ClawHub
Back to skill

Security audit

docx-trackdiff

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local DOCX comparison skill, with ordinary cautions around installing an unpinned dependency and processing untrusted Word files.

Reasonable to install for local DOCX redline generation. Prefer a virtual environment, pin `lxml` if reproducibility matters, and avoid running it on untrusted or unusually large DOCX files outside an isolated worker or resource-limited environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:64
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 2. Generate and publish cryptographic hashes for every supported distribution, then require hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lockfile or constraints file to make dependency resolution reproducible. 4. Document installation from the official package index using an explicit index URL where appropriate. 5. Periodically review pinned versions for security advisories and update them through a controlled review process. 6. Prefer installation inside a dedicated virtual environment with no unnecessary access to sensitive files or credentials. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/compare_docx_tracked.py:57
Finding

Unbounded Processing of Attacker-Controlled DOCX Archives

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description says this skill should take two DOCX versions and produce a tracked-changes Word file. The provided code does not implement document comparison or tracked-change generation. Instead, it assumes such an output file already exists and verifies whether that output is well-formed and semantically consistent with the OLD and NEW documents. This is a materially different primary purpose, not merely a supporting internal detail, because the script's core function is validation rather than creation. No clearly malicious or unrelated behavior is present, but the implemented capability does not match the declared end-user function.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
python3 scripts/compare_docx_tracked.py OLD.docx NEW.docx OUT.docx \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
python3 scripts/verify_tracked.py OUT.docx OLD.docx NEW.docx

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

L095-L096 将技能调用描述为自然语言请求“对比一下这两个版本的 docx…”/“Compare these two Word documents with track changes”，但没有给出更明确的触发范围、约束条件或反例。这类描述更像普通对话请求而非严格的调用条件，可能导致代理在相似的日常文档比较场景中意外触发该技能。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest says the skill should produce a file 'as if a human had edited the old file into the new one,' which implies OLD is the base with revisions applied toward NEW. The module docstring instead says 'NEW as base, revisions vs OLD,' while the code description/CLI labels old as base and newer as revised, creating an active contradiction in the skill's own documentation about what transformation is being represented.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/verify_tracked.py (reported line 135)May include surrounding context.

python
# separator; joining with ' ' would insert phantom spaces at run breaks
    deltext = ''.join(t.text or '' for t in tree.iter(qn('w:delText')))
    ndel = normalize(deltext)
    sm = __import__('difflib').SequenceMatcher(a=old_plain, b=new_plain, autojunk=False)
    missing = []
    for tag, i1, i2, j1, j2 in sm.get_opcodes():
        if tag == 'delete':

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file explicitly presents the evaluation in English with a Chinese summary, indicating a fixed language/locale choice. Under the stated policy, forcing specific languages without user opt-in can be a natural-language policy violation, and this evaluation document does not provide a user choice or a region-specific justification for the constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This markdown file contains natural-language instructions for invoking the skill, and it provides fixed example utterances in specific languages as the way to activate it. While not severe, this can be read as prescribing language-specific invocation behavior without explicitly stating that users may choose their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction says to tell the user the file opens in Word's revision view using the Chinese phrase "所有标记". This imposes a specific locale/UI wording and may be incorrect or confusing for users on non-Chinese Word installations, without offering a language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.