ClawHub
Back to skill

Security audit

unisound-med-doc-preprocess

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local medical-document preprocessing helper, with expected file parsing and OCR/conversion behavior but no hidden network, persistence, or credential activity found.

Install only if you need a shared local parser/OCR helper for medical documents. Treat input files as sensitive: use trusted local binaries, avoid processing untrusted documents on privileged hosts, and keep PHI/PII handling controls in place.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents importing a shared preprocessing library that can read files and invoke external utilities such as LibreOffice, pdftotext, and tesseract, but it does not declare any tool scope or permission boundaries. In a medical-document context, missing scope declarations increases the risk that downstream agents invoke file and shell capabilities without clear review, enabling unintended access to sensitive patient data or unsafe subprocess execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This skill preprocesses medical documents and explicitly relies on OCR/PDF/external conversion tools, but the description omits any warning that sensitive health data may be exposed to local utilities, temporary files, logs, or subprocess boundaries. In healthcare workflows, that omission can lead operators to process regulated data without appropriate handling controls or awareness of privacy risks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
| `pdftotext`（poppler-utils） | 提取 PDF 文本 | 未安装 pypdf 时作为备选 |
| `tesseract`（含 chi_sim+eng） | 图片 OCR | 输入为图片时必须 |

安装（Ubuntu/Debian）：`sudo apt-get install libreoffice poppler-utils tesseract-ocr tesseract-ocr-chi-sim`

> 仅使用 JSON / txt 输入时，无需安装任何第三方包或外部工具。

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/preprocess.py (reported line 164)May include surrounding context.

python
| `pdftotext`（poppler-utils） | 提取 PDF 文本 | 未安装 pypdf 时作为备选 |
| `tesseract`（含 chi_sim+eng） | 图片 OCR | 输入为图片时必须 |

安装（Ubuntu/Debian）：`sudo apt-get install libreoffice poppler-utils tesseract-ocr tesseract-ocr-chi-sim`

> 仅使用 JSON / txt 输入时，无需安装任何第三方包或外部工具。

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/preprocess.py (reported line 242)May include surrounding context.

python
| `pdftotext`（poppler-utils） | 提取 PDF 文本 | 未安装 pypdf 时作为备选 |
| `tesseract`（含 chi_sim+eng） | 图片 OCR | 输入为图片时必须 |

安装（Ubuntu/Debian）：`sudo apt-get install libreoffice poppler-utils tesseract-ocr tesseract-ocr-chi-sim`

> 仅使用 JSON / txt 输入时，无需安装任何第三方包或外部工具。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The module-level natural-language documentation is entirely in Chinese, and the OCR logic prefers chi_sim+eng when available. This creates a language/locale bias without any visible opt-in, user choice, or explicit justification that the skill is intended only for a Chinese-language environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes a common library that uniformly loads local documents into standard artifacts for downstream skills. While format conversion/OCR is consistent with preprocessing, this implementation also searches PATH and launches multiple host-installed executables via subprocess, introducing command-execution capability that is not declared in the stated scope and is materially more powerful than simple parsing.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/preprocess.py (reported line 90)May include surrounding context.

python
def _detect_tesseract_langs(tesseract_bin: str) -> Sequence[str]:
    proc = subprocess.run(
        [tesseract_bin, "--list-langs"],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code invokes external tools via subprocess to convert office documents and later OCR images/PDFs, which means user-provided document contents are sent to separate binaries for processing. Although this is part of preprocessing functionality, the file does not include any user-facing prompt, logging, or warning that local external programs will read the supplied files, which is relevant for sensitive medical documents.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
78% confidence
Finding

This code sends untrusted office documents to LibreOffice/soffice for conversion. Although there is no shell injection, office parsers are historically high-risk attack surfaces, and executing a PATH-discovered binary on attacker-controlled files can expose the host to parser RCE or unintended behavior if the environment supplies a trojaned binary.

Content

Scanner excerpt · scripts/preprocess.py (reported line 166)May include surrounding context.

python
if not office_bin:
        raise PreprocessError("libreoffice/soffice not found. Install: sudo apt-get install libreoffice")
    with tempfile.TemporaryDirectory(prefix="med-doc-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The functions for PDF extraction and image OCR call external executables (pdftotext and tesseract) on medical document inputs, exposing file contents to those tools. In a code file handling healthcare-related inputs, there is no visible confirmation, print/log notice, or explanatory comment warning users that sensitive files will be processed by external programs.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
71% confidence
Finding

This call passes untrusted PDF content to an external pdftotext process discovered from PATH. The Python code is not shell-injectable, but PDF parsers have had memory corruption and code execution bugs, so using an external parser on attacker-supplied files expands the attack surface of a preprocessing library.

Content

Scanner excerpt · scripts/preprocess.py (reported line 195)May include surrounding context.

python
pdf_to_text = _shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
71% confidence
Finding

Like the earlier PDF path, this code invokes an external pdftotext binary on untrusted PDFs. The direct code pattern is not command injection, but it still creates meaningful exposure to vulnerabilities in the external parser and to PATH hijacking if the runtime environment is compromised.

Content

Scanner excerpt · scripts/preprocess.py (reported line 223)May include surrounding context.

python
pdf_to_text = _shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/preprocess.py (reported line 249)May include surrounding context.

python
cmd = [tesseract_bin, str(path), "stdout"]
    if lang_arg:
        cmd.extend(["-l", lang_arg])
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False)
    if proc.returncode != 0 or not proc.stdout.strip():
        raise PreprocessError(f"Image OCR failed: {proc.stderr.strip() or 'no text returned'}")
    return proc.stdout

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language description and usage instructions are entirely in Chinese, which can impose a language constraint on users without explicit opt-in. The file does not indicate that the skill is region- or language-specific, nor does it offer an alternative language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.