Security audit

国央企word文档

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Word document generator with no hidden network, credential, persistence, or destructive behavior found.

Before installing, consider pinning the docx dependency exactly for reproducible installs. Users may also need to adjust the absolute require path shown in examples to match their installed skill path.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Unpinned Dependencies

Low

Category: Supply Chain
Content: "description": "创建符合中国政府及央企规范的Word文档(.docx)", "author": "刘洪亮", "dependencies": { "docx": "^9.6.1" } }
Confidence: 95% confidence
Finding: "docx": "^9.6.1"

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: node_modules/@types/node/child_process.d.ts:122

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/@types/node/repl.d.ts:40

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/@types/node/vm.d.ts:542

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/docx/dist/index.cjs:21152

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/docx/dist/index.iife.js:21152

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/docx/dist/index.mjs:21150

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/docx/dist/index.umd.cjs:21154

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/jszip/dist/jszip.js:11404

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/jszip/dist/jszip.min.js:13

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/setimmediate/setImmediate.js:17

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/xml-js/dist/xml-js.js:7928

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: node_modules/xml-js/dist/xml-js.min.js:8

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: node_modules/@types/node/http.d.ts:1390

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/@types/node/crypto.d.ts:539

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: node_modules/jszip/dist/jszip.js:1297

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: node_modules/jszip/lib/utils.js:382