corporate-doc-builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 1.0.0

Overview

This document-building skill is mostly purpose-aligned, but it runs unpinned external Mermaid tooling through npx and disables Chromium sandboxing while processing user documents.

Install only if you are comfortable letting the skill run local document-processing scripts and an unpinned npx Mermaid renderer over your working files. Prefer running it in an isolated workspace or container with no sensitive environment variables, use copies of templates, and pin or preinstall Mermaid CLI before processing confidential corporate documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/render_mermaid.py:48

Finding

Automatic Execution of an Unpinned Mermaid CLI Package

Content

View full analysis

Vulnerability Details

File Location: scripts/render_mermaid.py, lines 48-57
Vulnerability Type: Unpinned runtime dependency retrieval and execution
Risk Level: Medium

Vulnerable Code:

python

cmd = [
    "npx", "-y", "@mermaid-js/mermaid-cli",
    "-i", mmd_path,
    "-o", png_path,
    "-b", "white",
    "-s", "2",
] + puppeteer_args

result = subprocess.run(cmd, capture_output=True, text=True)

Technical Analysis

The rendering script invokes npx with the -y option and an unversioned @mermaid-js/mermaid-cli package name. If the package is not already available locally, npx can retrieve the currently resolved release from the configured package registry and execute it without interactive confirmation.

Because no exact version, lockfile, or integrity hash is specified, the code executed during a future run may differ from the code reviewed during this audit. Although the use of an argument array prevents shell metacharacter injection through the file paths, it does not mitigate package supply-chain risk.

Attack Path

1. An attacker compromises the Mermaid CLI package, one of its transitive dependencies, a package maintainer account, or the configured package registry.
2. A malicious package version becomes the version resolved by the unpinned package name.
3. A user follows the documented workflow and runs render_mermaid.py.
4. npx -y downloads and executes the affected package without requesting confirmation.
5. Malicious package lifecycle or CLI code executes with the permissions and environmental access of the user running the skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running the script. The resulting access may include reading or modifying documents available to that account, accessing environment variables and credentials exposed to the process, modifying project files, and making network ...[truncated 312 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Mermaid CLI to an exact, reviewed version, such as @mermaid-js/mermaid-cli@X.Y.Z.
• Install dependencies during a controlled setup phase rather than downloading executable packages at document-rendering time.
• Maintain a lockfile that pins transitive dependencies and verify package integrity metadata.
• Remove -y so unexpected installation is not silently approved, or fail if the approved local executable is unavailable.
• Use a trusted internal package mirror where appropriate.
• Run the renderer in a restricted, rootless container with minimal filesystem mounts, no unnecessary credentials, and network access disabled after dependency installation.
• Establish a deliberate dependency-update process that includes security review and regression testing.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/puppeteer-config.json:1

Finding

Chromium Sandbox Disabled During Mermaid Rendering

Content

View full analysis

Vulnerability Details

File Location: scripts/puppeteer-config.json, line 1
Vulnerability Type: Unsafe browser security configuration
Risk Level: Medium

Vulnerable Code:

json

{ "args": ["--no-sandbox"] }

The configuration is automatically applied by scripts/render_mermaid.py when the file exists:

python

script_dir = os.path.dirname(os.path.abspath(__file__))
puppeteer_cfg = os.path.join(script_dir, "puppeteer-config.json")
puppeteer_args = ["-p", puppeteer_cfg] if os.path.exists(puppeteer_cfg) else []

Technical Analysis

The bundled Puppeteer configuration passes --no-sandbox to Chromium for every Mermaid rendering operation. Chromium's sandbox is a defense-in-depth boundary intended to restrict the effects of vulnerabilities in browser and rendering processes.

Disabling this boundary does not independently prove that arbitrary Mermaid input can execute host code. However, if malicious diagram content triggers a vulnerability in Mermaid, Puppeteer, Chromium, image processing, or related components, the absence of the Chromium sandbox can significantly increase the resulting access to the host process environment.

Mermaid content can originate from user-provided Markdown or generated content derived from external source materials. It should therefore be treated as potentially untrusted rendering input.

Attack Path

1. An attacker supplies source material or Markdown that causes malicious Mermaid content to be included in a document.
2. The user invokes render_mermaid.py.
3. The script starts Mermaid CLI and supplies the bundled Puppeteer configuration.
4. Chromium processes the content with its sandbox explicitly disabled.
5. If the content successfully exploits a vulnerability in the rendering stack, attacker-controlled code may execute with the permissions of the renderer process rather than remaining confined by Chromium's normal sandbox.

This path is conti ...[truncated 644 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --no-sandbox from the default Puppeteer configuration.
• Configure the runtime so Chromium's sandbox can operate correctly, preferably under a non-root account with appropriate kernel support.
• If disabling the Chromium sandbox is unavoidable, require explicit user opt-in rather than enabling it through a bundled default.
• Isolate rendering in a dedicated rootless container or sandbox with:
  • A read-only root filesystem.
  • Only the required input and output directories mounted.
  • Dropped Linux capabilities.
  • No host namespaces or privileged mode.
  • Strict CPU, memory, and execution-time limits.
  • Network access disabled unless explicitly required.
  • No credentials or sensitive environment variables.
• Keep Chromium, Puppeteer, Mermaid CLI, and related dependencies pinned and promptly patched.
• Validate diagram size and complexity before rendering to reduce exposure to resource-exhaustion inputs.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:9

Finding

Python Dependencies Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-16
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Low

Vulnerable Configuration:

yaml

metadata:
  openclaw:
    requires:
      bins:
        - python3
        - npx
    install:
      - kind: uv
        packages:
          - python-docx
          - Pillow
          - openpyxl

Technical Analysis

The skill installation metadata specifies Python packages by name only. It provides no exact versions, lockfile, or cryptographic hashes. Consequently, separate installations may resolve different package and transitive-dependency versions.

This makes the environment non-reproducible and allows newly published, compromised, or unexpectedly incompatible versions to enter the workflow without a deliberate review. In addition, openpyxl is included for the documented research workflow but is not imported by either bundled executable script, increasing the installed dependency surface for users who only need the scripts.

Attack Path

1. A listed package, transitive dependency, maintainer account, or configured package index is compromised, or a vulnerable release is published.
2. The skill is installed or its dependencies are refreshed.
3. The package resolver selects the affected release because no approved version or integrity hash is enforced.
4. The affected dependency is imported or otherwise used during document processing.
5. Malicious code executes, or a dependency vulnerability becomes reachable, with the permissions of the skill process.

Exploitation depends on a compromised or vulnerable dependency entering the resolved environment; no evidence was found that the currently named packages are intentionally malicious.

Impact Assessment

A malicious dependency could execute code with the privileges of the installing or invoking account. Potentially accessible resources include project doc ...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to an exact, reviewed version.
• Commit a resolver-generated lockfile that fixes transitive dependency versions.
• Enforce package hashes during installation where supported.
• Use only trusted package indexes and disable unexpected fallback indexes.
• Separate optional research dependencies from the minimum runtime dependencies required by the bundled scripts.
• Remove openpyxl from the default installation if spreadsheet processing is not required at runtime, or declare it as an optional dependency.
• Automate vulnerability scanning while ensuring dependency updates remain explicit, reviewed changes.
• Rebuild and test the locked environment periodically to apply security updates deliberately.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on .docx generation from Markdown and template preservation, but the body also instructs external diagram rendering, disk writes, shell use, and optional unsandboxed Chromium configuration. This mismatch can cause reviewers or users to underestimate the operational and security-sensitive behaviors the skill will perform.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

npx -y @mermaid-js/mermaid-cli can trigger runtime package retrieval and execution of external code, which may involve network access and supply-chain exposure. In a document-generation skill handling untrusted Markdown, this is dangerous because a simple render step can cause unreviewed code to run in the environment, potentially leading to compromise or data exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly directs use of filesystem reads/writes and shell execution (ls, cat, Python scripts, and npx) but does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance of overbroad access to arbitrary files or command execution beyond the user’s intended workspace.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill depends on npx/Mermaid CLI without pinning an exact package version, which creates a supply-chain risk because execution may fetch and run whatever version is current at runtime. That can introduce malicious or incompatible code into the document-generation workflow, especially in automated agent environments.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

## Overview

Turning a corporate .docx template plus scattered source materials into a finished document is error-prone. Models routinely break template styles, exceed token limits, hallucinate TOC entries, and produce images that overlap with text.

This skill codifies a battle-tested 6-stage pipeline that avoids these traps:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The injection step explicitly states that the script clears body content after the TOC, but the skill does not require an explicit user warning or backup before this destructive modification. In practice, this can lead to accidental loss of template content or corruption of documents if the wrong file is supplied.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script relies on npx and references Mermaid CLI without any version pinning, which means execution may vary over time and can pull different code depending on the environment. This creates a supply-chain risk where an unexpected or compromised package version could be executed during document processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

npx -y @mermaid-js/mermaid-cli can trigger runtime package retrieval and execution of external code, which may involve network access and supply-chain exposure. In a document-generation skill handling untrusted Markdown, this is dangerous because a simple render step can cause unreviewed code to run in the environment, potentially leading to compromise or data exposure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_mermaid.py (reported line 56)May include surrounding context.

python

"-s", "2",
        ] + puppeteer_args

        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode == 0:
            print(f"Successfully rendered {png_path}")
        else:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file instructs the agent to write specification files to disk and later produce a final .docx output, but it does not clearly warn the user that the workflow will create or overwrite files in the specified output locations. For markdown files, SQP-2 applies when the skill description omits warnings about behavior that can affect user data or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The script writes a concatenated markdown file to full_md_path, and elsewhere saves or replaces .docx outputs, which affects user files on disk. While the module docstring and CLI help describe the outputs functionally, there is no explicit warning or confirmation that files at those paths will be created or overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.