ClawHub
Back to skill

Security audit

Contract Diff

Security checks across malware telemetry and agentic risk

Overview

This contract-diff skill appears purpose-aligned, but it can silently install Python packages and overwrite fixed local filenames during normal use.

Install only if you are comfortable running it in an isolated virtual environment or disposable workspace. Avoid using it on highly confidential contracts unless console output and generated reports are handled securely, and keep backups because helper scripts may overwrite fixed filenames such as template.docx and scanned.pdf.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Content
def try_import(*packages):
    for pkg in packages:
        try:
            __import__(pkg)
        except ImportError:
            os.system(f'pip install {pkg} -q')
Confidence
88% confidence
Finding
__import__(pkg)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
try:
            __import__(pkg)
        except ImportError:
            os.system(f'pip install {pkg} -q')

try_import('python-docx', 'PyMuPDF', 'PIL', 'pytesseract')
Confidence
97% confidence
Finding
os.system(f'pip install {pkg} -q')

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs use of local file reads/writes and shell-invoked tooling (`pip install`, Python scripts, OCR binaries) but does not declare any permissions. Undeclared capabilities are dangerous because they hide the actual trust boundary from the platform and user, increasing the risk of unauthorized file access, document exfiltration, or arbitrary command execution in an agent environment that may auto-grant behavior based on metadata.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
Executing shell commands to install packages at runtime is not justified by the advertised purpose of comparing contracts and generating a report. This creates an unnecessary code-execution and supply-chain risk path on the host, especially in agent environments where skills are expected to process files, not reconfigure the system.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill changes the host environment by installing software, which materially exceeds its declared behavior of document comparison and report generation. In a security review context, this mismatch is significant because it grants the skill persistence-affecting behavior and increases blast radius beyond handling user-provided files.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
Copying user-supplied files onto fixed filenames without checking for preexisting files can silently overwrite prior artifacts in the workspace, causing data loss or cross-run contamination. In an agent skill that processes contracts, this is more dangerous because stale or overwritten inputs can lead to incorrect legal diff results, mixing documents between runs and undermining integrity of the output.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code silently installs packages without user notice or consent, which is unsafe operationally and can surprise users by changing the execution environment. In an agent skill, this is particularly problematic because users may assume the tool only analyzes documents, not performs networked package-management actions.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script processes sensitive contract data and later emits extracted differences directly to stdout, which can leak confidential legal terms into terminal scrollback, orchestration logs, or shared job output. In the context of a contract-comparison skill, this is more dangerous because the inputs are likely to contain proprietary or personal information and users may expect controlled document output rather than raw console disclosure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.