document-parser

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:46 AM UTC
• Version: 1.0.0

Overview

This is a straightforward local document-parsing skill, with some setup and documentation weaknesses but no evidence of hidden, destructive, or exfiltrating behavior.

Install only in a virtual environment if possible, review the Python dependencies before running the installer, and avoid parsing confidential or regulated documents unless you trust the local runtime. Expect possible feature inconsistency because the OpenClaw entry file is less capable than the documented parse_document.py script.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_dependencies.sh:6

Finding

Unpinned Third-Party Dependencies Installed into the Active Python Environment

Content

View full analysis

Vulnerability Details

File Location: scripts/install_dependencies.sh, lines 6-9
Vulnerability Type: Unpinned and integrity-unverified dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install --upgrade pip

# Core dependencies
pip install python-docx PyPDF2 pdfplumber

Technical Analysis

The installation script upgrades pip and installs three third-party packages without fixed versions, package hashes, a lock file, or an explicitly trusted package index. Consequently, each installation can resolve to different artifacts. The command also uses whichever pip executable appears first in PATH and does not establish an isolated virtual environment.

Python package installation can execute package build or installation logic with the privileges of the user running the script. If the configured package index, dependency-resolution path, or a future package release is compromised, attacker-controlled code could execute during installation. Upgrading pip is unnecessary for the document-parsing functionality and expands the mutable supply-chain surface.

The project documentation directs users to run this script during first-use setup, making this behavior part of the expected deployment workflow.

Attack Path

1. A user follows the documented setup procedure and runs bash scripts/install_dependencies.sh.
2. The shell resolves pip from the user's current PATH and uses the environment's configured package index.
3. pip is upgraded to the latest available version, after which mutable latest versions of python-docx, PyPDF2, and pdfplumber, including transitive dependencies, are resolved.
4. If an index, resolved artifact, dependency, or future release has been compromised, attacker-controlled installation or build code executes.
5. That code runs with the privileges of the invoking user and can access resources available to that account.

Impact Assessment

Successful exploitation could permi ...[truncated 554 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unnecessary pip self-upgrade from the installation script.
2. Create and use a dedicated virtual environment so packages do not modify the active global environment.
3. Invoke pip through the intended interpreter, such as python3 -m pip, rather than relying on PATH resolution.
4. Pin all direct and transitive dependencies to reviewed versions in a lock or requirements file.
5. Record cryptographic hashes and install with --require-hashes.
6. Use an explicitly configured trusted package index and reject unexpected fallback indexes.
7. Add dependency scanning and controlled update review to the release process.

Example hardened workflow:

bash

#!/usr/bin/env bash
set -euo pipefail

python3 -m venv .venv
.venv/bin/python -m pip install \
  --require-hashes \
  --only-binary=:all: \
  -r requirements.lock

The referenced requirements.lock should pin every resolved package and include verified SHA-256 hashes for all permitted artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The implemented behavior only reads text from Word paragraphs and PDF page text. There is no code path for .txt files, and no logic to extract tables from either Word or PDF documents. The extra .doc handling is a minor undeclared extension rather than the main concern. Because key declared capabilities (.txt parsing and table extraction) are missing, the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README encourages users to upload and analyze PDFs, Word documents, and text files, but it does not warn that those files may contain confidential business, personal, legal, or financial data that will be processed and exposed to the skill runtime. In a document-parsing skill, this omission increases the risk that users will submit sensitive files without understanding the privacy implications, leading to unintended disclosure or mishandling of document contents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to read user-supplied local files, but the manifest does not declare any explicit tool scope or permissions boundary. That can lead to over-broad file access at runtime or ambiguous policy enforcement, making it easier for the skill to be invoked with access beyond the minimum required document paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation text includes broad phrases such as analyzing, extracting, reading content, or answering questions about document content, which could cause the skill to trigger in overly general situations. Over-broad routing increases the chance that a file-reading skill is selected when not strictly necessary, expanding exposure to sensitive document content and unintended file access workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says this skill parses .docx, .pdf, and .txt documents and extracts plain text and tables. In the implementation, only .doc/.docx and .pdf branches exist, and both return text only; there is no handling for .txt files and no table extraction from either format.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description and declared skill types in this file limit the skill to Word and PDF parsing, while the stated skill purpose includes parsing .txt files and extracting plain text and tables. This is a semantic mismatch between the documented behavior in the manifest and the broader claimed capability of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code comments at L10 and L15 are written in Chinese, which imposes a specific language in user- or maintainer-facing natural language without any indication of user choice or a documented regional constraint. This matches the language/locale policy category because the file contains natural-language instructions/comments in a fixed language with no opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. The examples involve parsing contracts and reports and extracting full text, tables, and metadata, but the document does not warn that uploaded or local documents may contain sensitive or confidential information that will be processed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.