ClawHub
Back to skill

Security audit

Word Reader

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to read Word documents as advertised, but its installer can make system-level package changes and its outputs may save sensitive document contents without strong warnings.

Review the installer before running it. Prefer installing dependencies in a virtual environment, avoid --break-system-packages, and only use sudo or antiword if you specifically need legacy .doc support. Treat extracted text, metadata, and batch output files as potentially sensitive, especially when processing business or personal documents.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
install.sh:44
Finding

Unpinned Python Dependency Installed into the System-Managed Environment

Content
View full analysis

Vulnerability Details

File Location: install.sh:44-48
Vulnerability Type: Unpinned third-party dependency installation and bypass of system package protections
Risk Level: Medium

Vulnerable Code:

bash
if python3 -m pip install python-docx --break-system-packages 2>/dev/null; then
    echo "   ✅ python-docx installation completed"
elif python3 -m pip install python-docx 2>/dev/null; then
    echo "   ✅ python-docx installation completed"
else

Technical Analysis

The installation script downloads python-docx without specifying an audited version or verifying an integrity hash. The effective dependency content may therefore change between installations as package releases change.

The preferred installation command also passes --break-system-packages. This option bypasses protections intended to prevent pip from modifying a Python environment managed by the operating system. Installing directly into that environment can replace or conflict with packages used by unrelated system applications.

Related unpinned installation instructions also appear in SKILL.md:17-23, SKILL.md:209-213, README.md:24-26, and skill.json:20-23.

Attack Path

  1. A user executes install.sh to install the Skill.
  2. The script asks pip to resolve the current python-docx package without a version constraint or integrity hash.
  3. If the dependency source or a newly published dependency artifact has been compromised, pip downloads the affected artifact.
  4. Package installation code runs with the privileges of the user executing the installer.
  5. Because the preferred command uses --break-system-packages, the package is permitted to modify the system-managed Python environment.
  6. Malicious dependency code can subsequently execute when scripts/read_word.py imports the docx module.

This is a supply-chain exposure rather than evidence that the currently named package is m ...[truncated 610 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin python-docx and its transitive dependencies to reviewed versions.

  2. Record cryptographic hashes in a requirements lock file and install with hash enforcement:

    bash
    python3 -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.txt

  3. Remove --break-system-packages and use a dedicated virtual environment so the Skill cannot alter the operating system's managed Python packages.

  4. Use a trusted, explicitly configured package index and retain dependency artifacts or a lock file for reproducible installations.

  5. Apply the same pinned installation instructions consistently in SKILL.md, README.md, and skill.json.

  6. Run dependency vulnerability and provenance checks before publishing each release.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (33)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation encourages extraction of Word text, tables, metadata, and batch output without warning that documents may contain sensitive content and embedded metadata such as author names and timestamps. In practice, users may inadvertently expose confidential information in console logs, saved result files, or downstream systems, especially in batch-processing workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file documents bulk extraction of Word documents and writing the results to JSON/Markdown files, including document metadata such as author and timestamps. Because these operations can expose sensitive user data at scale, the skill description should explicitly warn users that extracted content and metadata may contain confidential information and will be written to disk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises shell execution and likely file-writing behavior via installation and output features, but it declares no explicit tool scope or permissions. In agent environments, missing scope boundaries can cause the skill to be invoked with broader capabilities than users expect, increasing the chance of unintended command execution or file modification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

The embedded install command explicitly uses sudo to install a system package. Even though this appears intended for dependency setup, privileged shell commands are sensitive because they modify the host environment and, if copied into automated workflows, can expand the blast radius of a compromised or misused skill.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
{
              "id": "system",
              "kind": "system",
              "command": "sudo apt-get install antiword -y",
              "label": "Install antiword for .doc support (optional)",
              "platform": "linux-debian"
            }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill includes privileged installation instructions using sudo without an explicit warning about system-level changes. In an agent or semi-automated environment, this can normalize elevated command execution and lead users to run root-level package installation without evaluating trust, provenance, or platform impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This skill is designed to extract full document text, tables, and metadata from Word files, which commonly contain confidential business or personal data. Omitting a privacy warning increases the risk that users process sensitive documents without understanding exposure, retention, or downstream sharing implications.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
94% confidence
Finding

The troubleshooting section repeats a sudo-based package installation command without cautionary context. Repetition of privileged commands in user-facing documentation increases the likelihood of unsafe copy-paste execution and reinforces elevated access as normal operating procedure.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

对于 .doc 格式支持：

bash
# Ubuntu/Debian
sudo apt-get install antiword

# macOS
brew install antiword

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

All user-facing comments and output strings in the script are in Chinese, and the file provides no language selection, opt-in, or justification for being locale-specific. This is a natural-language policy issue because it imposes a specific language on users rather than offering a choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The demo script conditionally changes permissions on the skill's Python file with chmod +x, which is a filesystem modification outside the stated read/extract-only Word parsing purpose. While this targets a local skill file rather than arbitrary user input, it still violates least privilege and can normalize self-modifying installer behavior in a demo script.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The .doc path processes untrusted documents by invoking an external system binary (antiword), which increases attack surface beyond pure in-process parsing. If antiword has memory-safety or parser vulnerabilities, a crafted .doc file could trigger code execution or process compromise in the context running the skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/read_word.py (reported line 69)May include surrounding context.

python
try:
            # 检查 antiword 是否可用
            result = subprocess.run(['which', 'antiword'], 
                                  capture_output=True, text=True)
            if result.returncode != 0:
                raise Exception("antiword 未安装。请安装 antiword: Ubuntu/Debian: sudo apt-get install antiword; macOS: brew install antiword")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/read_word.py (reported line 75)May include surrounding context.

python
raise Exception("antiword 未安装。请安装 antiword: Ubuntu/Debian: sudo apt-get install antiword; macOS: brew install antiword")
            
            # 使用 antiword 转换
            result = subprocess.run(['antiword', str(self.file_path)], 
                                  capture_output=True, text=True, encoding='utf-8')
            
            if result.returncode != 0:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes a reader/extractor for Word documents, which implies analyzing existing files and returning their contents. In batch mode, the script persists aggregated results to a user-specified file, adding file-write behavior beyond simple document reading.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

In batch mode, the code opens the output path for writing and serializes all extracted results, which may include full document text and metadata. Although the code prints a success message afterward, it does not disclose beforehand that it will persist potentially sensitive content or overwrite the specified file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The stated purpose is reading and extracting text from Word documents, but this code writes transformed content to a separate output file when requested. That is a broader behavior than a pure reader and should be reflected in the declared skill scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code writes the processed document output directly to the path provided by the user, and the extracted content can include full text, tables, image references, and metadata. There is no prior warning or confirmation that sensitive document contents will be stored locally or that an existing file may be replaced.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · DEVELOPMENT.md (reported line 84)May include surrounding context.

md
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

md
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · demo.sh (reported line 69)May include surrounding context.

sh
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 33)May include surrounding context.

sh
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 34)May include surrounding context.

sh
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 36)May include surrounding context.

sh
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 67)May include surrounding context.

sh
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/read_word.py (reported line 72)May include surrounding context.

python
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.json (reported line 23)May include surrounding context.

json
"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

Static analysis

No suspicious patterns detected.