Security audit

Word 光标插入

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it can modify a live Word document and unnecessarily prints nearby document text and inserted table rows to stdout, which may expose sensitive content in logs.

Install only if you are comfortable with an automation that controls the currently active Word document and may print nearby document text and sample table rows into command output. Use it only with non-sensitive documents or after reviewing/removing the content-bearing stdout logs, and make sure the intended Word document and cursor position are active before running it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill accepts arbitrary local file content via `--file` and inserts it into Word, which expands behavior beyond the stated scope of selected text or Excel/CSV insertion. This can be abused to read unintended local files and copy their contents into a document, creating a capability mismatch that may expose sensitive data or bypass user expectations and policy controls.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill reads text surrounding the current Word cursor and prints that context to stdout, even though this data access and disclosure are not described in the manifest. Nearby document text often contains sensitive report content, so exposing it through logs or tool output creates an information disclosure channel beyond the expected insertion function.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger examples are broad enough to match many ordinary Word-editing requests, which can cause the skill to activate without a clear user request to use this specific automation. Because the skill directly controls a live Word instance and inserts content at the cursor, ambiguous activation increases the risk of unintended document modification or accidental data insertion into the wrong place.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The description is written only in Chinese, which can steer interaction into a specific language without confirming the user's preference. This is primarily a safety and usability issue: the user may misunderstand what the skill does or approve an operation affecting a live document without fully understanding the prompt or output.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code emits surrounding document context and table-location state to stdout without a user-facing warning or consent mechanism. In agent or managed environments, stdout is often logged, surfaced to orchestration layers, or retained for troubleshooting, so this can leak sensitive document contents outside Word.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: After inserting a table, the skill prints the first and last inserted rows to stdout without disclosure. Table data sourced from CSV/Excel commonly contains confidential business or personal information, so echoing row contents into logs creates an unnecessary exfiltration path.

Static analysis

No suspicious patterns detected.