ClawHub
Back to skill

Security audit

Superdoc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent SuperDoc DOCX helper; its main risks are ordinary document file writes and npm installation hygiene, not hidden or malicious behavior.

Before installing, treat this as a document-editing helper that can read and write local DOCX files. Use copies or backups for important documents, keep generated files in a deliberate output folder, protect client data such as names and email addresses, and prefer pinned project-local npm dependencies over global unpinned installs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:105
Finding
Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md:105`, `SKILL.md:129`, and `references/superdoc-reference.md:6` **Vulnerability Type**: Unpinned npm dependencies and global package installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:105`: ```bash npm install --global superdoc jsdom ``` `SKILL.md:129`: ```bash npm install @superdoc-dev/react ``` `references/superdoc-reference.md:6`: ```markdown **Installation:** `npm install superdoc` (for projects) or `npm install @superdoc-dev/react` (for React) ``` ### Technical Analysis The installation instructions do not pin the packages to exact, reviewed versions and do not require lockfile or integrity verification. Consequently, npm resolves whichever package releases and transitive dependencies are current when the commands are executed. This makes the installed code mutable after the skill has been audited. The global installation command presents additional risk because it modifies the user's global Node.js environment. npm packages can define installation lifecycle scripts, which may execute with the permissions of the user running npm. If a named package, its publisher account, or one of its transitive dependencies is compromised in the future, following these instructions could execute attacker-controlled code. The package names correspond to the documented SuperDoc packages, and the project does not contain evidence of dependency confusion, typosquatting, a malicious source, or an existing malicious payload. The finding concerns unsafe dependency acquisition practices and the resulting supply-chain exposure. ### Attack Path 1. A user follows the documented installation command. 2. npm resolves the latest available versions of the named packages and their transitive dependencies. 3. A package publisher account, package release, or transitive dependency has been compromised or contains a malicious lifecycle script. 4. npm downloads th ...[truncated 930 chars]
Remediation
## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version, such as `superdoc@1.17.0`, rather than allowing npm to select a mutable latest release. 2. Specify and review an exact compatible version of `jsdom` and `@superdoc-dev/react`. 3. Prefer project-local dependencies over global installation: ```bash npm install --save-exact superdoc@1.17.0 jsdom@REVIEWED_VERSION npm install --save-exact @superdoc-dev/react@REVIEWED_VERSION ``` 4. Commit a reviewed `package-lock.json` and direct users or automation to run `npm ci`, ensuring reproducible dependency resolution. 5. Verify npm package provenance, publisher identity, registry source, and integrity metadata before installation. 6. Audit direct and transitive dependencies with appropriate software-composition-analysis tooling. 7. Where compatible with the packages' documented installation process, disable lifecycle scripts using `npm ci --ignore-scripts` and explicitly run only reviewed setup steps. 8. Execute dependency installation in a minimally privileged, isolated development environment rather than under an administrative account.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This markdown example generates personalized documents from client data including names and email addresses, which can involve sensitive or personal information. The skill description does not warn users about protecting input data, securing generated files, or validating output destinations.

Missing User Warnings

Low
Confidence
88% confidence
Finding
This markdown file includes code examples that save generated documents directly with `fs.writeFileSync`, which affects user data on the local filesystem. The surrounding skill description explains document creation/editing, but it does not warn users about file writes, overwrites, or choosing safe output paths.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The markdown demonstrates loading an existing DOCX, modifying text, and writing a new output file, but provides no user-facing warning about handling potentially sensitive document contents or reviewing changes before saving. For a skill that edits user documents, a caution about data integrity and backup/review is expected.

Static analysis

No suspicious patterns detected.