Security audit

Zerox

Security checks for vulnerabilities and agentic risk

Overview

This document-conversion skill is coherent, but needs review because it sends documents through a third-party API path, reads a shared credential file as a fallback, and has a macOS notification bug that can run unintended commands from crafted filenames.

Review before installing. Use it only for documents you are comfortable sending to a remote AI provider and the APIYI intermediary, prefer an explicitly supplied APIYI_API_KEY over a shared credential file, avoid background conversion on untrusted filenames on macOS, and pin or audit the zerox dependency before relying on it for sensitive files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/convert-bg.mjs:67
Finding: AppleScript Injection Through an Attacker-Controlled Filename
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: README.md:7
Finding: Document and Credential Traffic Redirected Through a Third-Party API Intermediary
Content: View full analysis
> ~/.openclaw/.env ``` ### Technical Analysis The installation procedure directs users to modify code under `node_modules` so that OpenAI-compatible requests are sent through `api.apiyi.com`. This changes the behavior of a legitimate third-party library after installation and makes the effective data destination dependent on an undocumented local patch. The Skill processes potentially sensitive PDFs, office documents, and images using a remote vision model. Consequently, document data and the configured authorization credential are exposed to the intermediary. The Skill declaration describes GPT-4o vision but does not clearly explain in its primary usage documentation that document content will be handled by this specific intermediary or describe its privacy and retention properties. Manually modifying an installed provider implementation also prevents straightforward verification of the dependency's effective behavior and can be overwritten by subsequent package installations. ### Attack Path 1. A user installs the Zerox dependency. 2. Following the README, the user modifies the dependency's provider endpoint to `https://api.apiyi.com/v1`. 3. The user stores an APIYI credential in the shared OpenClaw environment file. 4. The user invokes the converter on a local document. 5. Zerox processes the document through the modified OpenAI-compatible endpoint. 6. The third-party intermediary receives the authorization credential and document-derived request data. 7. Any compromise, unexpected retention policy, o ...[truncated 666 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/convert.mjs:40
Finding: Unnecessary Read Access to the Shared OpenClaw Credential File
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:1
Finding: Unpinned Security-Sensitive Dependency Without a Lockfile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 14)May include surrounding context.
配置apiKey

这里配置的是API易的apiKey

sh
echo 'APIYI_API_KEY = sk-xxx' >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/convert.mjs (reported line 57)May include surrounding context.
js
### 配置apiKey 这里配置的是API易的apiKey ```sh echo 'APIYI_API_KEY = sk-xxx' >> ~/.openclaw/.env ```

Credential Access

High

Category: Privilege Escalation
Confidence: 78% confidence
Finding: This finding corresponds to the code path that intentionally looks for API credentials outside the immediate execution environment. While it appears to be for service authentication rather than exfiltration, accessing ~/.openclaw/.env is still credential access behavior that is unnecessary to perform basic file handling and increases exposure of local secrets.
Content: Scanner excerpt · scripts/convert.mjs (reported line 40)May include surrounding context.
js
process.exit(1); } // Read API key from ~/.openclaw/.env if not in environment let apiKey = (process.env.APIYI_API_KEY ?? "").trim(); if (!apiKey) {

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: At this line the script constructs a path to ~/.openclaw/.env and reads it directly, which is a concrete credential-access operation. Even if the intent is convenience, direct reading of a secrets file by a skill broadens trust requirements and could enable unauthorized use of stored API keys.
Content: Scanner excerpt · scripts/convert.mjs (reported line 45)May include surrounding context.
js
if (!apiKey) { try { const envPath = path.join(process.env.HOME || "~", ".openclaw", ".env"); const envContent = fs.readFileSync(envPath, "utf-8"); const match = envContent.match(/APIYI_API_KEY\s*=\s*(.+)/); if (match) {

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to alter a dependency so document contents and API requests are sent through a third-party proxy endpoint rather than the original provider path. For a document-conversion skill, this materially changes the trust boundary: potentially sensitive documents and prompts may be transmitted to an external intermediary with unknown security, retention, and access controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Directing users to modify dependency source code to reroute traffic to a third-party endpoint bypasses normal package integrity and update expectations, and does so without warning about the security consequences. This creates supply-chain and transparency risks because users may unknowingly process sensitive documents through an intermediary outside the documented behavior of the original library.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The documented endpoint indicates that document-processing data may be transmitted to an external service. In the context of a skill advertised as converting local documents to Markdown, external transmission is more dangerous because users may provide confidential PDFs, DOCX files, or scanned records without realizing they are leaving the local environment.
Content: Scanner excerpt · README.md (reported line 9)May include surrounding context.
md
npm install zerox --ignore-scripts ### 修改zerox源码由于直连zerox只支持国外的几个模型厂商，直连连不上，所以需要用中转商，这里用的是API易，需要把node_modules目录下的zerox源码的openAI.js文件中的API端点地址改为 https://api.apiyi.com/v1 ### 配置apiKey 这里配置的是API易的apiKey

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README tells users to place an API key into a local env file but provides no guidance on file permissions, secret rotation, avoiding source control exposure, or use of a secure secret store. While not immediate exfiltration on its own, this encourages weak credential hygiene that can lead to accidental disclosure or misuse of the proxy account.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes Node scripts and requires an environment variable containing an API key, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens the trust boundary for the skill, making its runtime capabilities less transparent to users and policy enforcement, and can lead to unintended access to sensitive environment data or code execution pathways.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill processes user-supplied documents with GPT-4o vision via an external AI API, but the description does not clearly warn that document contents will be transmitted off-box to a third-party service. This creates a significant data privacy and compliance risk because users may submit sensitive files without informed consent, especially given the skill's broad support for PDFs, DOCX, PPTX, and images.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes a document-to-Markdown conversion skill for text extraction. While spawning the converter itself is an expected implementation detail, invoking osascript to execute AppleScript and interact with the host notification system adds an unrelated system-automation capability outside the declared document-processing purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script reads an API key from ~/.openclaw/.env when the environment variable is absent, which expands its access to sensitive local credential material beyond the immediate user input and declared document path. For a document-conversion skill, silently probing a home-directory secrets file is risky because it normalizes credential harvesting behavior and can expose credentials to code paths or logs that were not expected by the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script sends the provided document to an external model provider through zerox/OpenAI without any explicit user-facing notice or consent prompt about off-device transmission. This is dangerous because users may supply sensitive PDFs, DOCX, or images expecting local conversion, causing confidential content to be disclosed to a third party unintentionally.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: The dependency uses a caret range (^1.1.20), which allows automatic installation of newer compatible versions instead of a single reviewed version. This increases supply-chain risk because future package releases could introduce malicious code, vulnerable transitive dependencies, or breaking behavior without an explicit update review. In a document-conversion skill that processes untrusted files, dependency trust is more security-sensitive than in a purely local utility.
Content: Scanner excerpt · package.json (reported line 3)May include surrounding context.
json
{ "dependencies": { "zerox": "^1.1.20" } }

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/convert-bg.mjs:56

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T07 · Tool Hijacking and Spoofing

T05 · Unauthorized Access and Privilege Escalation

T08 · Insecure Dependencies

SkillSpector

Credential Access

配置apiKey

Credential Access

Credential Access

Credential Access

Context-Inappropriate Capability

Missing User Warnings

External Transmission

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

Unpinned Dependencies

Static analysis

Shell command execution detected (child_process).