ClawHub
Back to skill

Security audit

Word文档工具（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This Word document skill asks for document read, write, and command capability that fits its stated docx creation and editing purpose.

Install only if you want the agent to read and modify local Word documents. Give explicit file paths, review generated output before overwriting important files, and confirm any delete or cleanup actions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
78% confidence
Finding
The example trigger phrases are very broad and overlap with ordinary user language, increasing the chance that an agent auto-invokes this skill unintentionally. In a skill with read, write, and exec permissions, accidental activation can cause unintended file creation, file reads, or command execution without clear user intent.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation describes create/edit/modify/delete-style operations but does not warn users about file writes or potentially destructive actions. Given the declared write and exec tools, users may not realize the skill can alter or remove local data, which raises the risk of accidental data loss or unsafe filesystem operations.

Static analysis

No suspicious patterns detected.