Openclawkit Word

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

This is a straightforward local Word document helper with ordinary file read/write behavior and no evidence of hidden access, persistence, exfiltration, or destructive intent.

Install in a normal least-privileged environment, prefer a pinned python-docx version if your workflow requires reproducibility, and use dedicated output folders or explicit filenames because generated DOCX files can overwrite existing paths.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:29

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5, SKILL.md:29-35, and scripts/openclawkit_word.py:17-18
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

SKILL.md:5:

yaml

metadata: { "openclaw": { "emoji": "📝", "requires": { "bins": [], "python": ["python-docx"] } } }

SKILL.md:29-35:

markdown

- Python 3.6+
- 依赖包：
  - `python-docx` (Word文档处理)

安装依赖：
```bash
pip install python-docx

text

`scripts/openclawkit_word.py:17-18`:

```python
注意：此工具库需要安装python-docx库
安装命令：pip install python-docx

Technical Analysis

The project declares and recommends installing python-docx without specifying an exact reviewed version or an expected package hash. Consequently, the dependency resolver may install whichever release is current at installation time from the user's configured package index.

The package name is conventional, and the audited project contains no evidence that it deliberately selects a malicious package or unsafe index. Nevertheless, the absence of version and integrity constraints means the code ultimately installed is mutable and was not part of this static audit. Security therefore depends on the future state of the package repository, the user's package-index configuration, and the integrity of the selected dependency release.

Attack Path

1. An attacker compromises a future compatible release of the dependency, its publication credentials, or a package index configured by the user.
2. A user follows the documented pip install python-docx instruction, or the skill platform resolves the unpinned metadata declaration.
3. The resolver downloads the attacker-controlled release because no exact version or hash is enforced.
4. Malicious package installation code may run during installation. Malicious runtime code may also run when the project executes import docx.
5. The payload operates with the permissi ...[truncated 819 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin python-docx to an exact version that has been reviewed and tested, both in the skill metadata and installation documentation.

2. Maintain dependencies in a lock or requirements file containing cryptographic hashes, and install with hash verification, for example:

   text

   python-docx==REVIEWED_VERSION --hash=sha256:EXPECTED_DISTRIBUTION_HASH
   

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate and verify hashes separately for every permitted wheel or source distribution.

4. Use an explicitly configured, trusted package index rather than inheriting arbitrary index settings from the runtime environment.

5. Perform dependency vulnerability and provenance checks before updating the pin.

6. Install and run the skill in a least-privileged isolated environment without unnecessary credentials, filesystem access, or network permissions.

7. Establish a controlled update process so dependency upgrades require review, testing, and regeneration of integrity hashes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains user-facing documentation entirely in Chinese, including the tool description and installation guidance, and the runtime demo messages are also hard-coded in Chinese. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises document processing capabilities but does not clearly warn users that it will create and write output files, including potentially large numbers of files during batch operations. This can lead to unintended filesystem modifications, overwrites, or data exposure if users invoke the tool without understanding its write behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.