ClawHub
Back to skill

Security audit

docx-diff

Security checks for vulnerabilities and agentic risk

Overview

This skill locally compares two DOCX files and writes diff reports, with no evidence of hidden network access, persistence, credential use, or destructive behavior.

Install this only if you are comfortable with a local script reading the two DOCX files you choose and creating diff reports that may include document text and embedded images. Prefer running it in a project folder or virtual environment, and consider pinning python-docx before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Runtime Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install python-docx

Technical Analysis

The Skill directs the agent to install python-docx from pip without specifying an audited version, requiring package hashes, constraining the package index, or using an isolated environment. Consequently, the installed dependency may change after the Skill itself has been audited.

If the package distribution account, configured package index, package-resolution process, or network trust boundary is compromised, pip could install attacker-controlled content. Such content may execute during package installation or later when compare_docx.py imports the docx module.

This is a supply-chain weakness rather than evidence that the current python-docx package is malicious.

Attack Path

  1. An attacker compromises the relevant package distribution channel or causes the environment to use an attacker-controlled pip index.
  2. A user or agent follows the dependency-installation instruction in SKILL.md.
  3. pip resolves and installs an attacker-controlled or unexpectedly modified package version.
  4. Malicious code executes during installation or when the comparison script imports the package.
  5. The code runs with the privileges of the user executing the Skill and can access resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Depending on that user's permissions, an attacker could read documents and credentials, modify user-accessible files, or install additional malicious components. The scope is limited by the privileges and isolation controls of the execution environment.

Remediation
View remediation

Remediation Suggestions

  1. Pin python-docx to a specifically reviewed version.
  2. Store dependencies in a lock or requirements file with cryptographic hashes.
  3. Install dependencies with hash enforcement, for example:
bash
python -m pip install --require-hashes -r requirements.txt
  1. Configure pip to use an explicitly trusted package index and disable unintended supplemental indexes.
  2. Install the dependency in a dedicated virtual environment with only the filesystem permissions required to process the selected documents and create reports.
  3. Periodically review and deliberately update the pinned dependency after vulnerability and provenance checks.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs the agent to run a local script that generates multiple output files, but the manifest declares no explicit tool scope or permissions. That mismatch weakens least-privilege controls and makes it harder for the platform or user to understand that the skill can write files to disk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include broad everyday requests such as '帮我看看哪里改了' and '这两版有什么区别', which can cause the skill to activate in contexts the user did not intend. Mis-triggering a skill that installs dependencies and runs a local file-processing script increases the chance of unintended code execution or file access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes generating HTML, DOCX, and TXT outputs but does not warn that files will be written to disk, potentially into the same directory as the second input file. Without overwrite and destination warnings, users may unintentionally expose sensitive document contents in shareable reports or overwrite existing artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code's natural-language interface is entirely in Chinese, including the module docstring and command-line usage text, and later the generated HTML explicitly sets lang="zh-CN". Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.