ClawHub
Back to skill

Security audit

Wisely Read PPT

Security checks for vulnerabilities and agentic risk

Overview

This skill does the document conversion it advertises, but it can automatically change the local Python/system environment in ways users should review first.

Install only if you are comfortable with the skill running local conversion tools and writing extracted document content into DOCX, JSON, image, and asset directories. Prefer running it in a virtual environment or container, preinstall reviewed dependencies, use --no-install during parsing, and review any LibreOffice/PATH setup commands before allowing them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/parse.py:57
Finding

Automatic Installation of Unpinned Python Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose is document parsing, but the skill also instructs the agent to auto-install software and Python packages, probe the local environment, persist host configuration in local-env.json, and spawn subagents with inherited sandbox context. Those side effects materially exceed a typical 'convert PPT/PDF to docx' expectation and can lead to unauthorized system modification, data exposure, or execution of untrusted tooling on the host.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/parse.py (reported line 169)May include surrounding context.

python
# 隔离 profile 避免并发锁冲突
        lo_profile = f"file:///tmp/lo_profile_{os.getpid()}"
        # 清除 LibreOffice 内嵌 Python 的路径警告
        lo_env = os.environ.copy()
        lo_env.pop("PYTHONHOME", None)
        lo_env.pop("PYTHONPATH", None)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README states that Python dependencies are installed automatically, but does not warn users that running the skill may modify the local environment. Automatic package installation can unexpectedly change interpreter state, pull unpinned or compromised packages, and violate least-surprise expectations in shared or sensitive environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill requests and documents broad capabilities including shell execution, file read/write, and environment inspection, but it does not declare any explicit tool scope or permission boundary. That makes the effective privilege surface ambiguous and increases the chance the agent will execute installs, conversions, and file operations beyond what a user would reasonably expect from a document-parsing skill.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference/macos-install.md (reported line 3)May include surrounding context.

md
# macOS LibreOffice 安装指南

> 当 `brew install --cask libreoffice` 不可用（无 Homebrew、sudo 被拒、沙盒环境）时，使用本指南的无 sudo 方案。

## 方案 A：Homebrew（推荐，需要已安装 brew）

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

安装后 soffice 通常已在 PATH 中。如不在：

bash
sudo ln -sf "/Applications/LibreOffice.app/Contents/MacOS/soffice" /usr/local/bin/soffice

方案 B：无 sudo 安装（无 Homebrew 或 sudo 被拒）

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference/macos-install.md (reported line 15)May include surrounding context.

安装后 soffice 通常已在 PATH 中。如不在：

bash
sudo ln -sf "/Applications/LibreOffice.app/Contents/MacOS/soffice" /usr/local/bin/soffice

方案 B：无 sudo 安装（无 Homebrew 或 sudo 被拒）

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference/macos-install.md (reported line 18)May include surrounding context.

安装后 soffice 通常已在 PATH 中。如不在：

bash
sudo ln -sf "/Applications/LibreOffice.app/Contents/MacOS/soffice" /usr/local/bin/soffice

方案 B：无 sudo 安装（无 Homebrew 或 sudo 被拒）

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference/macos-install.md (reported line 78)May include surrounding context.

安装后 soffice 通常已在 PATH 中。如不在：

bash
sudo ln -sf "/Applications/LibreOffice.app/Contents/MacOS/soffice" /usr/local/bin/soffice

方案 B：无 sudo 安装（无 Homebrew 或 sudo 被拒）

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference/macos-install.md (reported line 89)May include surrounding context.

安装后 soffice 通常已在 PATH 中。如不在：

bash
sudo ln -sf "/Applications/LibreOffice.app/Contents/MacOS/soffice" /usr/local/bin/soffice

方案 B：无 sudo 安装（无 Homebrew 或 sudo 被拒）

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference/macos-install.md (reported line 38)May include surrounding context.

bash
hdiutil attach ~/Downloads/LibreOffice.dmg -nobrowse
mkdir -p ~/Applications
cp -R "/Volumes/LibreOffice/LibreOffice.app" ~/Applications/
hdiutil detach "/Volumes/LibreOffice"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file is natural-language guidance for operating the skill, and all instructions, templates, and required status strings are fixed in Chinese. Because the file does not provide an opt-in, language alternative, or justification for a Chinese-only workflow, it creates a language/locale policy concern under the rule for forced language without user choice.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/parse.py (reported line 45)May include surrounding context.

python
("pdfplumber", "pdfplumber"), ("docx", "docx"),
                     ("pytesseract", "pytesseract"), ("PIL", "PIL")]:
        try:
            __import__(mod); env[key] = True
        except Exception:
            pass
    return env

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Auto-installing Python packages at runtime is unnecessary for a PPT/PDF parsing skill and causes code from external repositories to be installed and executed in the current environment. This creates avoidable supply-chain risk and can unexpectedly alter the host system, especially because the behavior is enabled by default.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

The script performs runtime pip installs automatically, including a fallback to --break-system-packages, without explicit user confirmation. This expands the skill's behavior from document parsing into modifying the Python environment and fetching code from package repositories, which can lead to unwanted package installation, environment corruption, or supply-chain exposure.

Content

Scanner excerpt · scripts/parse.py (reported line 75)May include surrounding context.

python
]
    for base in pip_cmds:
        try:
            r = subprocess.run(base + pkgs,
                               stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                               timeout=180)
            if r.returncode == 0:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script launches pip installs without prior confirmation or an in-file safety warning, so simply running the parser can trigger network access and package changes. In a skill context this is dangerous because users expect file conversion, not silent software installation with elevated package-management side effects.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/parse.py (reported line 149)May include surrounding context.

python
def _run_cmd(cmd, timeout=120, env=None, **kw):
    """运行子进程,带 timeout。"""
    try:
        return subprocess.run(cmd, timeout=timeout, env=env, **kw)
    except subprocess.TimeoutExpired:
        print(f"       -> 命令超时 ({timeout}s): {' '.join(str(c) for c in cmd[:4])}...")
        return None

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README presents all operational instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. This can violate a language/locale policy when a specific language is imposed without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file instructs the user to create symlinks in ~/.local/bin and append to ~/.zshrc or ~/.zshenv, which are persistent changes to the user's environment and shell configuration. While the commands are shown, the document does not include an explicit caution that these steps alter login behavior and PATH for future shells.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

L183-L190 的模板先以 <!-- 开始注释，但在 L189 使用了 --> 结束后，前一行 L188 也已包含 -->，导致注释边界自相矛盾。该段上文又明确要求“状态：初稿（待主代理复核）”，因此模板实现会让文档消费者对哪些内容属于注释、状态是否仍为待复核产生歧义，属于文档意图与实际模板格式不一致。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This code saves screenshots, extracted images, and extracted text JSON to the filesystem, and later saves a generated DOCX. Although file generation is part of the parser's functionality, the file lacks a clear user-facing warning near these operations that source document contents will be copied into persistent output files and asset directories.

Content

No source excerpt is available for this finding.