ClawHub
Back to skill

Security audit

anydoc

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible document-conversion helper, but its install path creates a lasting PATH-first wrapper that runs a mutable remote package and can shadow existing tools.

Review before installing. Prefer a pinned, locally installed anydoc version, check whether an anydoc command already exists before creating this wrapper, and avoid the hosted Parse API for confidential documents unless third-party upload is acceptable.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:24
Finding

Mutable Remote Package Is Downloaded and Executed Without Version Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–31
Vulnerability Type: Unpinned remote dependency execution
Risk Level: High

bash
mkdir -p ~/.local/bin
cat > ~/.local/bin/anydoc <<'EOF'
#!/usr/bin/env bash
set -euo pipefail

exec bunx @firecrawl/anydoc@latest "$@"
EOF
chmod +x ~/.local/bin/anydoc

Technical Analysis

The generated wrapper executes bunx @firecrawl/anydoc@latest. The latest package tag is mutable, so the code executed during a future conversion may differ from the code available when the Skill was reviewed. No exact version, lockfile, package integrity hash, or locally reviewed artifact constrains the downloaded payload.

bunx may retrieve the package and its transitive dependencies from an external registry before executing them with the current user's permissions. Consequently, compromise of the package publisher, registry, release process, or a transitive dependency could turn an ordinary document-conversion request into arbitrary local code execution.

This is primarily an insecure dependency issue and also creates a remote payload retrieval and execution channel because the effective executable payload can change after review.

Attack Path

  1. The Agent loads the Skill and determines that anydoc is not installed.
  2. Following the documented installation procedure, it creates the wrapper in ~/.local/bin/anydoc.
  3. An attacker compromises a future @firecrawl/anydoc release, its publishing account, registry distribution, or a transitive dependency.
  4. Because the wrapper specifies @latest, a later invocation resolves the compromised package rather than a fixed, previously reviewed version.
  5. bunx downloads and executes the package with the permissions and environment of the Agent's operating-system user.
  6. The malicious package can act before, during, or after processing the supplied document.

Impact Assessme

...[truncated 653 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version.
  • Use a lockfile-backed installation that fixes all transitive dependency versions.
  • Verify package integrity using a trusted checksum or package-manager integrity metadata.
  • Download and review dependency updates separately from routine document-conversion operations.
  • Do not perform network retrieval on every invocation. Install a verified artifact once and execute that immutable local artifact.
  • Run document conversion in a sandbox with minimal filesystem access, a sanitized environment, resource limits, and outbound network access disabled where practical.
  • Document a controlled upgrade process requiring review and integrity verification before changing the pinned version.

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:24
Finding

Persistent PATH-Priority Wrapper Can Replace or Shadow an Existing Tool

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–39
Vulnerability Type: Tool replacement and command shadowing
Risk Level: Medium

bash
mkdir -p ~/.local/bin
cat > ~/.local/bin/anydoc <<'EOF'
#!/usr/bin/env bash
set -euo pipefail

exec bunx @firecrawl/anydoc@latest "$@"
EOF
chmod +x ~/.local/bin/anydoc
text
1. Keep `~/.local/bin` on `PATH` ahead of later package-manager bin dirs.
2. Requires Bun so `bunx` can fetch `@firecrawl/anydoc@latest`.
3. Verify with `command -v anydoc` and `anydoc -V`.
4. Prefer this wrapper over a permanent Bun/npm global install of `@firecrawl/anydoc`.

Technical Analysis

The installation procedure writes directly to ~/.local/bin/anydoc with shell redirection. It does not test whether the destination already exists, preserve an existing file, validate ownership, or require confirmation before replacement. The Skill then explicitly requires ~/.local/bin to precede other package-manager directories in PATH.

These instructions create a persistent command-resolution change: future calls that appear to invoke the normal anydoc tool are redirected through the newly created wrapper. If a trusted executable or wrapper already exists at the destination, it is silently overwritten. If another trusted installation exists elsewhere, it is shadowed by the PATH-priority wrapper.

The wrapper further redirects every call to a mutable remotely resolved package, combining tool spoofing with the dependency risk described separately.

Attack Path

  1. A trusted anydoc implementation is already installed elsewhere, or an existing file is present at ~/.local/bin/anydoc but is not detected by the initial command lookup.
  2. The Agent follows the installation block.
  3. Shell redirection truncates and replaces any existing ~/.local/bin/anydoc file without prompting.
  4. The user or Agent places ~/.local/bin before othe ...[truncated 978 chars]
Remediation
View remediation

Remediation Suggestions

  • Check for an existing destination with test -e ~/.local/bin/anydoc and refuse to overwrite it automatically.
  • Resolve and display all existing candidates with type -a anydoc before installation.
  • Require explicit user approval before creating or replacing a persistent executable.
  • Avoid requiring PATH precedence over other package-manager directories.
  • Use a unique, versioned command name rather than shadowing a generic executable name.
  • Install a pinned, verified executable instead of a wrapper that dynamically resolves @latest.
  • If replacement is authorized, create a backup atomically and document a rollback procedure.
  • Prefer a project-local, isolated installation whose effects end with the project or task rather than modifying the user's persistent command environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

Convert documents to Markdown

Run the anydoc CLI and write Markdown to stdout or a file:

bash
anydoc <file>              # Markdown to stdout

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill presents first-time installation steps that can fetch and execute code from the network, but the top-level description does not warn users about that behavior. This omission can mislead users and automation into invoking the skill under the assumption it only performs local document conversion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The install wrapper executes bunx @firecrawl/anydoc@latest, which fetches and runs the latest remote package at execution time. This creates a supply-chain and integrity risk because package contents can change without review, and first use may trigger network-dependent code execution beyond the skill's stated document-conversion purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill references the hosted Firecrawl Parse API for OCR-capable handling of scanned PDFs without clearly warning that document contents would be transmitted to an external service. For sensitive office documents and PDFs, this is a meaningful privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.