ClawHub
Back to skill

Security audit

Word Document Organizer

Security checks for vulnerabilities and agentic risk

Overview

This Word-formatting skill is mostly purpose-aligned, but it under-discloses a runtime package install and can overwrite the original document despite stronger safety claims.

Review before installing, especially on shared or locked-down machines. Use an isolated Python environment, require approval before any pip install, and provide a separate output_path so the original Word document is not overwritten.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill dynamically installs a Python package from the network at runtime using pip, even though document formatting does not require live network access during execution. This expands the trust boundary to external package indexes and creates supply-chain and reproducibility risks, especially in automated agent environments where installation may happen without explicit user review.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The security note claims the operation is atomic and cannot damage the original file on failure, but the code sets output_path to the original document path when no output is provided and then saves directly to that path. A crash, partial write, logic error, or library failure during save can overwrite or corrupt the original document despite the documentation claiming otherwise.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:102