ClawHub
Back to skill

Security audit

Miaoda Doc Parse

Security checks for vulnerabilities and agentic risk

Overview

This is a document-parsing helper that appears purpose-aligned, but users should treat parsed files and URLs as potentially processed by Miaoda's IDP tooling.

Install only if you trust `miaoda-studio-cli` and the Miaoda/IDP document parser. Use it only on files or URLs you are authorized to process, especially for confidential, internal, or access-controlled documents.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly supports parsing remote document URLs but does not warn that document content may be fetched and transmitted to an external IDP service for processing. This can cause unintended disclosure of sensitive files or internal documents if a user supplies private or access-controlled URLs under the assumption processing is local.

Static analysis

No suspicious patterns detected.