T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:67- Finding
Agent Safety and Verification Suppression Through Skill Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Word 光标插入
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it modifies the active Word document while discouraging verification and printing nearby document text to logs.
Install only if you are comfortable with a skill that can edit the currently active Word document in place. Before running it, put the cursor in the intended document and avoid using it on confidential documents unless you accept that nearby text may appear in command output or agent logs. Prefer reviewed, pinned dependency versions and do not treat the script's success message as the only possible check when accuracy matters.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:116- Finding
Unpinned Third-Party Dependencies Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is written entirely in Chinese and repeatedly frames the workflow around Chinese text handling, such as defaulting to Chinese command-line content. This indicates a locale/language assumption without offering the user a language choice or documenting that the skill is intentionally region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The invocation examples are broad enough to match generic Word-editing or report-writing requests, which can cause the skill to trigger in situations beyond simple cursor insertion. Because the skill can inspect document context and modify the active document, overly broad routing increases the risk of unintended execution and document changes without sufficiently specific user intent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill explicitly instructs the agent to compute counts, sums, or other report values before inserting them into Word, which expands its scope from a bounded document-editing action into arbitrary data processing. That broadening increases the chance the skill will be selected for tasks involving external data interpretation or computation, potentially causing unintended access, misuse of unrelated files, or incorrect autonomous transformations before insertion.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The fast-path example embeds source reading and computation directly into the insertion workflow, including sample code that derives values before writing to Word. This encourages the agent to combine data access, transformation, and document modification in one step, reducing separation of duties and making overbroad or unsafe automation more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest explicitly states that the skill connects to the currently open Word document and inserts text or tables at the cursor, but it does not clearly warn users that it will modify an active document. This creates a real safety issue because users may invoke it without fully understanding that live document contents will be altered, which can lead to unintended edits, data corruption, or insertion into the wrong document.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The guidance explicitly states 'Chinese text goes through FILES, not the command line,' which imposes a specific language/locale handling requirement in natural language. The document does not offer user opt-in or explain that the skill is intentionally limited to a Chinese-language regional context, so this is a policy-relevant locale constraint.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script prints up to 200 characters before and after the current Word selection to stdout, which can expose sensitive document content unrelated to the insertion operation. In an agent environment where stdout may be logged, surfaced to other components, or retained in execution traces, this creates an unintended data leakage channel from potentially confidential Word documents.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script prints operational messages containing Chinese text such as "幂等跳过" and "字" in user-facing console output. This imposes a specific language/locale on users without any opt-in or documented locale constraint, which matches the natural-language policy violation criteria.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes inserting a selected passage or Excel/CSV content into Word, emphasizing text and tables from those sources. The implementation adds a separate capability to read any UTF-8 text file from disk with --file and insert its contents, which is broader than the described behavior.
- Content
Static analysis
No suspicious patterns detected.