ClawHub
Back to skill

Security audit

mar-docstrange

Security checks for vulnerabilities and agentic risk

Overview

This is a document-extraction skill that sends user-selected documents to a disclosed external API; privacy review is needed, but no hidden or destructive behavior was found.

Install only if you are comfortable sending selected documents or document URLs to SkillBoss API Hub. Use environment variables or a secret store for SKILLBOSS_API_KEY, avoid regulated or highly sensitive documents until you have reviewed the provider's privacy and retention terms, and prefer redacted files or short-lived scoped URLs when possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Start

```bash
curl -X POST "https://api.heybossai.com/v1/run" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
Confidence
89% confidence
Finding
The referenced endpoint is a third-party API endpoint, so the skill depends on sending data and authentication headers outside the local environment. Even though HTTPS is used and the documentation includes some security notes, the core skill function still requires external transmission of potentially sensitive documents.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Start

```bash
curl -X POST "https://api.heybossai.com/v1/run" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
Confidence
89% confidence
Finding
The referenced endpoint is a third-party API endpoint, so the skill depends on sending data and authentication headers outside the local environment. Even though HTTPS is used and the documentation includes some security notes, the core skill function still requires external transmission of potentially sensitive documents.

External Transmission

Medium
Category
Data Exfiltration
Content
### Extract to Markdown

```bash
curl -X POST "https://api.heybossai.com/v1/run" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
Confidence
95% confidence
Finding
This example sends document data to an external API for markdown extraction, which creates a real confidentiality and privacy exposure if users process sensitive files. In context, this is expected functionality for a document-extraction skill, but it still represents a genuine data-exfiltration surface to a third-party processor.

External Transmission

Medium
Category
Data Exfiltration
Content
**Simple field list:**
```bash
curl -X POST "https://api.heybossai.com/v1/run" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
96% confidence
Finding
This example transmits base64-encoded document content and requests structured field extraction from a third-party service. Because invoices and receipts commonly contain PII and financial data, the context increases the likelihood of sensitive information disclosure if used without governance.

External Transmission

Medium
Category
Data Exfiltration
Content
**With JSON schema:**
```bash
curl -X POST "https://api.heybossai.com/v1/run" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
The JSON schema extraction workflow sends full file contents to an external API, potentially revealing all text in the document, not just the requested fields. This is a real privacy and confidentiality risk despite being part of the intended feature set.

External Transmission

Medium
Category
Data Exfiltration
Content
### Extract Tables to CSV

```bash
curl -X POST "https://api.heybossai.com/v1/run" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/table.pdf"}}'
Confidence
93% confidence
Finding
The table extraction example again requires sending document contents or URLs to an external service, creating a potential exposure of embedded sensitive business data. The danger is contextual rather than deceptive, but the external transfer is still security-relevant and real.

External Transmission

Medium
Category
Data Exfiltration
Content
**Queue the document:**
```bash
curl -X POST "https://api.heybossai.com/v1/run" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "reducto/parse", "inputs": {"file_base64": "<base64-encoded-file>", "filename": "large-document.pdf", "output_format": "markdown", "async": true}}'
Confidence
97% confidence
Finding
The async workflow uploads base64-encoded large documents to the third-party API, which can increase exposure because larger files often contain more sensitive material and remain available for polling and backend processing. This broadens the confidentiality and retention risk surface compared with purely local processing.

External Transmission

Medium
Category
Data Exfiltration
Content
**Poll for results:**
```bash
curl -X POST "https://api.heybossai.com/v1/run" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
Confidence
86% confidence
Finding
The polling example references the same external endpoint, so it maintains dependence on third-party communications and may reveal processing metadata such as record identifiers and job status. By itself this is lower impact than file upload, but it still extends the external trust boundary.

Static analysis

No suspicious patterns detected.