ClawHub
Back to skill

Security audit

AI Word Form Filling

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed remote document-filling tool that sends user-selected files to LLMFill, so it is acceptable when users understand and approve that data sharing.

Install only if you are comfortable sending the selected Word forms and knowledge-base files to llmfill.com for processing. Do not use it for confidential, regulated, personal, or internal-only documents unless you have authorization and have considered redaction; protect the long-lived API key in ~/.llmfill/config.json and review AI-filled results before relying on them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation instructs users to upload .docx files to an external service and later download processed results, but it does not clearly warn that the full document contents may be transmitted off-platform and potentially contain sensitive business, legal, compliance, or personal data. In the context of this skill, which is explicitly designed for DDQs, compliance forms, and due diligence questionnaires, the omitted disclosure increases the risk that users send confidential material without informed consent or appropriate handling expectations.

External Transmission

Medium
Category
Data Exfiltration
Content
# 无 Python 环境的 curl 操作指南

> 本指南用于**本机没有 Python** 时：agent 直接用 Bash + curl 调用网关 API
> 完成全部功能（curl 在 Windows 10+/Linux/macOS 均自带）。有 Python 时
Confidence
95% confidence
Finding
The guide explicitly instructs agents to upload local documents and send authentication tokens to a remote third-party service, which creates a real data exfiltration path. Although it includes privacy warnings and confirmation gates, the skill context is document automation, so users may process sensitive forms, DDQs, compliance documents, or regulated data, making external transmission materially risky if the agent follows these instructions.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# 无 Python 环境的 curl 操作指南

> 本指南用于**本机没有 Python** 时：agent 直接用 Bash + curl 调用网关 API
> 完成全部功能（curl 在 Windows 10+/Linux/macOS 均自带）。有 Python 时
Confidence
93% confidence
Finding
The document gives the agent operational shell/curl procedures for uploading files, polling, downloading, and deleting remote resources, including use of credential material from a local config file. Even though the guide contains a confirmation gate, this still expands the agent's ability to perform high-impact external actions with user data and secrets, and such tool-parameterized actions are dangerous in a skill whose purpose is automated form completion over potentially sensitive documents.

Static analysis

No suspicious patterns detected.