ClawHub
Back to skill

Security audit

Word Template Filler

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a straightforward Word template automation helper, but its debug instructions include an unsafe command that can forcibly close all open Word documents.

Review this before installing if you often keep Word documents open. The core script appears purpose-aligned, but avoid the documented `taskkill` command unless you have saved and closed all Word files; a safer version should warn users and close only the Word instance created for the task.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation explicitly instructs users to run `taskkill /f /im WINWORD.EXE`, which forcibly terminates all Word processes and can immediately discard unsaved documents unrelated to this skill. In this context the issue is not code execution but unsafe operational guidance: it encourages destructive recovery behavior without warning, scope limitation, or safer alternatives.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal