ClawHub
Back to skill

Security audit

excel2pdf

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local Excel-to-PDF converter with ordinary dependency and file-output cautions.

Install the dependencies in a virtual environment and be aware the converter reads the chosen spreadsheet and creates or overwrites a PDF at the default or specified output path. Pinning dependency versions would improve reproducibility.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:103
Finding

Unpinned and Unverified Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103-107
Vulnerability Type: Supply-chain risk from unrestricted dependency resolution
Risk Level: Medium

markdown
## Dependencies

Install once per environment:

```bash
pip install openpyxl reportlab
text

### Technical Analysis

The installation instructions request `openpyxl` and `reportlab` without pinning reviewed versions or verifying distribution hashes. Consequently, installation results can change over time and depend on the package index configured in the user's environment.

No malicious dependency is present in the audited project, and both specified names correspond to established packages. However, the installation procedure lacks controls against a compromised package release, compromised or misconfigured package index, dependency substitution, or unexpected future releases. Installation from a source distribution can also invoke package build components on the local system.

### Attack Path

1. An attacker compromises an upstream dependency release, a transitive dependency, or a package index used by the target environment.
2. The user follows the documented `pip install openpyxl reportlab` command.
3. Because no versions or hashes are enforced, pip resolves and downloads the affected distribution.
4. Malicious code executes during package build or installation, when the dependency is imported, or while spreadsheets are processed.
5. The payload operates with the privileges of the user running pip or the converter.

### Impact Assessment

Successful exploitation could allow arbitrary code execution with the invoking user's privileges. The affected scope could include spreadsheets processed by the Skill, generated documents, files accessible to that account, environment variables, and user-level credentials. If installation is performed from an elevated shell, the impact could extend to system-wide files and configuration. Exploit
...[truncated 162 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin dependency versions that have been reviewed and tested, for example through a committed requirements.txt or lock file.
  2. Generate and verify cryptographic hashes for every direct and transitive dependency, then install with pip install --require-hashes -r requirements.txt.
  3. Resolve dependencies through the official PyPI index or a controlled internal mirror, and prevent fallback to untrusted indexes.
  4. Regularly scan locked dependencies for known vulnerabilities and update them through a reviewed process.
  5. Install and execute the converter inside a dedicated virtual environment or restricted container without administrative privileges.
  6. Prefer reviewed binary wheels where appropriate and disable unexpected source builds in controlled deployments.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.