ClawHub
Back to skill

Security audit

dianju-ofd-tools

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent document-conversion purpose, but its setup asks users to run an unpinned external package and send credentials/documents to an HTTP API without adequate safeguards.

Review this carefully before installing. Use only a trusted `dianju-ofd-tools` package version from a trusted registry, prefer a pinned version, use HTTPS endpoints only, avoid putting real APP_KEY values directly in shared commands or logs, and do not process sensitive documents unless the API service is approved for that data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:12
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Supply-chain exposure caused by unpinned package execution
Risk Level: High

Vulnerable Code

bash
npx dianju-ofd-tools --APP_ID=xxx --APP_KEY=xxx --API_URL=http://ip:port/DCS

Technical Analysis

The Quick Start command instructs users to execute dianju-ofd-tools through npx without specifying an exact package version, integrity hash, lockfile, or trusted registry. Depending on the local npm configuration and cache state, npx may retrieve the current package release from the configured registry and execute it immediately.

The package implementation is not present in the audited project, which contains only SKILL.md. Therefore, the executable package and its transitive dependencies could not be statically verified. Their effective behavior can also change after this Skill has been reviewed.

This creates a supply-chain trust boundary: compromise of the publisher account, npm package, configured registry, or a transitive dependency could turn the documented command into arbitrary local code execution.

Attack Path

  1. An attacker compromises the package publisher, registry, or a dependency used by dianju-ofd-tools.
  2. The attacker publishes a malicious version under the same package name.
  3. A user follows the documented Quick Start command without specifying a version.
  4. npx retrieves and executes the attacker-controlled package.
  5. The malicious package runs with the invoking user's operating-system privileges.
  6. It may access the supplied credentials, selected documents, environment variables, and other resources available to that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. The accessible scope may include local files readable or writable by that user, the supplied APP_ID and APP_KEY, documents selected for conv ...[truncated 163 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the package to an exact reviewed version, such as dianju-ofd-tools@X.Y.Z; do not use a floating version range.
  • Install dependencies through a committed lockfile and use reproducible installation mechanisms such as npm ci.
  • Verify package integrity and provenance, including registry source, publisher identity, signatures or attestations where available, and expected integrity hashes.
  • Document the official source repository and trusted npm registry.
  • Run the package in a restricted environment with only the minimum filesystem and network access required.
  • Continuously scan the package and its transitive dependencies for malicious releases and known vulnerabilities.
  • Require a new security review before updating the pinned package version.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:12
Finding

Sensitive Credentials and Documents May Be Transmitted Over Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-19
Vulnerability Type: Plaintext transmission and unsafe command-line handling of sensitive information
Risk Level: High

Vulnerable Code

bash
npx dianju-ofd-tools --APP_ID=xxx --APP_KEY=xxx --API_URL=http://ip:port/DCS
text
APP_ID：appid

APP_KEY：appkey

API_URL：The system API address

Technical Analysis

The only Quick Start example configures the service with an http:// endpoint while also passing an application identifier and application key. The documented features process local PDF and OFD files through a network service and return extracted content or temporary download links.

If the implementation sends these values or document data to the configured endpoint without an additional protected transport layer, plaintext HTTP does not provide confidentiality, server authentication, or transport integrity. A network-positioned attacker could observe or modify credentials, document data, conversion responses, extracted content, or temporary download URLs.

Supplying APP_KEY as a command-line argument creates an additional local exposure risk. Command arguments may be retained in shell history, terminal logs, troubleshooting records, or process metadata available to other appropriately privileged local users. The documentation also describes optional file logging but does not require secret redaction.

Attack Path

  1. A user follows the Quick Start example and configures an HTTP service endpoint.
  2. The user supplies a real APP_ID and APP_KEY, then submits a local PDF or OFD document for processing.
  3. A network-positioned attacker observes or modifies traffic between the client and service.
  4. The attacker captures credentials, document content, extracted text, or a temporary download URL, or substitutes a malicious response.
  5. Captured credentials may be reused against the service within their granted author ...[truncated 702 chars]
Remediation
View remediation

Remediation Suggestions

  • Require HTTPS for all API endpoints and reject plaintext HTTP by default.
  • Enforce certificate and hostname validation; do not provide an option that silently disables TLS verification.
  • Replace the documentation example with an https:// endpoint.
  • Pass secrets through a protected credential store, restricted configuration file, or environment-based secret mechanism instead of command-line arguments.
  • Scope credentials to the minimum required permissions, rotate them regularly, and support immediate revocation.
  • Redact APP_KEY, authorization headers, document contents, and temporary URLs from console and file logs.
  • Explicitly disclose that selected documents are transmitted to the configured service and document its retention, deletion, and access-control policies.
  • Protect temporary download URLs with short expiration periods, strong unguessable tokens, and authorization checks where supported.
  • Add client-side endpoint validation and warn or fail when an insecure scheme is supplied.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The quick-start exposes APP_ID, APP_KEY, and an example API_URL using plain HTTP without warning users to protect credentials or require secure transport. This can lead to credential leakage through shell history, logs, screenshots, or interception in transit if HTTP is used, enabling unauthorized API access and potential document exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to execute an unpinned package via npx, which will fetch and run the latest published version at execution time. This creates a supply-chain risk: if the package is updated maliciously or compromised upstream, users may execute attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation describes converting and extracting content from local files through an API endpoint but does not clearly warn that document contents may be transmitted to an external service. Because these tools operate on local PDFs/OFDs, users may inadvertently send sensitive documents off-host, causing confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.