ClawHub
Back to skill

Security audit

drawio-to-html

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated converter purpose, but a malicious diagram can make the generated HTML run unwanted browser code.

Review this skill before installing for general use. It is reasonable for trusted personal diagrams, but do not use it on diagrams from untrusted people or publish the generated HTML until the script escapes text and validates style values. Choose output paths deliberately to avoid overwriting files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/drawio2html.py:164
Finding

Stored HTML and SVG Injection Through Unescaped Diagram Content

Content
View full analysis
{e["value"]}') ``` Node labels are also inserted directly into SVG text elements: ```python # Lines 197-202 lines = v['value'].split('\n') line_height = 16 start_y = y + h / 2 - (len(lines) - 1) * line_height / 2 + 5 for idx, line in enumerate(lines): ty = start_y + idx * line_height svg_parts.append(f' {line}') ``` The unescaped diagram name and generated SVG are embedded directly into the final HTML document: ```python # Lines 207-209 html_doc = f''' ``` ```python # Line 234 {diagram_name} ``` ```python # Lines 255-259

{diagram_name}

{svg_content} ``` Style-derived colors are also accepted without a strict allowlist and inserted into SVG attributes: ```python def parse_color(c): """Parse drawio color to CSS color.""" if not c: ...[truncated 3427 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs execution of a local Python script that writes an HTML file, but the manifest declares no explicit tool scope or permission constraints. That mismatch can allow broader-than-expected file write behavior, making it easier for an agent or integration to create or overwrite files in the workspace without clear authorization boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script inserts untrusted diagram_name, vertex text, and edge labels directly into HTML and SVG text nodes without escaping. A crafted .drawio file can break out of the intended context and inject active HTML/JavaScript, causing stored/self-XSS when the generated page is opened or shared.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The generated document hard-codes lang="zh-CN" and uses a Chinese-specific font preference ("PingFang SC") in the default styling. This imposes a specific language/locale choice on all outputs without offering a user option or documenting a justified region-specific requirement.

Content

No source excerpt is available for this finding.