ClawHub
Back to skill

Security audit

Doc Converter

Security checks for vulnerabilities and agentic risk

Overview

This document converter is mostly coherent, but its HTML-to-PDF path gives rendered HTML unrestricted local-file access without clear warning or scoping.

Review this skill before installing. Use it only on trusted documents, especially for HTML-to-PDF, because crafted HTML could cause wkhtmltopdf to read local files into the output PDF or load remote resources. Prefer disabling local-file access by default, using a sandbox or allow-listed asset directory, and pinning dependencies before production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:318
Finding

HTML Renderer Permits Unrestricted Local-File Access

Content
View full analysis
Remediation
View remediation
`. 3. Reject or sanitize `file://` references, absolute filesystem paths, and references that escape the approved asset directory. 4. Disable external resource loading when network access is unnecessary, and enforce outbound network restrictions at the process or container level. 5. Run `wkhtmltopdf` under a dedicated, low-privilege operating-system account with no access to user home directories, credentials, or unrelated project data. 6. Use an isolated container or sandbox with a read-only filesystem and only the input/output directories mounted. 7. Apply execution time, memory, file-size, and process limits to reduce renderer abuse. 8. Clearly document that HTML must be treated as untrusted active content rather than as a passive document format. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:7
Finding

Python Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation's supported conversions table advertises a .docx → .md method, yet the code only includes implementations for Word→PDF, Markdown→PDF, Markdown→Word, and HTML→PDF. This is an active contradiction between documented capability and actual code behavior, not just an omitted detail.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md
except FileNotFoundError:
            print("❌ wkhtmltopdf not installed")
            print("Install: brew install wkhtmltopdf (macOS)")
            print("         sudo apt install wkhtmltopdf (Linux)")
            return None
        
        # Convert

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The HTML→PDF path invokes wkhtmltopdf with --enable-local-file-access, which permits HTML content to reference local files during rendering. If an attacker can supply or influence the HTML input, the generated PDF may embed sensitive local file contents or otherwise expose host-local data that the user did not intend to include.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The detect_conversion_type function maps ('.docx', '.md') to docx_to_md, implying that this conversion is supported. However, no converter class or script for docx_to_md is defined anywhere in the file, so the documentation/code intent diverges from the actual implementation.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text
permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest description includes both English and Chinese text, and later instructions also switch languages, but the skill does not state whether output language follows user preference. This can violate language or locale policy expectations when a skill implicitly chooses or mixes languages without explicit user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.