ClawHub
Back to skill

Security audit

AI-Powered Markdown to Word Converter (LaTeX, Mermaid & Auto Formatting)

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it converts Markdown to Word by uploading the user-provided file to md2word.com, with no evidence of hidden persistence, credential access, or unrelated behavior.

Install only if you are comfortable sending Markdown document contents to md2word.com for conversion. Avoid using it for confidential, regulated, or proprietary documents unless you have reviewed that service's privacy practices; the publisher should also update the pinned requests dependency.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly uploads user-provided Markdown files to an external website for processing, but the description does not warn users that their files leave the local/trusted environment. This creates a real privacy and data-handling risk because users may submit sensitive content without informed consent, and the third-party service may retain, inspect, or further process uploaded data.

Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium
Category
Supply Chain
Confidence
98% confidence
Finding
The file pins requests to version 2.31.0, which is flagged by multiple advisories including credential leakage via malicious URLs and request verification issues. Even though requirements.txt alone does not prove the vulnerable code paths are exercised, shipping a dependency with known CVEs is a real supply-chain risk because any downstream use of requests in the skill could expose secrets, weaken TLS/request validation behavior, or otherwise inherit the vulnerable behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script uploads the user-supplied Markdown file to md2word.com, a third-party service, without an explicit consent prompt or warning that local content will leave the system. Markdown often contains sensitive notes, internal documentation, embedded links, or proprietary text, so silent transmission creates a real confidentiality and data-handling risk.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
The skill hardcodes use of the English locale endpoint `https://md2word.com/en`, while the document itself is bilingual and does not explain why the English locale is required or offer any locale choice. This can be a natural-language policy issue because it imposes a specific locale without documented user opt-in or justification.

Natural-Language Policy Violations

Low
Confidence
85% confidence
Finding
The Accept-Language header is hard-coded to 'en-US,en;q=0.5', which imposes a specific language/locale preference. There is no user choice, opt-in, or documented reason for restricting the interaction to English.

Static analysis

No suspicious patterns detected.