ClawHub
Back to skill

Security audit

Doc Generator

Security checks for vulnerabilities and agentic risk

Overview

This document-generation skill is not clearly malicious, but it should be reviewed because it can send document content to AnyGen and install additional unreviewed tooling automatically.

Install only if you are comfortable sending prompts and document content to AnyGen. Avoid using it for confidential, regulated, or customer data unless your organization has approved AnyGen, and review or pin the CLI and anygen-workflow-generate skill before allowing automatic installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned and Automatically Approved Supply-Chain Installations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-16 and SKILL.md:40-45
Vulnerability Type: Unpinned third-party package and unreviewed remote skill installation
Risk Level: Medium

Vulnerable Code

SKILL.md:13-16:

yaml
- id: node
  kind: node
  package: "@anygen/cli"
  bins: ["anygen"]

SKILL.md:40-45:

markdown
If the `anygen-workflow-generate` skill is not available, install it first:

```bash
anygen skill install --platform <openclaw|claude-code> -y
text

### Technical Analysis

The npm dependency `@anygen/cli` is declared without an exact version or integrity hash. Consequently, installation can resolve to a mutable package release that differs from the version originally reviewed.

The fallback workflow also directs the agent to install another skill using the `-y` option. This suppresses interactive approval and does not require the downloaded skill's source, version, signature, checksum, or contents to be reviewed before installation.

These behaviors create a supply-chain trust boundary in which externally maintained content can change after this skill has been audited. If the package registry account, distribution channel, CLI backend, or referenced workflow is compromised, malicious content could be delivered through an apparently legitimate installation operation.

No evidence establishes that the current package or workflow is malicious. The vulnerability is the absence of controls that ensure future installed content is identical to reviewed content.

### Attack Path

1. An attacker compromises the publisher account, package release process, workflow distribution service, or another relevant upstream source.
2. The attacker publishes or substitutes a malicious release of `@anygen/cli` or `anygen-workflow-generate`.
3. The environment resolves the unpinned package or invokes the documented fallback installation.
4. The `-y` option permits the workflow installation to proceed without an interactive revie
...[truncated 1028 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin @anygen/cli to an exact, reviewed version rather than allowing mutable version resolution.
  2. Use a lockfile and verify package integrity through registry-provided hashes, checksums, or cryptographic signatures.
  3. Pin anygen-workflow-generate to a specific immutable version, commit, or content digest.
  4. Document and validate the expected publisher, registry, and download origin before installation.
  5. Remove -y from the skill-installation command so that users can inspect and explicitly approve the source and requested changes.
  6. Download workflow content for review before activating it, and reject unexpected scripts, executable hooks, or instruction changes.
  7. Perform dependency installation in a sandbox or least-privilege environment with restricted filesystem, secret, and network access.
  8. Avoid exposing ANYGEN_API_KEY to package installation hooks or unrelated workflow components.
  9. Add automated dependency scanning and periodic verification to detect publisher changes, compromised releases, and unexpected differences from approved artifacts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The listed trigger phrases are broad natural-language examples without scope limits, so normal conversation like asking for a report or summary could auto-select this skill even when a local/non-third-party response would suffice. Because the skill is tied to remote generation, over-triggering increases the chance of unnecessary disclosure of sensitive prompts or attachments.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill states that documents are generated server-side at www.anygen.io, but it does not clearly warn users at the point of use that their document contents may be transmitted to a third party. In a document/report skill, inputs often contain sensitive business, legal, technical, or personal information, so missing disclosure materially raises confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The listed trigger phrases are broad natural-language examples without scope limits, so normal conversation like asking for a report or summary could auto-select this skill even when a local/non-third-party response would suffice. Because the skill is tied to remote generation, over-triggering increases the chance of unnecessary disclosure of sensitive prompts or attachments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The trigger description hard-codes both English and Chinese invocation examples, but does not explain language handling, user preference, or locale selection. If organizational policy requires respecting user language choice, this undocumented mixed-language trigger behavior may be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.