doc-coauthoring
Verdict safe, but 2 findings (2 medium), mainly prompt injection, unauthorized tool use. Most recent scan 2026-02-01.
Byte-identical copies of this skill are also published by clawhub.ai. Same SKILL.md, same files; each copy is scanned separately so divergence shows up here.
The doc-coauthoring skill presents MEDIUM security risks primarily related to transitive trust abuse and undefined integration usage. The skill instructs the agent to fetch and process content from external shared documents without validation, creating a vector for indirect prompt injection attacks. An attacker could share a malicious document containing instructions that the agent would execute. The skill also references undefined 'integrations' without specifying which are allowed or how their outputs should be validated. Additionally, two Python files are referenced but missing from the package. The skill lacks optional metadata fields that would help define security boundaries. While the core documentation workflow concept is legitimate, the external document fetching functionality requires security controls before production use.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.
- Package
- 1 file, 15 KB
- SKILL.md
- 2404 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Doc Co-Authoring Workflow · When to Offer This Workflow · Stage 1: Context Gathering · Initial Questions · Info Dumping · Stage 2: Refinement & Structure · Step 1: Clarifying Questions · Step 2: Brainstorming · Step 3: Curation · Step 4: Gap Check · Step 5: Drafting · Step 6: Iterative Refinement
Findings
MEDIUM Transitive Trust Abuse via External Shared Documents Prompt Injectionllm
The skill instructs the agent to fetch and trust content from external shared documents (e.g., Google Docs, Notion) using integrations. When a user provides a link to a shared document or mentions editing an existing shared document, the skill directs the agent to 'use the appropriate integration to fetch it' and 'read the current state'. This creates a transitive trust vulnerability where the agent will follow instructions or content from untrusted external sources without validation. An attacker could share a malicious document containing prompt injection instructions that the agent would then execute.
SKILL.md
'If they provide a link to a shared document, use the appropriate integration to fetch it' and 'If user mentions editing an existing shared document: Use the appropriate integration to read the current state'MEDIUM Undefined Integration Tool Usage Without Validation Unauthorized Tool Usellm
The skill references 'appropriate integration' multiple times to fetch external documents but does not specify which integrations are allowed or how they should be validated. The manifest lacks 'allowed-tools' specification, and the instructions assume integration capabilities exist without defining security boundaries. This could lead to unauthorized tool use or tool exploitation if malicious integrations are available or if legitimate integrations are misused to access sensitive external resources.
SKILL.md
'use the appropriate integration to fetch it' - no specification of which integrations are safe or allowed, no validation of integration outputsWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 15 KB |
External hosts referenced
claude.ai
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit 69c0b1a06741. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/anthropics/skills/tree/main/skills/doc-coauthoring
- Raw scan result: skills-doc-coauthoring-scan.json
- Badge for your README:
- Request a re-scan