ClawHub
Back to skill

Security audit

Yq Minimax Docx

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a DOCX document tool, but its setup and template handling need review because they can run unverified installers, change shell startup files, and preserve external links.

Install only if you are comfortable reviewing and running the setup script yourself. Prefer installing .NET, pandoc, and LibreOffice through trusted system package workflows first, avoid running setup.sh as root, check $HOME/.bashrc after setup, and use trusted DOCX templates or inspect generated files for external links before sharing them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/setup.sh:103
Finding

Setup Downloads and Executes an Unverified Remote Installer

Content
View full analysis
/dev/null 2>&1; then info "Adding Microsoft package repository..." sudo apt-get update -qq sudo apt-get install -y -qq wget apt-transport-https wget -q "https://dot.net/v1/dotnet-install.sh" -O /tmp/dotnet-install.sh chmod +x /tmp/dotnet-install.sh /tmp/dotnet-install.sh --channel 8.0 --install-dir "$HOME/.dotnet" export PATH="$HOME/.dotnet:$PATH" echo 'export PATH="$HOME/.dotnet:$PATH"' >> "$HOME/.bashrc" fi ;; # ... none) if [ "$OS" = "windows-git-bash" ]; then fail "On Windows, install .NET SDK from: https://dotnet.microsoft.com/download" fail "Then restart your terminal and re-run this script." return 1 fi # Fallback: use Microsoft install script info "Using Microsoft install script..." wget -q "https://dot.net/v1/dotnet-install.sh" -O /tmp/dotnet-install.sh || \ curl -sSL "https://dot.net/v1/dotnet-install.sh" -o /tmp/dotnet-install.sh chmod +x /tmp/dotnet-install.sh /tmp/dotnet-install.sh --channel 8.0 --install-dir "$HOME/.dotnet" export PATH="$HOME/.dotnet:$PATH" echo 'export PATH="$HOME/.dotnet:$PATH"' >> "$HOME/.bashrc" ;; ``` ### Technical Analysis The setup process retrieves executable shell code from a mutable external URL and immediately runs it. It does not pin a specific installer artifact or validate a cryptographic checksum or signature before execution. HTTPS protects transport under normal conditions, but it does not protect against compromise of the upstream endpoint, its publishing infrastructure, or an incorrectly trusted certificate authority. The installer is also writte ...[truncated 2264 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/setup.sh:112
Finding

Setup Persistently Prepends a User-Writable Directory to PATH

Content
View full analysis
> "$HOME/.bashrc" ``` The same code appears in both .NET installation branches. ### Technical Analysis The setup script modifies `$HOME/.bashrc` automatically and without explicit user consent. The inserted command prepends `$HOME/.dotnet` to `PATH` for future interactive shell sessions. Because this directory is writable by the user, any executable placed there with the same name as a subsequently invoked command can take precedence over system binaries. The modification is not idempotent: every applicable setup run appends another identical line. The script does not mark a managed block, check for an existing entry, create a backup, or offer rollback behavior. This is not evidence of a malicious backdoor or scheduled persistence mechanism. It is an insecure setup practice because it makes a lasting change to command resolution outside the immediate document-processing operation. ### Attack Path 1. The user runs setup and the script appends the PATH modification to `$HOME/.bashrc`. 2. A later compromise, malicious package, or other process with write access to the user account places a spoofed executable in `$HOME/.dotnet`. 3. The user starts a new Bash session, activating the prepended path. 4. When the user invokes a command whose name matches the spoofed executable, the shell resolves the attacker-controlled file first. 5. The spoofed executable runs with the user’s privileges. This finding does not independently allow an unprivileged external attacker to write to `$HOME/.dotnet`; exploitation requires an existing ability to place a file in the user-owned directory or compromise the installation process. ### Impact Assessm ...[truncated 397 chars]
Remediation
View remediation
> "$HOME/.bashrc" fi ``` 4. Back up the profile before editing it and provide an uninstall or rollback command. 5. Verify that `$HOME`, `$HOME/.dotnet`, and installed executable files have expected ownership and restrictive permissions. 6. Consider invoking the installed .NET binary through an explicit path rather than modifying the global executable search order. 7. If PATH modification is retained, append rather than prepend where feasible, reducing the chance of shadowing trusted system utilities. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dotnet/MiniMaxAIDocx.Core/Commands/ApplyTemplateCommand.cs:256
Finding

Template Application Blindly Preserves Untrusted External Relationships

Content
View full analysis
/// Copies sub-relationships (images, etc.) from a source part to a target part. /// private static void CopyPartRelationships(OpenXmlPart source, OpenXmlPart target) { foreach (var rel in source.ExternalRelationships) { target.AddExternalRelationship(rel.RelationshipType, rel.Uri, rel.Id); } foreach (var childPart in source.Parts) { try { var contentType = childPart.OpenXmlPart.ContentType; if (contentType.StartsWith("image/")) { var newChild = target.AddNewPart(contentType, childPart.RelationshipId); using var stream = childPart.OpenXmlPart.GetStream(FileMode.Open, FileAccess.Read); newChild.FeedData(stream); } } catch (Exception ex) { Console.Error.WriteLine($"[WARN] Skipped non-image embedded part: {ex.Message}"); } } } ``` ### Technical Analysis `CopyPartRelationships` copies every external relationship from a template header or footer part into the generated document. It does not validate: - The relationship type. - The URI scheme. - The destination host. - Whether the relationship is necessary for formatting. - Whether external access was authorized by the user. The surrounding template logic copies the header or footer XML before copying its relationships, preserving references to those relationship IDs. Consequently, an attacker-controlled template can cause the output document to retain external hyperlinks or externally referenced resources. Depending on relationship type and Microsoft Word security settings, external content may be resolved w ...[truncated 2121 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (121)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a comprehensive DOCX authoring/editing/formatting skill built on OpenXML SDK in .NET, with three explicit pipelines and broad triggers for producing formal Word documents. The supplied code does something much narrower and materially different: it is a shell wrapper around LibreOffice for converting an existing .doc file to .docx. This is not a supporting implementation detail of the declared behavior; it is a distinct primary purpose. The code neither creates documents, edits content, fills forms, applies templates, nor validates against XSD, and it relies on soffice rather than OpenXML SDK/.NET. Therefore the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a comprehensive DOCX creation/editing/formatting capability implemented with OpenXML SDK in .NET, including three authoring pipelines and validation. The supplied code does none of that. It is a Bash preview utility for reading an existing DOCX and outputting plain text or raw XML. Its primary purpose is inspection/preview, not document generation, modification, formatting, or template application. This is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says the skill's purpose is to produce and modify .docx documents using OpenXML SDK pipelines. However, the supplied code does not create, edit, format, validate, or otherwise manipulate Word documents. Its primary function is operational: checking whether the local environment is ready for the DOCX toolchain, including installed SDKs, project build state, optional utilities, locale, and permissions. These are supporting setup tasks, but in this chunk they are the entire behavior, making the actual code materially different from the declared primary purpose. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
91% confidence
Finding

The manifest contains unusual metadata blocks and reserved signature-like fields that are not necessary for normal skill operation, alongside aggressive activation language. While not proof of malicious code, such metadata can be used to bias trust decisions, evade review heuristics, or poison downstream tool/skill selection logic, making the skill harder to audit safely.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: 9d5a8b3d82a01e0f24fae0fc2985a5c1
    PropagateID: 9d5a8b3d82a01e0f24fae0fc2985a5c1
    ReservedCode1: 304402202866606e6ad9dc0e4f624c67e85f82e9617260f7346116caa0a1fdb9f128680c02202f46fdfd4daab5f6da467fd0b323b4512ec66ce0e30cab8379ef68787ac95abb
    ReservedCode2: 304502206044c98043ad51077bc4cfd8d35829415d3883454a872d97e808b06c66e75a1d022100c6eec4cff27ee43cc2783b3e9a1af0b6b9812219bf6af5c78897f8e67f13540c
description: |
    Professional DOCX document creation, editing, and formatting using OpenXML SDK (.NET). Three pipelines: (A) create new documents from scratch, (B) fill/edit content in existing documents, (C) apply template formatting with XSD validation gate-check. MUST use this skill whenever

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says the skill MUST be used whenever a request implies a formal or printable document, even if the user does not mention DOCX explicitly. Such broad activation criteria can hijack many unrelated tasks and route them into a shell-capable skill, expanding the attack surface and increasing the chance of unsafe or unnecessary tool use.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/cjk_typography.md (reported line 73)May include surrounding context.

xml
<w:rFonts
  w:ascii="Calibri"        <!-- Latin characters (U+0000–U+007F) -->
  w:hAnsi="Calibri"        <!-- Latin extended, Greek, Cyrillic -->
  w:eastAsia="SimSun"      <!-- CJK Unified Ideographs, Kana, Hangul -->
  w:cs="Arial"             <!-- Arabic, Hebrew, Thai, Devanagari -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_good_bad_examples.md (reported line 26)May include surrounding context.

└──────────────────────────────────┘

text
```xml
<!-- H1: bold but same size as body — no visual separation -->
<w:rPr><w:b/><w:sz w:val="24"/></w:rPr>
<!-- Body -->
<w:rPr><w:sz w:val="24"/></w:rPr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_good_bad_examples.md (reported line 77)May include surrounding context.

text
```xml
<w:rPr><w:b/><w:sz w:val="56"/></w:rPr>  <!-- 28pt heading -->
<w:rPr><w:sz w:val="20"/></w:rPr>         <!-- 10pt body -->

GOOD: H1=20pt with body=11pt (ratio ~1.8x)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_good_bad_examples.md (reported line 108)May include surrounding context.

xml
<w:pPr>
  <w:spacing w:line="240" w:lineRule="auto"/>  <!-- 1.0 spacing (240/240) -->
  <w:spacing w:after="0"/>                     <!-- no paragraph gap -->
</w:pPr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_principles.md (reported line 56)May include surrounding context.

text

```xml
<!-- Page margins: 1 inch = 1440 twips on all sides -->
<w:pgMar w:top="1440" w:right="1440" w:bottom="1440" w:left="1440"
         w:header="720" w:footer="720" w:gutter="0"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_principles.md (reported line 299)May include surrounding context.

md
<w:spacing w:before="360" w:after="120"/>
</w:pPr>

<!-- Body paragraph: 0pt before, 8pt after -->
<w:pPr>
  <w:spacing w:before="0" w:after="160"/>
</w:pPr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_principles.md (reported line 550)May include surrounding context.

md
</w:rPr>
</w:style>

<!-- Apply consistently: every H2 references the style -->
<w:p>
  <w:pPr>
    <w:pStyle w:val="Heading2"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/openxml_encyclopedia_part3.md (reported line 1030)May include surrounding context.

csharp
// <w:r>
//   <w:rPr>
//     <w:b/>  <!-- New: bold -->
//     <w:rPrChange w:id="7" w:author="Bob" w:date="2026-03-22T11:00:00Z">
//       <w:rPr/>  <!-- Old: no formatting -->
//     </w:rPrChange>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scenario_b_edit_content.md (reported line 84)May include surrounding context.

When the entire search text is within a single w:r (run):

xml
<!-- Before -->
<w:r>
  <w:rPr><w:b /></w:rPr>
  <w:t>{{companyName}}</w:t>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scenario_c_apply_template.md (reported line 164)May include surrounding context.

Critical distinction: w:styleId vs w:name:

xml
<!-- styleId="1" but name="heading 1" -->
<w:style w:type="paragraph" w:styleId="1">
  <w:name w:val="heading 1"/>
  <w:basedOn w:val="a"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scenario_c_apply_template.md (reported line 246)May include surrounding context.

xml
   <!-- Source -->
   <w:pPr><w:pStyle w:val="Heading1"/></w:pPr>
   <!-- After mapping -->
   <w:pPr><w:pStyle w:val="1"/></w:pPr>

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

ResolveComment accepts a commentId parameter but never uses it; instead it marks the first matching extensible comment element as done. In a document-editing skill, this can silently alter the wrong review record, undermining auditability and allowing document state manipulation where unresolved comments may remain hidden or the wrong issue may be marked complete.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/HeaderFooterSamples.cs (reported line 24)May include surrounding context.

text
///   <w:headerReference w:type="default" r:id="rId7"/>
///   <w:footerReference w:type="default" r:id="rId8"/>
///   <w:headerReference w:type="first" r:id="rId9"/>
///   <w:titlePg/>   <!-- needed to activate first-page header/footer -->
/// </w:sectPr>
///
/// Header/Footer XML (in separate part):

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/HeaderFooterSamples.cs (reported line 490)May include surrounding context.

text
///       <w:gridCol w:w="3120"/> <w:gridCol w:w="3120"/> <w:gridCol w:w="3120"/>
    ///     </w:tblGrid>
    ///     <w:tr>
    ///       <w:tc> <!-- left: logo text -->  </w:tc>
    ///       <w:tc> <!-- center: title -->    </w:tc>
    ///       <w:tc> <!-- right: page num -->  </w:tc>
    ///     </w:tr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/TableSamples.cs (reported line 274)May include surrounding context.

text
///     <w:tblBorders>
    ///       <w:top w:val="single" w:sz="12" w:space="0" w:color="000000"/>
    ///       <w:bottom w:val="single" w:sz="12" w:space="0" w:color="000000"/>
    ///       <!-- No left, right, insideV borders -->
    ///       <w:insideH w:val="none" w:sz="0" w:space="0" w:color="auto"/>
    ///       <w:insideV w:val="none" w:sz="0" w:space="0" w:color="auto"/>
    ///     </w:tblBorders>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/TableSamples.cs (reported line 552)May include surrounding context.

text
/// XML:
    /// <w:tblGrid>
    ///   <w:gridCol w:w="1440"/>   <!-- 1 inch -->
    ///   <w:gridCol w:w="4680"/>   <!-- 3.25 inches -->
    ///   <w:gridCol w:w="3240"/>   <!-- 2.25 inches -->
    /// </w:tblGrid>
    ///

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/TableSamples.cs (reported line 865)May include surrounding context.

text
/// Row 1: <w:tcPr><w:vMerge w:val="restart"/></w:tcPr>
    ///         <w:p><w:r><w:t>Visible content</w:t></w:r></w:p>
    /// Row 2: <w:tcPr><w:vMerge/></w:tcPr>
    ///         <w:p/>   <!-- MUST still have a paragraph, even though cell is merged -->
    /// Row 3: <w:tcPr><w:vMerge/></w:tcPr>
    ///         <w:p/>   <!-- MUST still have a paragraph -->
    ///

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/setup.sh (reported line 113)May include surrounding context.

sh
..."
                sudo apt-get update -qq
                sudo apt-get install -y -qq wget apt-transport-https
                wget -q "https://dot.net/v1/dotnet-install.sh" -O /tmp/dotnet-install.sh
                chmod +x /tmp/dotnet-install.sh
                /tmp/dotnet-install.sh --channel 8.0 --install-dir "$HOME/.dotnet"
                export PATH="$HOME/.dotnet:$PATH"
                echo 'export PATH="$HOME/.dotnet:$PATH"' >> "$HOME/.bashrc"
            fi
            ;;
        dnf)
            sudo dnf install -y dotnet-sdk-8.0
            ;;
        pacman)
            sudo pacman -S --noconfirm dotnet-sdk
            ;;
        zypper)
            sudo zypper install -y dotnet-sdk-8.0
            ;;
        apk)
            apk add --no-cache dotnet8-sdk
            ;;
        none)
            if [ "$OS" = "windows-git-bash" ]; then
                fail "On Windows, install .NET SDK from: https://dotnet.microsoft.com/download"
                fail "Then restart your

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

The --noconfirm flag removes the last user verification barrier before a privileged package manager action. In a setup script, that can enable unattended installation of packages and dependency changes, increasing the blast radius if the script is invoked unexpectedly, altered, or pointed at a compromised mirror.

Content

Scanner excerpt · scripts/setup.sh (reported line 120)May include surrounding context.

sh
sudo dnf install -y dotnet-sdk-8.0
            ;;
        pacman)
            sudo pacman -S --noconfirm dotnet-sdk
            ;;
        zypper)
            sudo zypper install -y dotnet-sdk-8.0

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/setup.sh:468