ClawHub
Back to skill

Security audit

My Docx Formatter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese official-document DOCX formatter with a normal local dependency install, though users should note its broad auto-trigger wording and unpinned Python dependency.

Install this only if you want Chinese official-document formatting. Review ambiguous requests before letting it format ordinary reports or summaries, and consider pinning python-docx or using a locked dependency workflow before running install.sh in sensitive environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
install.sh:14
Finding

Unpinned and Unverified Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: install.sh, lines 14–17
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: Medium

bash
# 激活虚拟环境并安装依赖
echo "📥 安装 python-docx..."
source .venv/bin/activate
uv pip install python-docx

Technical Analysis

The installation script installs python-docx without a version constraint, dependency lockfile, cryptographic hash verification, or an explicitly enforced package index. Consequently, the package and its transitive dependencies may change between installations without any change to the audited project.

Because uv pip can use package-index configuration inherited from the execution environment, the resolved artifact may also depend on externally controlled index or resolver settings. This creates a supply-chain risk: compromise of an upstream release, configured package repository, or dependency could cause users to install code that was not part of the reviewed Skill package.

The dependency is subsequently loaded by docx-formatter.py through imports such as from docx import Document. Any malicious runtime behavior introduced into the resolved package would therefore execute with the privileges of the user running the formatter.

Attack Path

  1. A user follows the installation instructions and executes install.sh.
  2. The script creates or reuses the local virtual environment and invokes uv pip install python-docx.
  3. The resolver obtains the current package and transitive dependency versions from its configured package index because no reviewed lockfile, version pin, or required hashes constrain resolution.
  4. An attacker who has compromised an upstream package release, a configured repository, or the dependency-resolution channel supplies a malicious artifact.
  5. The malicious artifact is installed into .venv.
  6. When the user runs the formatter, Python imports the installed docx package, causing attacke ...[truncated 886 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin python-docx and all transitive dependencies to reviewed versions.
  2. Commit a generated uv.lock file and install exclusively from that lockfile, such as with uv sync --locked.
  3. Require cryptographic hashes for resolved distributions where the selected package workflow supports them.
  4. Explicitly configure the approved package index rather than implicitly trusting environment-specific resolver configuration.
  5. Configure automated dependency scanning and a controlled process for reviewing and updating pinned versions.
  6. Make installation fail if the lockfile is absent or resolution would modify it.
  7. Avoid running the installation script with administrative privileges; retain the project-local virtual environment and least-privilege execution model.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill is hard-coded for Chinese official-document formatting and does not present any language, jurisdiction, or locale choice. In practice, this can override user expectations and produce incorrect or policy-inappropriate output when the request is for a different document standard, creating integrity and usability risks rather than direct code-execution risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The auto-trigger scope is very broad and includes generic terms like '报告', '总结', '方案', '润色', and '修改', which can match many ordinary writing requests unrelated to official-document formatting. This can cause the agent to invoke the skill unexpectedly, leading to inappropriate formatting transformations, unnecessary script execution/installation paths, or user confusion about why a specialized formatter was selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring states that the tool is a '公文格式规范生成器' and will generate documents strictly according to Chinese official document formatting standards. This imposes a specific language/locale convention without presenting any user choice or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The sample content is entirely written in Chinese and explicitly references compliance with Chinese official-document formatting, which indicates a fixed language/locale expectation. Under the policy rule, a skill should not impose a specific language or locale unless it offers user choice or clearly documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module name/commentary and all function documentation are written entirely in Chinese, presenting the skill as a Chinese-only public-facing interface. The policy requires flagging language or locale constraints when the skill forces a specific language without offering user choice or documenting a justified region-specific scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's comments and all user-facing echo output are in Chinese, and there is no indication that the skill is intentionally region-specific or that users can opt into another language. This can violate a language/locale policy when a skill is expected to be usable by a broader audience without forced locale assumptions.

Content

No source excerpt is available for this finding.