Security audit

vaDocparse

Security checks across malware telemetry and agentic risk

Overview

This document parser appears purpose-built, but it can upload full local documents to a configured remote service and stores service credentials in plaintext without a strong consent or privacy boundary.

Install only if you trust the configured document parsing server and are comfortable sending entire PDFs/images to it. Replace or remove the bundled .env fallback, prefer a trusted HTTPS endpoint, avoid highly sensitive documents unless the service’s retention/logging policy is acceptable, and protect or rotate any API key stored in .env or openclaw.json.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill says the tool returns extracted text, but later requires generating downloadable files and exposing local storage paths to the user. That inconsistency can lead an implementation to persist sensitive document contents on disk and reveal internal filesystem locations, increasing data leakage risk beyond the declared behavior.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The tool interface describes a text-returning API, but the instructions later mandate downloadable files and reporting file paths. This ambiguity encourages unsafe implementations that may write extracted sensitive content to local storage or disclose internal path structure without user consent or clear platform controls.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger terms include broad verbs such as '阅读/识别/读取', which can match many ordinary requests unrelated to OCR or document parsing. Over-broad activation is dangerous here because the skill sends files to a remote service, so accidental invocation could cause unintended external transmission of sensitive documents.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger section lacks strong scope boundaries and negative examples, making it easier for the agent to invoke the skill when the user did not intend remote document processing. In this context, mistaken activation is more serious because it may upload private files to an external parser without an adequately clear consent boundary.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill description states that documents are parsed via a remote service, but it does not clearly warn users that their files and extracted contents may be transmitted to an external system. Because documents often contain sensitive personal, financial, legal, or corporate data, lack of a prominent privacy notice and consent step materially increases confidentiality risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code base64-encodes the full input file and sends it to a remote MCP endpoint, but there is no explicit user-facing disclosure, consent check, or trust boundary warning before transfer. Because this skill is specifically triggered on document/OCR requests, it is likely to handle sensitive PDFs and images, so silent exfiltration to a configured remote service creates a real confidentiality risk even if the feature is intentional.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The installer persists the API key in plaintext both in a .env file and later in openclaw.json without an explicit warning or any file-permission hardening. On multi-user systems, shared workspaces, backups, or accidental commits, this can expose credentials and allow unauthorized use of the remote parsing service.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.