ClawHub
Back to skill

Security audit

MiniMax DOCX

Security checks for vulnerabilities and agentic risk

Overview

This DOCX skill mostly matches its purpose, but its setup can install software, run a mutable remote installer, and persist shell PATH changes.

Install only if you are comfortable reviewing and running a setup script that may install packages, use sudo, fetch a remote dotnet installer, modify ~/.bashrc, and restore NuGet packages. Prefer provisioning .NET and optional tools yourself, use --minimal, and avoid applying untrusted DOCX templates unless external links/relationships are stripped or reviewed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/setup.sh:109
Finding

Unverified Remote Installer Download and Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dotnet/MiniMaxAIDocx.Core/Commands/ApplyTemplateCommand.cs:262
Finding

Unvalidated External Relationships Propagated from DOCX Templates

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (116)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes environment inspection, build, restore, setup, and dependency-check behavior that is materially broader than a simple document-processing capability. In a security-sensitive agent setting, such hidden operational breadth can expose system details, modify the environment, or expand attack surface under the guise of formatting a Word document.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes environment inspection, build, restore, setup, and dependency-check behavior that is materially broader than a simple document-processing capability. In a security-sensitive agent setting, such hidden operational breadth can expose system details, modify the environment, or expand attack surface under the guise of formatting a Word document.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill includes environment inspection, build, restore, setup, and dependency-check behavior that is materially broader than a simple document-processing capability. In a security-sensitive agent setting, such hidden operational breadth can expose system details, modify the environment, or expand attack surface under the guise of formatting a Word document.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation rule says the skill MUST be used for a very broad set of formal-writing requests, even when the user does not explicitly ask for DOCX output. Because this skill has shell-execution behavior, overbroad routing can cause unnecessary command execution and file-processing workflows to be invoked for ordinary writing tasks that should remain in-text.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger list contains highly generic terms such as 'document', '报告', and '排版', which are likely to collide with everyday conversation and unrelated tasks. In context, that is more dangerous because this skill can launch shell/setup/doc-processing actions, making accidental invocation materially risky rather than merely inconvenient.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/cjk_typography.md (reported line 73)May include surrounding context.

xml
<w:rFonts
  w:ascii="Calibri"        <!-- Latin characters (U+0000–U+007F) -->
  w:hAnsi="Calibri"        <!-- Latin extended, Greek, Cyrillic -->
  w:eastAsia="SimSun"      <!-- CJK Unified Ideographs, Kana, Hangul -->
  w:cs="Arial"             <!-- Arabic, Hebrew, Thai, Devanagari -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_good_bad_examples.md (reported line 26)May include surrounding context.

└──────────────────────────────────┘

text
```xml
<!-- H1: bold but same size as body — no visual separation -->
<w:rPr><w:b/><w:sz w:val="24"/></w:rPr>
<!-- Body -->
<w:rPr><w:sz w:val="24"/></w:rPr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_good_bad_examples.md (reported line 77)May include surrounding context.

text
```xml
<w:rPr><w:b/><w:sz w:val="56"/></w:rPr>  <!-- 28pt heading -->
<w:rPr><w:sz w:val="20"/></w:rPr>         <!-- 10pt body -->

GOOD: H1=20pt with body=11pt (ratio ~1.8x)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_good_bad_examples.md (reported line 108)May include surrounding context.

xml
<w:pPr>
  <w:spacing w:line="240" w:lineRule="auto"/>  <!-- 1.0 spacing (240/240) -->
  <w:spacing w:after="0"/>                     <!-- no paragraph gap -->
</w:pPr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_principles.md (reported line 56)May include surrounding context.

text

```xml
<!-- Page margins: 1 inch = 1440 twips on all sides -->
<w:pgMar w:top="1440" w:right="1440" w:bottom="1440" w:left="1440"
         w:header="720" w:footer="720" w:gutter="0"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_principles.md (reported line 299)May include surrounding context.

md
<w:spacing w:before="360" w:after="120"/>
</w:pPr>

<!-- Body paragraph: 0pt before, 8pt after -->
<w:pPr>
  <w:spacing w:before="0" w:after="160"/>
</w:pPr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design_principles.md (reported line 550)May include surrounding context.

md
</w:rPr>
</w:style>

<!-- Apply consistently: every H2 references the style -->
<w:p>
  <w:pPr>
    <w:pStyle w:val="Heading2"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/openxml_encyclopedia_part3.md (reported line 1030)May include surrounding context.

csharp
// <w:r>
//   <w:rPr>
//     <w:b/>  <!-- New: bold -->
//     <w:rPrChange w:id="7" w:author="Bob" w:date="2026-03-22T11:00:00Z">
//       <w:rPr/>  <!-- Old: no formatting -->
//     </w:rPrChange>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scenario_b_edit_content.md (reported line 84)May include surrounding context.

When the entire search text is within a single w:r (run):

xml
<!-- Before -->
<w:r>
  <w:rPr><w:b /></w:rPr>
  <w:t>{{companyName}}</w:t>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scenario_c_apply_template.md (reported line 164)May include surrounding context.

Critical distinction: w:styleId vs w:name:

xml
<!-- styleId="1" but name="heading 1" -->
<w:style w:type="paragraph" w:styleId="1">
  <w:name w:val="heading 1"/>
  <w:basedOn w:val="a"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scenario_c_apply_template.md (reported line 246)May include surrounding context.

xml
   <!-- Source -->
   <w:pPr><w:pStyle w:val="Heading1"/></w:pPr>
   <!-- After mapping -->
   <w:pPr><w:pStyle w:val="1"/></w:pPr>

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

ResolveComment ignores the supplied commentId and marks the first matching extensible comment element as done, so callers cannot reliably resolve the intended comment. In a document automation skill that may process legal, business, or approval documents, this can silently falsify review state, hide unresolved issues, or mark the wrong thread as complete, undermining document integrity and auditability.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/HeaderFooterSamples.cs (reported line 24)May include surrounding context.

text
///   <w:headerReference w:type="default" r:id="rId7"/>
///   <w:footerReference w:type="default" r:id="rId8"/>
///   <w:headerReference w:type="first" r:id="rId9"/>
///   <w:titlePg/>   <!-- needed to activate first-page header/footer -->
/// </w:sectPr>
///
/// Header/Footer XML (in separate part):

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/HeaderFooterSamples.cs (reported line 490)May include surrounding context.

text
///       <w:gridCol w:w="3120"/> <w:gridCol w:w="3120"/> <w:gridCol w:w="3120"/>
    ///     </w:tblGrid>
    ///     <w:tr>
    ///       <w:tc> <!-- left: logo text -->  </w:tc>
    ///       <w:tc> <!-- center: title -->    </w:tc>
    ///       <w:tc> <!-- right: page num -->  </w:tc>
    ///     </w:tr>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/TableSamples.cs (reported line 274)May include surrounding context.

text
///     <w:tblBorders>
    ///       <w:top w:val="single" w:sz="12" w:space="0" w:color="000000"/>
    ///       <w:bottom w:val="single" w:sz="12" w:space="0" w:color="000000"/>
    ///       <!-- No left, right, insideV borders -->
    ///       <w:insideH w:val="none" w:sz="0" w:space="0" w:color="auto"/>
    ///       <w:insideV w:val="none" w:sz="0" w:space="0" w:color="auto"/>
    ///     </w:tblBorders>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/TableSamples.cs (reported line 552)May include surrounding context.

text
/// XML:
    /// <w:tblGrid>
    ///   <w:gridCol w:w="1440"/>   <!-- 1 inch -->
    ///   <w:gridCol w:w="4680"/>   <!-- 3.25 inches -->
    ///   <w:gridCol w:w="3240"/>   <!-- 2.25 inches -->
    /// </w:tblGrid>
    ///

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/dotnet/MiniMaxAIDocx.Core/Samples/TableSamples.cs (reported line 865)May include surrounding context.

text
/// Row 1: <w:tcPr><w:vMerge w:val="restart"/></w:tcPr>
    ///         <w:p><w:r><w:t>Visible content</w:t></w:r></w:p>
    /// Row 2: <w:tcPr><w:vMerge/></w:tcPr>
    ///         <w:p/>   <!-- MUST still have a paragraph, even though cell is merged -->
    /// Row 3: <w:tcPr><w:vMerge/></w:tcPr>
    ///         <w:p/>   <!-- MUST still have a paragraph -->
    ///

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/setup.sh (reported line 113)May include surrounding context.

sh
sudo apt-get update -qq
                sudo apt-get install -y -qq wget apt-transport-https
                wget -q "https://dot.net/v1/dotnet-install.sh" -O /tmp/dotnet-install.sh
                chmod +x /tmp/dotnet-install.sh
                /tmp/dotnet-install.sh --channel 8.0 --install-dir "$HOME/.dotnet"
                export PATH="$HOME/.dotnet:$PATH"
                echo 'export PATH="$HOME/.dotnet:$PATH"' >> "$HOME/.bashrc"
            fi
            ;;
        dnf)
            sudo dnf install -y dotnet-sdk-8.0
            ;;
        pacman)
            sudo pacman -S --noconfirm dotnet-sdk
            ;;
        zypper)
            sudo zypper install -y dotnet-sdk-8.0
            ;;
        apk)
            apk add --no-cache dotnet8-sdk
            ;;
        none)
            if [ "$OS" = "windows-git-bash" ]; then
                fail "On Windows, install .NET SDK from: https://dotnet.microsoft.com/download"
                fail "

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

The use of --noconfirm with pacman suppresses an important safety checkpoint for privileged package installation. In an agent setup script, bypassing confirmation increases the chance of unintended or silent host changes and reduces the user's opportunity to inspect what will be installed.

Content

Scanner excerpt · scripts/setup.sh (reported line 120)May include surrounding context.

sh
sudo dnf install -y dotnet-sdk-8.0
            ;;
        pacman)
            sudo pacman -S --noconfirm dotnet-sdk
            ;;
        zypper)
            sudo zypper install -y dotnet-sdk-8.0

Static analysis

No suspicious patterns detected.