anydocs - Generic Documentation Indexing & Search

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:30 AM UTC
• Version: 1.0.2

Overview

This is a coherent documentation crawler/search skill, but it deserves review because it can crawl arbitrary documentation sites, cache their contents locally, and optionally send browser-rendering requests and tokens through a configurable gateway.

Install only if you are comfortable with a tool that makes outbound requests to configured or supplied documentation URLs and stores scraped text locally. Prefer the virtual environment install, avoid using it on confidential or authenticated docs unless that caching is approved, clear ~/.anydocs/cache when needed, and only use browser rendering with trusted local or HTTPS gateways and protected tokens.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and instructs use of capabilities that imply network access, local file reads/writes, shell execution, and possible environment access, but it declares no permissions at all. This creates a transparency and consent gap: an agent or operator may invoke indexing/configuration assuming a low-risk documentation tool, while the skill can make outbound requests and persist fetched content locally, increasing the chance of unexpected data exposure or unsafe execution context use.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to enable browser-based indexing with a gateway token, but it does not disclose that page contents and accessed URLs may be transmitted through the OpenClaw gateway during rendering. This creates a real security/privacy risk because users may index internal or sensitive documentation under the assumption that processing is local, causing unintended third-party exposure of documentation content or metadata.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill documentation does not clearly warn that indexing and fetch operations will contact arbitrary configured URLs and store retrieved content in a local cache. In this context, users may point the tool at internal documentation or sensitive sites without realizing content will be persisted, which can create privacy, compliance, or data-retention risks even if the feature is expected for a docs indexer.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The fetch command accepts an arbitrary user-supplied URL or path and then performs a live network request via the scraper without a meaningful warning, confirmation, or destination restriction. In a documentation-indexing tool this can cause unintended outbound requests to internal services, localhost, or attacker-controlled hosts, which creates SSRF-like risk and surprise network access in addition to retrieving and displaying untrusted content.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The index command performs bulk discovery, scraping, and local cache writes against configured URLs, but the CLI text does not prominently warn that it will issue many outbound requests and persist scraped content locally. In this skill context, that increases the chance of users unintentionally scraping sensitive or internal sites and storing potentially confidential data on disk.

External Transmission

Medium

• Category: Data Exfiltration

Content

"Content-Type": "application/json"
            }
            
            resp = requests.post(
                f"{self.gateway_url}/tools/invoke",
                json=open_payload,
                headers=headers,

• Confidence: 86% confidence
• Finding: requests.post( f"{self.gateway_url}/tools/invoke", json=

External Transmission

Medium

• Category: Data Exfiltration

Content

}
            }
            
            resp = requests.post(
                f"{self.gateway_url}/tools/invoke",
                json=snapshot_payload,
                headers=headers,

• Confidence: 84% confidence
• Finding: requests.post( f"{self.gateway_url}/tools/invoke", json=

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: requests==2.31.0

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: python-dotenv==1.0.0

Known Vulnerable Dependency: lxml==4.9.3 — 2 advisory(ies): CVE-2026-41066 (lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to); CVE-2026-41066 (lxml is a library for processing XML and HTML in the Python language. Prior to 6)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: lxml==4.9.3

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.