ClawHub
Back to skill

Security audit

Dochub

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent document-knowledge-base tool, but it asks for broad local file handling and even suggests disabling sandbox protection for Windows file moves.

Install only if you are comfortable giving the agent access to a chosen local document directory and letting it reorganize files into raw/wiki/update structures. Do not disable sandbox protections just to make file moves work; instead run it in a clearly scoped folder, keep backups, and require explicit confirmation before updates or dependency installation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill directs the agent to execute a fixed external Python interpreter and install packages with pip. That expands the skill from document organization into arbitrary code execution and environment modification, which can be abused to run unreviewed code, alter the host environment, or pull untrusted dependencies from the network. In this context, the capability is only partially justified because document conversion may need tooling, but the unrestricted command guidance and package installation make it materially more dangerous.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill explicitly recommends disabling sandbox protections to move files, which is a direct escalation of privilege beyond normal document processing. This undermines a core safety boundary and could enable unrestricted filesystem access, exfiltration, or destructive modifications if the skill is triggered in a sensitive environment. The document-management context makes this more dangerous, not less, because broad file operations are central to the workflow.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The search trigger phrases are overly broad and overlap with ordinary conversation, increasing the chance of accidental activation. Mis-triggering can cause unintended reads of local knowledge-base contents and generation of responses from documents the user did not intend to query, which is a real safety issue for a skill with filesystem-backed retrieval.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The update trigger includes the vague phrase '有新文档', which can match normal discussion rather than an intentional request to modify the knowledge base. Because update performs scanning, conversion, file moves, and index changes, accidental invocation could alter repository state and process files without clear user intent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.