ClawHub
Back to skill

Security audit

Word Template Filler

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does local Word-template parsing and filling, but it tells the agent to upload generated documents to a public link by default, which can expose sensitive document contents.

Install only if you are comfortable reviewing each generated document before any upload. For contracts, personal data, financial terms, or proprietary content, keep outputs local unless you explicitly choose a trusted private sharing method. Pinning the python-docx dependency would also reduce supply-chain drift.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:61
Finding

Generated Documents Are Uploaded Through a Public Download Link by Default

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-63
Vulnerability Type: Unnecessary external disclosure of generated documents
Risk Level: Medium

Vulnerable Instruction

English rendering of the relevant source instruction:

markdown
### 4. Upload and return a link

Use the `uploader` skill to upload the generated file and return a public download link.

Technical Analysis

The documented workflow directs the agent to upload every completed document through another skill and return a public download link. Uploading is not required for the core local task of parsing and filling a DOCX file.

Generated documents may contain contracts, personal identities, commercial terms, or other confidential information supplied by the user. The instruction does not require informed consent before transmission and does not identify the storage provider, access controls, retention period, deletion process, or link-discovery protections.

This breaks least-privilege principles by introducing external data transmission and public accessibility beyond what is necessary to generate the document.

Attack Path

  1. A user supplies a template and sensitive replacement data.
  2. The agent generates a completed DOCX containing that information.
  3. Following SKILL.md, the agent invokes the external uploader skill.
  4. The completed document is transmitted to an unspecified external service.
  5. A public download link is created.
  6. Anyone who obtains or discovers the link may access the document, depending on the uploader's controls.

Impact Assessment

This issue does not directly grant local system privileges. Its primary impact is unauthorized disclosure of the complete generated document to an external provider or unintended recipients. The affected scope includes all user data embedded in the output file, potentially including personal, contractual, financial, or proprietary information.

Remediation
View remediation

Remediation Suggestions

  • Save generated documents locally by default.
  • Require explicit, informed user consent before invoking any uploader.
  • Clearly identify the upload destination, retention policy, access model, and deletion procedure.
  • Prefer private, authenticated, short-lived download links over public links.
  • Warn users before transmitting documents that may contain sensitive information.
  • Apply data minimization and avoid uploading intermediate files or unnecessary metadata.
  • Provide a local-file return option so upload is never mandatory for successful completion.

T08 · Insecure Dependencies

Note
Location
SKILL.md:80
Finding

Runtime Dependency Installation Uses an Unpinned Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 80-90
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Instruction

bash
# Create the virtual environment once
python3 -m venv /root/.openclaw/workspace/skills/word-template-filler/.venv

# Install the dependency
/root/.openclaw/workspace/skills/word-template-filler/.venv/bin/pip install python-docx

# Use the virtual environment afterward
/root/.openclaw/workspace/skills/word-template-filler/.venv/bin/python scripts/parse_template.py <file>

Technical Analysis

The setup procedure installs python-docx without a pinned version, lockfile, package hash, or explicitly approved package index. Consequently, the resolved package artifact can change between installations, making the environment non-reproducible.

Although the audited project contains no evidence that python-docx is currently malicious or typo-squatted, an unpinned installation may acquire a vulnerable or compromised future release. Python package installation can also execute package-controlled build or installation behavior when applicable.

Attack Path

  1. The skill is used in an environment where its dependency has not yet been installed.
  2. The documented setup command runs pip install python-docx.
  3. Package resolution selects the latest version available from the configured package index at that time.
  4. If the selected release or package source has been compromised, malicious installation behavior or vulnerable runtime code enters the skill environment.
  5. Subsequent template parsing and filling operations execute using that dependency.

Impact Assessment

The immediate audited code does not establish compromise. If dependency resolution later retrieves a malicious package artifact, the package could execute with the privileges of the user running pip or the scripts. The potential scope includes files ...[truncated 142 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin python-docx to a reviewed, exact version.
  • Maintain dependencies in a version-controlled requirements or lock file.
  • Record and verify package hashes, such as through pip's --require-hashes option.
  • Configure an approved HTTPS package index rather than relying on unspecified environment configuration.
  • Scan pinned dependencies for known vulnerabilities and update them through a controlled review process.
  • Build the environment during deployment instead of performing mutable first-use installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

描述中的核心卖点之一是“AI生成主题内容并填充模板”，但代码只根据外部传入的 values JSON 做机械替换，没有模型调用、内容生成、主题理解或自动补全能力。此外，描述提到“批量生成”，而代码的命令行接口一次只处理一个 docx 文件，未体现批量遍历、多文件输出或任务队列等逻辑。其余部分——处理 Word 模板、识别 {{}} 占位符、生成新文档——与代码基本一致。因此存在能力夸大/行为不符，属于描述与实际行为不完全匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

声明描述的是一个完整的Word模板智能填充/文档生成工具，其核心能力应包括解析占位符、生成内容并回填到模板生成文档。而实际代码只是一个占位符提取器，功能范围明显更窄，仅负责读取Word文档并识别{{}}占位符，输出JSON结果。虽然“解析占位符”与声明的一部分一致，但缺失了声明中的主要能力，因此描述与实际行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs uploading generated Word documents and returning a public download link, but it provides no warning, consent check, or sensitivity review. Because the documented use cases include contracts, invitations, and other potentially sensitive business documents, this can lead to unintended public disclosure of confidential or personal information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.