doc-coauthoring
Verdict safe, but 1 finding (1 medium), mainly prompt injection. Most recent scan 2026-02-06.
This is a byte-identical copy of doc-coauthoring from anthropic, which is the primary page for this skill. Same SKILL.md, same files; each copy is scanned separately so divergence shows up here.
The doc-coauthoring skill presents a MEDIUM security risk primarily due to transitive trust abuse when fetching external shared documents. The skill instructs the agent to fetch and process content from user-provided external links without validation, creating an indirect prompt injection vector. Additionally, the skill references Python files (this.py, messaging.py) that are not included in the package, suggesting incomplete packaging or potential confusion about dependencies. The skill lacks optional metadata fields (license, compatibility, allowed-tools) which reduces transparency. The core workflow itself (context gathering, refinement, reader testing) appears benign and focused on legitimate documentation co-authoring tasks. No data exfiltration, credential theft, or command injection patterns were detected. The primary concern is the uncritical trust placed in external document sources.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.
- Package
- 1 file, 15 KB
- SKILL.md
- 2404 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Doc Co-Authoring Workflow · When to Offer This Workflow · Stage 1: Context Gathering · Initial Questions · Info Dumping · Stage 2: Refinement & Structure · Step 1: Clarifying Questions · Step 2: Brainstorming · Step 3: Curation · Step 4: Gap Check · Step 5: Drafting · Step 6: Iterative Refinement
Findings
MEDIUM Transitive Trust Abuse via External Shared Documents Prompt Injectionllm
The skill instructs the agent to fetch and trust content from external shared documents provided by users (e.g., 'use the appropriate integration to fetch it' when user provides a link). This creates an indirect prompt injection vector where malicious instructions could be embedded in externally-hosted documents that the agent will then follow. The skill delegates trust to untrusted external content without validation or sandboxing.
SKILL.md
'If they provide a link to a shared document, use the appropriate integration to fetch it' and 'Use the appropriate integration to read the current state' - The skill instructs fetching and processing external document content without security controls.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 15 KB |
External hosts referenced
claude.ai
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/doc-coauthoring
- Raw scan result: doc-coauthoring-scan.json
- Badge for your README:
- Request a re-scan