Shuke Document Formatting

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:34 AM UTC
• Version: 1.0.1

Overview

This document-formatting skill is mostly purpose-aligned, but it asks users to run system-wide font installation and has PDF conversion behavior that can touch local or network resources without enough safeguards.

Review this skill before installing. Use it only in a trusted local environment, avoid running the font installer with sudo unless you have verified the font files and source directory yourself, process only trusted DOCX files, and delete generated debug HTML if it may contain sensitive content. Prefer a sandboxed or offline conversion environment for untrusted documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: install_shuke_fonts.py:143

Finding

Privileged System-Wide Installation of Unvalidated Font Files

Content

View full analysis

{dest_path}") return True ``` ### Technical Analysis The installer explicitly requires root privileges and copies recursively discovered files into a system-wide font directory. Candidate fonts are selected solely through broad substring matching against their filenames. The script does not verify: - Whether a candidate is a structurally valid font. - Whether its internal font family and metadata match the expected font. - Whether it came ...[truncated 1972 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: convert_to_pdf_shuke_final.py:213

Finding

Unrestricted Resource Resolution During HTML-to-PDF Conversion

Content

View full analysis

HTML print("1. Convert DOCX to HTML...") if not docx_to_html(docx_path, html_temp_path): return False # Step 2: Add document-format CSS print("2. Apply document formatting...") html_with_css = add_shuke_font_css(html_temp_path) # Optionally save HTML for debugging. debug_html = pdf_path.replace('.pdf', '_debug.html') with open(debug_html, 'w', encoding='utf-8') as f: f.write(html_with_css) print(f"Debug HTML saved: {debug_html}") # Step 3: HTML -> PDF print("3. Generate PDF...") if not convert_with_weasyprint(html_with_css, pdf_path): return False ``` ### Technical Analysis HTML generated from a user-supplied DOCX file is passed directly to WeasyPrint. No custom `url_fetcher`, URI-scheme allowlist, host allowlist, path restriction, response-size limit, or network isolation is configured. WeasyPrint can resolve resources referenced by HTML and CSS, including images, stylesheets, and fonts. If Pandoc preserves or creates a resource reference from document-controlled content, PDF rendering may initiate requests to remote URLs, internal services, or local filesystem resources. The conversion also saves the resulting HTML beside the output PDF, potentially preserving sensitive resource references or converted document content longer than necessary. This is especially significant wh ...[truncated 1683 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (51)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared scope is document formatting and PDF generation, but the observed behavior instead appears to verify fonts and inspect hardcoded paths in the local environment. This scope drift is security-relevant because environment probing and fixed-path access are not what users expect from a document-processing skill and may expose system information or touch unrelated files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared scope is document formatting and PDF generation, but the observed behavior instead appears to verify fonts and inspect hardcoded paths in the local environment. This scope drift is security-relevant because environment probing and fixed-path access are not what users expect from a document-processing skill and may expose system information or touch unrelated files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared scope is document formatting and PDF generation, but the observed behavior instead appears to verify fonts and inspect hardcoded paths in the local environment. This scope drift is security-relevant because environment probing and fixed-path access are not what users expect from a document-processing skill and may expose system information or touch unrelated files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared scope is document formatting and PDF generation, but the observed behavior instead appears to verify fonts and inspect hardcoded paths in the local environment. This scope drift is security-relevant because environment probing and fixed-path access are not what users expect from a document-processing skill and may expose system information or touch unrelated files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared scope is document formatting and PDF generation, but the observed behavior instead appears to verify fonts and inspect hardcoded paths in the local environment. This scope drift is security-relevant because environment probing and fixed-path access are not what users expect from a document-processing skill and may expose system information or touch unrelated files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared scope is document formatting and PDF generation, but the observed behavior instead appears to verify fonts and inspect hardcoded paths in the local environment. This scope drift is security-relevant because environment probing and fixed-path access are not what users expect from a document-processing skill and may expose system information or touch unrelated files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Requiring root to install fonts into /usr/share/fonts gives the skill elevated privileges unrelated to basic document formatting. In skill context, this is more dangerous because a formatting tool does not ordinarily need administrative execution, so compromise or misuse would have system-wide impact.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises scripts that read and write documents and invoke shell commands, but the manifest does not declare any tool scope or permission boundaries. This creates an authorization and transparency gap: an agent or reviewer cannot easily determine what filesystem or command execution access the skill expects, increasing the chance of over-privileged execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The line states that all documents use GBK encoding and that ZIP packaging should use English filenames to avoid garbling. This imposes a language/locale-related constraint in natural language without user opt-in, and the file does not explain why users must accept this restriction beyond compatibility convenience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code's natural-language content, including the top-level description and all printed status/output strings, is exclusively in Chinese. Under the policy criteria, forcing a specific language without user opt-in or a clearly documented locale-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · check_pdf_fonts.py (reported line 18)May include surrounding context.

python

"""
    # 尝试使用pdffonts
    try:
        result = subprocess.run(['pdffonts', pdf_path], 
                              capture_output=True, text=True, check=True)
        print("PDF字体信息:")
        print(result.stdout)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · check_pdf_fonts.py (reported line 28)May include surrounding context.

python

# 尝试使用pdfinfo
    try:
        result = subprocess.run(['pdfinfo', pdf_path], 
                              capture_output=True, text=True)
        if result.returncode == 0:
            print("PDF基本信息:")

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill enumerates host fonts via fc-list and prints the results, which goes beyond the minimum needed to format or validate a single document and leaks environment details. In an agent/runtime setting, this can aid host fingerprinting, reveal installed commercial fonts or locale configuration, and expose information about the execution environment to users or logs.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · check_pdf_fonts.py (reported line 75)May include surrounding context.

python

print("="*60)
    
    try:
        result = subprocess.run(['fc-list', ':lang=zh'], 
                              capture_output=True, text=True)
        if result.returncode == 0:
            fonts = result.stdout.strip().split('\n')

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · check_pdf_fonts.py (reported line 96)May include surrounding context.

python

available_fonts = []
    try:
        result = subprocess.run(['fc-list'], 
                              capture_output=True, text=True)
        font_list = result.stdout.lower()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest advertises font installation plus document and PDF generation, but it does not disclose that these operations may alter local documents, create output files, or change system font state. In a skill that handles local files and font installation, missing transparency raises the risk of unintended system modification and reduces informed user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The trigger keywords include generic phrases such as '格式化文档', '生成PDF', and '文档格式化' that can match routine document-processing requests unrelated to the intended company-specific workflow. This can cause the skill to activate unexpectedly in broader contexts, increasing the chance that users invoke file-modifying or PDF-generation behavior without clear intent or appropriate review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents its description and all CLI messages in Chinese, and the implementation does not provide any user opt-in or alternative locale selection. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · convert_to_pdf_shuke_final.py (reported line 39)May include surrounding context.

python

if not all_found:
            print("\n⚠ 部分字体未找到，PDF可能使用替代字体")
            print("  请运行字体安装: sudo python install_shuke_fonts.py")
            return False
        
        return True

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · verify_shuke_fonts.py (reported line 188)May include surrounding context.

python

if not all_found:
            print("\n⚠ 部分字体未找到，PDF可能使用替代字体")
            print("  请运行字体安装: sudo python install_shuke_fonts.py")
            return False
        
        return True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · convert_to_pdf_shuke_final.py (reported line 51)May include surrounding context.

python

def docx_to_html(docx_path, html_path):
    """使用pandoc将docx转换为html"""
    cmd = ['pandoc', docx_path, '-o', html_path]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"pandoc转换错误: {result.stderr}")
        return False

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script silently writes a second artifact, a debug HTML file, alongside the requested PDF. Because the HTML contains converted document contents, this can unexpectedly leave sensitive data in an additional, more easily readable format and may violate user expectations or retention policies.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · convert_to_pdf_shuke_final.py (reported line 294)May include surrounding context.

python

print("\n🔍 检查PDF字体使用...")
    
    try:
        result = subprocess.run(['pdffonts', pdf_path], 
                              capture_output=True, text=True)
        if result.returncode == 0:
            print(result.stdout)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a Word/PDF formatting tool, but this implementation uses subprocess execution (fc-list) to inspect the host system for installed fonts. Spawning external commands is not an obvious or necessary capability for a formatting skill and expands the runtime capability beyond straightforward document generation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · doc_generator.py (reported line 86)May include surrounding context.

python

import subprocess
        try:
            for name in [en_name, zh_name]:
                result = subprocess.run(
                    ['fc-list', name, 'file'],
                    capture_output=True, text=True, timeout=5
                )

Static analysis

No suspicious patterns detected.