Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [ ] No API keys or secrets are embedded in `SKILL.md` or `package.json`
Security audit
mar-docstrange
Security checks for vulnerabilities and agentic risk
Overview
This skill is a documentation-only connector for a third-party document extraction API, and its sensitive data transmission is disclosed and aligned with its stated purpose.
Install only if you are comfortable sending selected documents to SkillBoss API Hub. Use environment variables or a secret store for the API key, avoid uploading highly sensitive regulated data until you have reviewed the provider's privacy and retention terms, and test with non-sensitive samples first.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
The referenced endpoint is a third-party API, and the skill's primary function depends on sending user-supplied documents there. Even though HTTPS is used and the documentation includes some privacy warnings, this still represents external transmission of potentially sensitive data and credentials.
- Content
Quick Start
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
The referenced endpoint is a third-party API, and the skill's primary function depends on sending user-supplied documents there. Even though HTTPS is used and the documentation includes some privacy warnings, this still represents external transmission of potentially sensitive data and credentials.
- Content
Quick Start
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
text **Security Note:** If storing API keys in `~/.openclaw/openclaw.json`: - Set file permissions: `chmod 600 ~/.openclaw/openclaw.json` - Never commit this file to version control - Prefer environment variables or your agent's secret store when possible - Rotate keys regularly and limit API key permissions if supported
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
This example again sends documents to an external service for processing. Because the skill is specifically meant to extract document contents, the risk is not hypothetical: sensitive document text may be disclosed to the provider and retained or further processed outside the user's environment.
- Content
Extract to Markdown
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This example uploads base64-encoded file contents directly to the external API, which increases the likelihood that full raw document contents, including PII or financial data, are transmitted. The added JSON extraction use case can encourage users to process especially sensitive structured records such as invoice numbers, dates, totals, and vendor information.
- Content
Simple field list:
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
Schema-based extraction still requires uploading the underlying document to a third-party API, so the security concern remains the external disclosure of the full source material. The structured nature of the extraction may also make downstream misuse easier if sensitive financial values are automatically normalized and exposed.
- Content
With JSON schema:
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
Table extraction to CSV entails sending document data to an outside endpoint, with the same confidentiality concerns as other examples. Tabular documents often contain financial, operational, or personally identifiable information that becomes easier to export and redistribute once converted to CSV.
- Content
Extract Tables to CSV
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/table.pdf"}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The async example uploads full file contents to the provider and stores processing state remotely via a record ID, extending the time window during which sensitive documents may reside with the third party. This increases exposure relative to transient local-only processing because both content and metadata may persist beyond the immediate request.
- Content
Queue the document:
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "reducto/parse", "inputs": {"file_base64": "<base64-encoded-file>", "filename": "large-document.pdf", "output_format": "markdown", "async": true}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Poll for results:
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Poll for results:
bash curl -X POST "https://api.heybossai.com/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "reducto/parse", "inputs": {"document_url": "https://example.com/document.pdf"}}'
Static analysis
No suspicious patterns detected.