ClawHub
Back to skill

Security audit

Paperless Api

Security checks for vulnerabilities and agentic risk

Overview

This Paperless-ngx upload skill does what it says, but it uses unsafe defaults for sending documents and API tokens.

Review before installing. Only use this with a Paperless-ngx server you control, prefer HTTPS with valid certificate verification, avoid placing real API keys directly in command history or shared prompts, and do not upload sensitive documents unless you have confirmed the destination and transport security.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/upload_document.py:34
Finding

TLS Certificate Verification Disabled for Sensitive Uploads

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/upload_document.py:56
Finding

Plaintext HTTP Permitted and Recommended for Credential and Document Transmission

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upload_document.py:57
Finding

API Token Exposed Through Command-Line Arguments and Documentation

Content
View full analysis
`. 2. The shell records the command in history, an automation platform logs it, or another authorized local user inspects process arguments while the script is running. 3. A person or process with access to that record recovers the token. 4. The token is submitted to the configured Paperless-ngx API. 5. The attacker performs operations allowed by the token until it is revoked or expires. This path requires access to local process information, history, or operational logs and is therefore generally less direct than network interception. ### Impact Assessment Disclosure grants the recip ...[truncated 397 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script uploads document contents and sends an API token while explicitly disabling TLS certificate verification. In the context of a document-management skill, this is especially dangerous because it can expose sensitive documents and credentials to man-in-the-middle interception or server impersonation on untrusted networks.

Content

No source excerpt is available for this finding.

Tainted flow: 'files' from open (line 15, file read) → requests.post (network output)

High
Category
Data Flow
Confidence
80% confidence
Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · scripts/upload_document.py (reported line 35)May include surrounding context.

python
data["document_type"] = document_type

    try:
        response = requests.post(url, headers=headers, files=files, data=data, verify=False) # verify=False for self-signed certs
        response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
        print("Document uploaded successfully!")
        print(response.json())

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill documents and enables network-capable behavior against a remote Paperless-ngx instance, but it does not declare any tool scope or permission boundaries. That omission can cause users or agents to invoke network actions without clear policy constraints, increasing the risk of unintended data transfer to external or misconfigured hosts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation instructs users to provide a host URL and API key for document upload without warning that local file contents and credentials will be transmitted to a remote service. In this context, the skill's core function is exfiltration-capable by design, so missing disclosure and trust-boundary guidance materially increases the chance of sensitive document or credential leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The example command includes an API key inline and demonstrates uploading a local file to a remote host without any secret-handling or data-transfer warning. This encourages unsafe operator behavior, including leaking secrets through shell history, logs, screenshots, and AI-visible command context while simultaneously transmitting document contents off-host.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Embedding a full API key directly in the example shell command is dangerous because shell commands are commonly retained in terminal history, process listings, CI logs, chat transcripts, and screenshots. In the context of a document-upload skill, compromise of that key can enable unauthorized access to the Paperless-ngx instance and abuse of document-management operations.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
99% confidence
Finding

Using verify=False disables server certificate validation, making HTTPS connections vulnerable to interception and spoofing. Because this skill handles both confidential document contents and an authentication token, the unsafe default materially increases the risk of credential theft and unauthorized document disclosure.

Content

Scanner excerpt · scripts/upload_document.py (reported line 35)May include surrounding context.

python
data["document_type"] = document_type

    try:
        response = requests.post(url, headers=headers, files=files, data=data, verify=False) # verify=False for self-signed certs
        response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
        print("Document uploaded successfully!")
        print(response.json())

Ssd 3

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

Including a realistic-looking concrete API key in documentation normalizes pasting secrets directly into prompts, config files, and commands. Even if the sample key is not live, this pattern trains insecure handling practices and can lead users to expose real credentials in places that are logged or shared.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The inline comments describe behavior where Paperless-ngx would create missing tags or associate existing ones by name, and suggest document type naming support, but the code does not perform any API lookup, creation, or translation to IDs. This is an intent/documentation mismatch that could mislead users about what the script actually guarantees.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.