Security audit

智能文档处理Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is not showing exfiltration or destructive behavior, but it materially misrepresents document-processing results by returning fabricated content instead of reading files.

Review this carefully before installing. It appears to be a mock or incomplete implementation, not a reliable document processor. Do not use it for real contracts, reports, compliance documents, or decisions unless the publisher replaces the fabricated outputs with real parsing and clearly documents file access, privacy, and conversion limits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill promotes document parsing, extraction, classification, and analysis across potentially sensitive formats, but it provides no warning that documents may contain confidential, regulated, or personal data. This increases the chance that users will submit contracts, reports, or other sensitive files without understanding privacy, retention, or exposure risks, making misuse more likely in real deployments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The OpenClaw invocation examples are extremely broad natural-language phrases such as '解析这个PDF文档' and '提取合同中的关键信息' without any trigger scoping, permission boundary, or confirmation requirement. In an agent environment, this can cause overbroad activation on ordinary user messages and lead to unintended processing of sensitive local documents, especially because the skill is designed to read, extract, summarize, and convert files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill advertises document parsing and analysis but never reads the supplied file, instead returning hardcoded text and fabricated metadata. This is dangerous because downstream users or agents may trust false summaries, metadata, and analysis results when making decisions about real documents.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s natural-language description and all user-facing messages are exclusively in Chinese, and metadata generation also fixes the language to 'zh-CN'. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated metadata always sets language: 'zh-CN', which forces a locale choice regardless of the document or user preference. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The format conversion function only changes the filename extension and reports success without transforming file contents. This can mislead callers into believing a conversion completed correctly, potentially causing data corruption, workflow failures, or incorrect handling of sensitive documents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This manifest file describes very broad capabilities such as document parsing, information extraction, content analysis, and format conversion, but does not define when the skill should be invoked or what phrases should trigger it. In a manifest context, such generic capability wording can overlap with many ordinary document-related requests and may cause unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language metadata is presented in Chinese throughout the description, tags, compatibility, and features, with no indication that users can choose another language or locale. This can violate language/locale policy requirements when a skill imposes a specific language without documented opt-in or region-specific justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.