides/PDFs to images, so image-parsing code is directly exposed to potentially untrusted presentation content, and known Pillow flaws have included RCE, memory corruption, and resource exhaustion.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
python-pptx
Pillow
pdf2image
pdfplumber

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
98% confidence
Finding

Pillow has multiple known advisories, but because no version is pinned, it is impossible to verify whether the installed release is patched. This is especially relevant in this skill because Pillow is used in a document/image processing pipeline that may handle untrusted files, increasing the likelihood that a vulnerable parser could be reached.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

pdf2image is unpinned, which allows uncontrolled version selection during installation and weakens supply-chain integrity. Because this skill converts PDF content as part of its core workflow, unexpected dependency changes can affect both security posture and runtime behavior.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
python-pptx
Pillow
pdf2image
pdfplumber

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

pdfplumber is unpinned even though it parses PDF content, which is often attacker-controlled and historically a high-risk file format. Unpinned parsing libraries increase exposure to newly introduced or undiscovered issues by making the deployed version unpredictable.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
python-pptx
Pillow
pdf2image
pdfplumber

Static analysis

No suspicious patterns detected.