Mxe

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:44 AM UTC
• Version: 2.0.0

Overview

The skill’s document-conversion purpose is understandable, but its install steps rely on building and globally linking an unreviewed external project from a hard-coded local path.

Review this skill carefully before installing. Only use it if you can inspect and trust the external MXE project at the hard-coded path, and prefer a pinned local install over npm link or global npm installs. Treat URL inputs as network fetches of external content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:20

Finding

Execution and Global Linking of an Unreviewed External npm Project

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-23
Vulnerability Type: Execution of an external, unbundled dependency
Risk Level: High

bash

If not installed:
```bash
cd /Users/tuan/.openclaw/workspace/mxe && npm run build && npm link

text

### Technical Analysis

The installation instructions change into a hard-coded project directory outside the audited skill and execute its npm `build` lifecycle script. The contents, dependencies, and package scripts of that external project are not included in the audited artifact and therefore cannot be verified.

`npm run build` executes whatever command is assigned to the external project's `build` script with the current user's privileges. The subsequent `npm link` operation exposes the resulting package executable through npm's global command environment. Consequently, files placed at or substituted into the referenced path can supply attacker-controlled scripts and an attacker-controlled `mxe` executable.

The audited `package.json` only contains skill metadata and does not provide the referenced implementation, scripts, dependencies, lockfile, or integrity information.

### Attack Path

1. An attacker gains the ability to create, replace, or modify files under `/Users/tuan/.openclaw/workspace/mxe`.
2. The attacker adds a malicious npm `build` script or modifies the package's CLI entry point.
3. A user follows the documented installation procedure.
4. `npm run build` executes the attacker-controlled lifecycle command with the user's privileges.
5. `npm link` exposes the malicious executable as the apparently legitimate `mxe` command.
6. Subsequent document-conversion requests invoke the substituted executable.

### Impact Assessment

Successful exploitation permits arbitrary command execution with the privileges of the user performing the installation. The malicious build or linked CLI could read or modify user-accessible files, 
...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

• Include the converter implementation in the reviewed project rather than relying on a hard-coded external workspace.
• Replace the absolute user-specific path with a project-relative, validated path.
• Audit all npm lifecycle scripts and CLI entry points before execution.
• Pin dependency versions and commit a lockfile with integrity metadata.
• Avoid npm link and other global installation mechanisms where possible; install the CLI locally and invoke it through an explicitly resolved project path.
• If external installation is unavoidable, verify the source revision, package provenance, and cryptographic integrity before running any lifecycle scripts.
• Run installation and conversion in a sandbox with restricted filesystem, credential, and network access.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:106

Finding

Unpinned Global Installation of Mermaid CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 106
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

markdown

1. **Mermaid requires mmdc**: Install with `npm i -g @mermaid-js/mermaid-cli`

Technical Analysis

The documentation directs users to install the latest available release of @mermaid-js/mermaid-cli globally. No exact version, lockfile, integrity hash, or provenance requirement is specified. The effective package contents can therefore change after the skill has been reviewed.

npm packages and their transitive dependencies can execute lifecycle scripts during installation. A compromised maintainer account, malicious release, or compromised transitive dependency could consequently execute code during the global installation. Global installation also makes the resulting executable available outside this skill's isolated project context.

Attack Path

1. The npm package, one of its transitive dependencies, or a newly published release is compromised.
2. A user follows the skill documentation and runs npm i -g @mermaid-js/mermaid-cli.
3. npm retrieves the currently resolved package graph rather than a specifically reviewed release.
4. Malicious lifecycle code executes during installation, or a compromised mmdc executable is installed globally.
5. The malicious executable runs when Mermaid diagrams are rendered.

Impact Assessment

Exploitation could result in arbitrary code execution with the privileges of the account running npm. An attacker could access user-readable files and environment variables, alter generated documents, perform network communications, or install a spoofed globally accessible CLI. The precise scope depends on the permissions of the installing user; the documentation does not explicitly require administrative privileges.

Remediation

View remediation

Remediation Suggestions

• Pin an exact, reviewed Mermaid CLI version instead of installing the latest release.
• Install it as a local project dependency and commit the generated lockfile with integrity values.
• Verify package provenance, signatures where available, and published integrity metadata.
• Review direct and transitive dependencies for known vulnerabilities before distribution.
• Avoid global installation; invoke the locally resolved binary through a controlled project script.
• Where operationally feasible, disable unnecessary lifecycle scripts and run rendering in a sandbox with restricted network and filesystem access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad and overlap with common user intents such as 'export pdf', 'generate pdf', and 'convert markdown'. This can cause the skill to activate in situations beyond the author's likely intent, increasing the chance of unintended invocation and inappropriate access to user content or workflow execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to pass a URL directly to the tool to 'download and convert' web content, but it does not warn that this causes outbound network access and retrieval of untrusted external content. In an agent setting, this can lead to unexpected data egress, interaction with attacker-controlled URLs, or processing of hostile remote content without explicit user awareness or confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.