ClawHub
Back to skill

Security audit

docx-skill

Security checks for vulnerabilities and agentic risk

Overview

This DOCX skill is a coherent document-processing guide with disclosed local file and package-management steps, but users should install its dependencies carefully.

Before installing, prefer project-local npm dependencies, a Python virtual environment, and pinned versions where practical; only install optional converters or image tools if you need those features.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Third-Party Dependencies Installed from Mutable Package Registries

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-35
Vulnerability Type: Unpinned and globally installed third-party dependencies
Risk Level: Medium

Vulnerable Code:

bash
# For creating documents
npm install -g docx

# For text extraction
brew install pandoc

# For validation (optional)
pip install python-docx
bash
# For PDF conversion
brew install --cask libreoffice

# For image processing
brew install imagemagick

Technical Analysis

The installation instructions retrieve mutable package versions without exact version constraints, lockfiles, checksums, signatures, or integrity verification. Consequently, the dependency code installed by a user may differ from the version reviewed when the Skill was published.

The npm install -g docx command is particularly broad because it installs the package globally rather than isolating it within the project. npm packages and their transitive dependencies may also execute lifecycle scripts during installation. The Python and Homebrew dependencies are likewise resolved to versions available from their configured repositories at installation time.

This creates a supply-chain risk if a package, transitive dependency, package-manager repository, or future release is compromised. The audited file contains no evidence that any named dependency is currently malicious; the issue is the absence of reproducible and integrity-verified dependency resolution.

Attack Path

  1. An attacker compromises a referenced package, one of its transitive dependencies, its registry account, or the repository used by the package manager.
  2. The attacker publishes a malicious release or modifies the artifact resolved by an unpinned installation command.
  3. A user follows the installation instructions in SKILL.md.
  4. The package manager resolves and downloads the mutable malicious version.
  5. Malicious installer or lifecycle code executes w ...[truncated 859 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an exact, reviewed version rather than installing the latest available release.
  2. Replace the global npm installation with a project-local dependency recorded in package.json, and commit an integrity-bearing lockfile such as package-lock.json.
  3. Use npm ci in deployment or automation so dependency resolution follows the reviewed lockfile exactly.
  4. Install Python dependencies in an isolated virtual environment from a pinned requirements file. Include package hashes and enforce them with pip install --require-hashes.
  5. Document reviewed Homebrew formula and cask versions. Where reproducible version pinning is unavailable, provide official artifact locations and cryptographic checksums or signature-verification instructions.
  6. Review transitive dependencies and package lifecycle scripts before approving upgrades.
  7. Avoid running package-manager installation commands with administrative privileges unless strictly required.
  8. Add automated dependency scanning and a controlled update process that reviews version changes before lockfiles or checksums are updated.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The page size reference labels 'US Letter' as the default for the US and 'A4' as the default for the EU, and later best practices recommend explicitly setting US Letter. This nudges a locale-specific document format preference without offering the user a choice or framing it as context-dependent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.