ClawHub
Back to skill

Security audit

Chinese Document Table Extraction & Field Validator

Security checks for vulnerabilities and agentic risk

Overview

The skill performs local document processing, but confirmed validation and citation defects require human checking.

Use reviewed local files or pin installation sources. Protect generated records as carefully as the originals and mask personal data before sharing. Check values and cited locations against the source even when validation passes; the scripts lack built-in OCR. Scanner reference gaps were investigated, but accuracy on production documents and external package releases remains unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The security-relevant mismatch is the guarantee of reliable field-level evidence despite key-value extraction assigning every field the same source row, allowing incorrect citations to appear verified. This undermines audit integrity in financial and payroll workflows; unsupported OCR and variable field sets are primarily capability and compatibility defects, not evidence of malicious behavior.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation command executes an unpinned npm CLI and retrieves skill content from a mutable repository reference, exposing installation to compromised future releases or repository changes. This is a supply-chain risk rather than an MCP-server issue; malicious installation code could access local credentials and sensitive financial documents with the invoking user's privileges.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/extract_tables.py (reported line 73)May include surrounding context.

python
def _require(module, pip_name, why):
    """尝试导入模块，失败时登记缺失信息（不抛异常）。"""
    try:
        return __import__(module)
    except ImportError:
        MISSING[module] = (pip_name, why)
        return None

Key-value forms emit incorrect source rows despite the documented per-field traceability guarantee.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

Key-value detection retains each field's row index, but record construction discards it and supplies row 1 for every field's evidence. Consequently, fields from later rows receive incorrect citations without an unverified marker, weakening the audit trail and potentially misleading reviewers of sensitive business records.

Content

No source excerpt is available for this finding.

Incomplete field citations are accepted as traceable despite the manifest's field-level traceability guarantee.

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The evidence check accepts any truthy page, sheet, or table_id together with a truthy row, without requiring a column or validating coordinate types and ranges. Consequently, incomplete or fabricated citations can avoid missing-evidence warnings and let the report claim that all fields are traceable, undermining the skill's explicit field-level traceability guarantee. This is particularly consequential for financial and insurance documents, where reviewers may rely on the report to verify individual amounts and identifiers.

Content

No source excerpt is available for this finding.