Security audit

Officecli

Security checks for vulnerabilities and agentic risk

Overview

The skill is useful for Office document work, but it asks agents to install and trust an external CLI in ways that give mutable remote code and generated instructions too much authority.

Install only if you trust the officecli publisher and distribution endpoint. Prefer downloading a versioned installer or release artifact, verifying its signature or checksum, and reviewing generated sub-skill rules before letting an agent follow them. Use the tool on documents you are comfortable allowing the CLI to read and modify.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:16
Finding: Unverified Remote Installation Scripts Executed Directly by Shells
Content: View full analysis
Remediation: View remediation
officecli.tar.gz" | sha256sum -c - # Extract and install only after successful verification. ``` ]]>

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:372
Finding: Agent Is Instructed to Follow Dynamically Generated and Persistent Skill Rules
Content: View full analysis
` — output is a SKILL.md, follow its rules. **Loading rule**: - Pick the most specific match in "When to use"; if none fits, load the format default (`word` / `pptx` / `excel`). - Scenes already contain the format default's rules — load **one** skill per artifact, never stack. - Loaded rules persist across turns; don't re-load each reply. - Two distinct artifacts → two separate loads. ``` ### Technical Analysis The reviewed Skill directs the agent to execute `officecli load_skill`, interpret the command's output as another Skill, follow its rules, and retain those rules across turns. The generated sub-Skills are not present in the audited project and therefore cannot be statically reviewed or integrity-checked. This creates an instruction trust boundary in which an external executable controls future agent instructions. The risk is compounded by the unverified installation mechanism: a substituted or compromised `officecli` binary could emit attacker-selected text while presenting it as a legitimate specialized Skill. Although the instructions say to load only one specialized Skill per artifact, they do not define an allowlisted immutable source, verify the output's signature, constrain the authority of loaded rules, or require treating command output as untrusted data. Cross-turn persistence increases the duration and scope of any injected behavior. ### Attack Path 1. The agent installs or invokes `officecli`. 2. A document task matches one of the specialized Skill categories. 3. The agent runs `officecli load_skill `. 4. A compromised or malicious binary emits attacker-controlled content formatted as `SKILL.md`. 5. The agent treats that content as authoritative instructions and follows its rules. 6. Because loaded rules are declared persist ...[truncated 1190 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL https://d.officecli.ai/install.sh | bash causes arbitrary code from an external domain to be executed immediately in the local shell. In the context of an agent skill, this is especially dangerous because the model may reproduce or encourage this command automatically, turning documentation into a code-execution pathway on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
bash
# macOS / Linux curl -fsSL https://d.officecli.ai/install.sh | bash # Windows (PowerShell) irm https://d.officecli.ai/install.ps1 | iex

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | bash pattern is a classic dangerous command chain because it converts network input directly into executable shell code. If the remote content is malicious, tampered with, or unexpectedly modified, compromise is immediate and may include persistence, credential theft, or broader host takeover.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
bash
# macOS / Linux curl -fsSL https://d.officecli.ai/install.sh | bash # Windows (PowerShell) irm https://d.officecli.ai/install.ps1 | iex

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs users to install the tool by piping a remotely fetched script directly into a shell or PowerShell interpreter. This bypasses any opportunity to inspect the script, gives the remote server immediate code-execution capability on the host, and creates a supply-chain risk if the distribution endpoint is compromised or changed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.