ClawHub
Back to skill

Security audit

anydoc

Security checks for vulnerabilities and agentic risk

Overview

This document-conversion skill is coherent, but it should be reviewed because it installs a persistent PATH-first wrapper that runs an unpinned remote package.

Install only if you are comfortable with Bun downloading and running the current @firecrawl/anydoc package. Prefer a pinned reviewed version or a preinstalled local CLI, and remove ~/.local/bin/anydoc if you do not want this wrapper to keep controlling future anydoc runs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to install and execute `@firecrawl/anydoc@latest` through `bunx`, which fetches code from the network at runtime and runs whatever the current latest package version contains. That creates a supply-chain execution path unrelated to merely describing document conversion behavior, and exposes the environment to package compromise, malicious updates, or unexpected postinstall/runtime behavior.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The instructions write a new executable into `~/.local/bin` and explicitly require that directory to be first on `PATH`, but do not warn about command shadowing or persistent modification of the user's execution environment. A PATH-first wrapper can override other binaries named `anydoc` and normalize future execution of network-fetched code in ways the user may not expect.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill recommends `bunx @firecrawl/anydoc@latest`, which performs network retrieval and executes remote package code without any user-facing warning about that risk. In an agent skill context, this is especially dangerous because the installation step may be followed automatically, turning ordinary document handling into arbitrary third-party code execution.

Static analysis

No suspicious patterns detected.