ClawHub
Back to skill

Security audit

1. The input is a Word template document; 2. Analyze the structure of this template, including: 1) Font styles, sizes, etc., for headings, body text, etc.; 2) Content: the general structure of each paragraph; 3) Multimedia elements: images, text, tables (including metric data, etc.) 3. Generate documents that conform to the template structure based on the given data 1) A knowledge base, or multiple documents; 2) Relationship tables (or CSV files), SQL query results, etc.

Security checks across malware telemetry and agentic risk

Overview

This is a coherent template-based document generation skill, but users should be careful because it may process sensitive local documents with a cloud model.

Install only if you are comfortable using your chosen OpenClaw environment and the glm-5 cloud model with the templates, reports, CSVs, SQL results, or knowledge-base content you provide. Avoid using confidential, regulated, or internal-only data unless your organization approves that model/provider, and review generated documents manually before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly states that local files and data sources are read, processed, written to output files, and analyzed by a cloud-hosted model, but it does not provide any user-facing warning, consent step, or data-handling limitation. In this context, the inputs may include reports, SQL query results, knowledge-base content, and other potentially sensitive organizational data, so undisclosed transmission to a cloud model and local persistence create meaningful confidentiality and privacy risk.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill description is very broad: it claims to generate formal documents from Word templates, knowledge-base documents, multiple files, CSV/relational tables, and SQL query results, but it does not define clear invocation boundaries or acceptable input conditions. In a skill that also exposes read, write, and exec tools, this ambiguity increases the chance the agent is invoked in unsafe or unintended contexts, leading to overreach, mishandling of sensitive data, or execution of risky downstream actions.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The description is written to operate in Chinese without indicating that language selection depends on user preference or configuration. While not inherently dangerous by itself, forced language behavior can cause misunderstanding of prompts, outputs, approvals, or generated documents, which is more concerning in a document-generation skill handling structured enterprise data and templates.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.