Markdown转Word（支持中文）

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:21 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Chinese Markdown-to-Word converter with a small supply-chain caution around its unpinned dependency install.

Install this in an isolated Python environment if possible, and consider pinning python-docx before use. Expect Chinese defaults, including 仿宋 font and Chinese command-line messages; non-Chinese documents may not format as desired.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

bash

pip3 install python-docx

Technical Analysis

The installation instruction asks pip to retrieve and install python-docx without specifying a reviewed version or verifying an integrity hash. As a result, the installed artifact depends on the package index and package version available when the command is run.

The referenced package name is consistent with the library imported by scripts/md2word.py; there is no evidence of typosquatting or a deliberately malicious dependency. Nevertheless, the absence of version and integrity controls creates supply-chain exposure. A compromised upstream release, compromised package index, or attacker-controlled pip index configuration could cause unreviewed package code to be installed. Python packages may execute code during installation, and installed modules execute code when imported.

Attack Path

1. A user follows the documented setup command.
2. Pip resolves python-docx through the user's configured package index without a version or hash constraint.
3. An attacker must first compromise the upstream distribution channel or influence the user's pip index configuration.
4. Pip downloads and installs the attacker-controlled or otherwise unreviewed distribution.
5. Malicious code may execute during package installation or when md2word.py imports the docx package.

This path is conditional on a supply-chain or package-index compromise; the audited project does not itself redirect pip to an attacker-controlled source.

Impact Assessment

If dependency resolution is successfully compromised, code could execute with the privileges of the user running pip or the conversion script. Potential effects include access to that user's readable files, modification of user-writable data, credential theft from accessible locations, and further net ...[truncated 236 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin python-docx to a reviewed, exact version in a dependency file.
2. Generate and verify cryptographic hashes for the package and all transitive dependencies.
3. Install dependencies from a trusted, explicitly configured package index.
4. Use an isolated virtual environment rather than modifying the system Python environment.
5. Periodically review and deliberately update the lock file after vulnerability and compatibility testing.

Example installation approach:

bash

python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

The corresponding requirements.txt should contain an exact version and verified SHA-256 hashes for every resolved distribution.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description and heading state that the skill is '专为中文文档设计' and uses fixed Chinese document conventions, which imposes a language/locale constraint in the skill’s natural-language description. The file does not offer a user choice of language/locale or explain a compliance or region-specific justification for restricting use to Chinese documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language strings and behavior in the file indicate the tool is fixed to a Chinese locale: the module description is in Chinese, the default font is hard-coded to 仿宋, and user-facing messages are only in Chinese. Because the skill does not offer a language/locale option or explain that it is intentionally region-specific, this creates a language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.