ClawHub
Back to skill

Security audit

Contract Diff

Security checks for vulnerabilities and agentic risk

Overview

This contract-diff skill appears purpose-aligned, but it can silently install Python packages and overwrite fixed local filenames during normal use.

Install only if you are comfortable running it in an isolated virtual environment or disposable workspace. Avoid using it on highly confidential contracts unless console output and generated reports are handled securely, and keep backups because helper scripts may overwrite fixed filenames such as template.docx and scanned.pdf.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Content
def try_import(*packages):
    for pkg in packages:
        try:
            __import__(pkg)
        except ImportError:
            os.system(f'pip install {pkg} -q')
Confidence
88% confidence
Finding
The code performs dynamic imports over a runtime-supplied package list and couples that behavior to automatic installation when imports fail. While the current list is hardcoded, this pattern weakens supply-chain safety and makes execution behavior depend on host state, which is risky for a document-comparison skill that should not modify its environment.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
try:
            __import__(pkg)
        except ImportError:
            os.system(f'pip install {pkg} -q')

try_import('python-docx', 'PyMuPDF', 'PIL', 'pytesseract')
Confidence
97% confidence
Finding
The script invokes a shell command to run `pip install` during normal execution, which modifies the host environment and introduces a supply-chain execution path. Even with hardcoded package names, this is dangerous because it executes external package installation without review, can pull compromised packages or unexpected versions, and exceeds the expected scope of a contract diff tool.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs use of local file reads/writes and shell-invoked tooling (`pip install`, Python scripts, OCR binaries) but does not declare any permissions. Undeclared capabilities are dangerous because they hide the actual trust boundary from the platform and user, increasing the risk of unauthorized file access, document exfiltration, or arbitrary command execution in an agent environment that may auto-grant behavior based on metadata.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
Executing shell commands to install packages at runtime is not justified by the advertised purpose of comparing contracts and generating a report. This creates an unnecessary code-execution and supply-chain risk path on the host, especially in agent environments where skills are expected to process files, not reconfigure the system.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill changes the host environment by installing software, which materially exceeds its declared behavior of document comparison and report generation. In a security review context, this mismatch is significant because it grants the skill persistence-affecting behavior and increases blast radius beyond handling user-provided files.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
Copying user-supplied files onto fixed filenames without checking for preexisting files can silently overwrite prior artifacts in the workspace, causing data loss or cross-run contamination. In an agent skill that processes contracts, this is more dangerous because stale or overwritten inputs can lead to incorrect legal diff results, mixing documents between runs and undermining integrity of the output.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code silently installs packages without user notice or consent, which is unsafe operationally and can surprise users by changing the execution environment. In an agent skill, this is particularly problematic because users may assume the tool only analyzes documents, not performs networked package-management actions.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script processes sensitive contract data and later emits extracted differences directly to stdout, which can leak confidential legal terms into terminal scrollback, orchestration logs, or shared job output. In the context of a contract-comparison skill, this is more dangerous because the inputs are likely to contain proprietary or personal information and users may expect controlled document output rather than raw console disclosure.

Static analysis

No suspicious patterns detected.