ClawHub
Back to skill

Security audit

文档问答助手

Security checks across malware telemetry and agentic risk

Overview

This local document QA skill is mostly aligned with its purpose, but its PDF handling can turn an untrusted PDF filename into unintended Python code execution.

Install only if you are comfortable reviewing or fixing the PDF parser first. Do not point it at untrusted directories or PDFs with unusual filenames; prefer TXT/Markdown files or a patched version that opens PDFs directly without python3 -c. Also note that several advertised features are not actually included in the package.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
elif ext == ".pdf":
        try:
            import subprocess
            result = subprocess.run(["python3", "-c",
                f"import pdfplumber; print(pdfplumber.open('{path}').pages[0].extract_text())"],
                capture_output=True, text=True)
            return result.stdout or "[PDF读取失败]"
Confidence
95% confidence
Finding
result = subprocess.run(["python3", "-c", f"import pdfplumber; print(pdfplumber.open('{path}').pages[0].extract_text())"], capture_output=True, text=True)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises and instructs use of local-document processing scripts that inherently require filesystem access and shell execution, yet it declares no permissions. That creates a transparency and policy-enforcement gap: operators and orchestration systems may invoke a skill with more capability than is explicitly disclosed, increasing the chance of unauthorized file access or unsafe execution in sensitive environments.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The skill description materially overstates implemented capabilities, including support for file types and verification behaviors that are not actually present. This is dangerous because users and higher-level agents may rely on nonexistent cross-validation, summarization, or broad document support when making decisions, leading to incorrect outputs, misplaced trust, and potentially unsafe handling of sensitive documents.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The PDF handler launches a subprocess that executes dynamically constructed Python code based on user-controlled input, which unnecessarily expands the attack surface beyond simple document reading. Because the skill's purpose is local document QA, this extra execution capability is unjustified and turns document ingestion into a code-execution pathway.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.