word-chinese-automation

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:47 AM UTC
• Version: 1.0.0

Overview

This skill is a Chinese Word proofreading helper that reads user-provided documents and writes expected local review outputs without hidden network, persistence, credential, or destructive behavior.

Install only if you want a Chinese-language proofreading workflow for Word documents. Be aware it creates local JSON files that may contain extracted document text, plus a Word report and corrected copy, so use it in a workspace appropriate for the document's sensitivity and install python-docx from a trusted, pinned environment when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Note

• Location: scripts/split_sentences.py:18

Finding

Unpinned Third-Party Dependency Installation Guidance in Sentence-Splitting Script

Content

View full analysis

Vulnerability Details

File Location: scripts/split_sentences.py:18-22
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

python

try:
    from docx import Document
except ImportError:
    print("Error: the python-docx library is required")
    print("Run: pip install python-docx")
    sys.exit(1)

Technical Analysis

The script directs users to install python-docx from the default Python package index without specifying an audited version, validating artifact hashes, using a lock file, or constraining the package source.

Because the package version and resolved transitive dependencies are mutable, the code ultimately imported by the script may differ between installations. This exposes users to supply-chain risks if the package publisher account, package repository, release artifact, or transitive dependency is compromised.

The script does not automatically execute the installation command, so exploitation requires the user to follow the displayed guidance. No evidence of an intentionally malicious package or dependency-confusion namespace was identified.

Attack Path

1. A user runs split_sentences.py in an environment where python-docx is unavailable.
2. The import fails, and the script recommends running pip install python-docx.
3. The user executes the command against the default package index.
4. Pip resolves the latest compatible package and its dependencies without checking project-supplied hashes.
5. If the selected package artifact or dependency chain has been compromised, attacker-controlled installation or import-time code executes.
6. The malicious code runs with the permissions of the user performing the installation or running the script.

Impact Assessment

A compromised dependency could read or modify files accessible to the current user, access documents processed by the Skill, use available network c ...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

• Add an audited, pinned python-docx version to a dependency file.
• Generate and verify cryptographic hashes for the package and all transitive dependencies.
• Use a command such as pip install --require-hashes -r requirements.txt.
• Maintain a lock file and review dependency updates before adoption.
• Configure installations to use an approved package index.
• Run document-processing scripts in a virtual environment with only the filesystem and network permissions required for the task.
• Add automated dependency vulnerability and integrity scanning to the release process.

T08 · Insecure Dependencies

Note

• Location: scripts/generate_report.py:34

Finding

Unpinned Third-Party Dependency Installation Guidance in Report Generator

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_report.py:34-42
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

python

try:
    from docx import Document
    from docx.shared import Pt, RGBColor
    from docx.enum.text import WD_ALIGN_PARAGRAPH
    from docx.enum.table import WD_TABLE_ALIGNMENT
    from docx.oxml.ns import qn
    from docx.oxml import OxmlElement
except ImportError:
    print("Error: python-docx must be installed")
    print("Run: pip install python-docx")
    sys.exit(1)

Technical Analysis

The recommended installation command does not pin python-docx to an audited version and does not verify package hashes. Dependency resolution therefore relies on mutable external repository state and may select package or transitive-dependency versions that were not reviewed with the Skill.

This is a supply-chain hardening issue rather than evidence of embedded malicious behavior. The installation is not performed automatically; a user must act on the recommendation.

Attack Path

1. A user invokes generate_report.py without python-docx installed.
2. The script displays the unpinned installation command.
3. The user runs the command using the default package index.
4. Pip downloads the currently resolved package artifacts without project-defined hash verification.
5. If an artifact, publisher account, repository, or transitive dependency has been compromised, malicious code may run during installation or later import.
6. The malicious code inherits the invoking user's permissions and access to report input and output files.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the current user's privileges. Accessible Word documents, generated reports, local files, environment variables, and available network resources could be exposed or modified. No privilege-esca ...[truncated 77 chars]

Remediation

View remediation

Remediation Suggestions

• Declare python-docx through a pinned and reviewed requirements or lock file.
• Record hashes for every resolved distribution and require hash verification during installation.
• Install dependencies with pip install --require-hashes -r requirements.txt.
• Use an organization-approved package mirror or explicitly trusted index.
• Review and test dependency upgrades before changing the pinned version.
• Execute report generation in an isolated environment with least-privilege filesystem and network access.
• Integrate dependency scanning and provenance checks into continuous integration.

T08 · Insecure Dependencies

Note

• Location: scripts/apply_corrections.py:36

Finding

Unpinned Third-Party Dependency Installation Guidance in Correction Script

Content

View full analysis

Vulnerability Details

File Location: scripts/apply_corrections.py:36-40
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

python

try:
    from docx import Document
except ImportError:
    print("Error: python-docx must be installed")
    print("Run: pip install python-docx")
    sys.exit(1)

Technical Analysis

The installation guidance permits pip to choose a mutable version of python-docx and its transitive dependencies from the configured package index. The project does not provide a pinned version, lock file, hash verification, or trusted-index restriction.

Consequently, users cannot reliably ensure that the installed dependency is the same artifact that was audited. Exploitation depends on compromise of the relevant supply chain and on a user manually running the recommended command.

Attack Path

1. A user launches apply_corrections.py without the required module.
2. The script recommends installing python-docx without a version or hash constraint.
3. The user executes the displayed pip command.
4. Pip retrieves the currently resolved package and dependency artifacts.
5. A compromised artifact can execute malicious code during installation or when imported.
6. The payload runs with the user's permissions and may access both the original document and corrected output.

Impact Assessment

A successful dependency-chain compromise could provide arbitrary code execution under the current user's account. This may expose documents being corrected and any other files, credentials, environment variables, or network resources available to that account. The audited script contains no mechanism for obtaining elevated privileges, establishing persistence, or bypassing access controls.

Remediation

View remediation

Remediation Suggestions

• Replace the free-form installation recommendation with instructions referencing a pinned dependency file.
• Pin an audited python-docx release and all transitive dependencies.
• Include cryptographic hashes and require pip's hash-checking mode.
• Restrict dependency retrieval to a trusted or internally controlled package index.
• Use a dedicated virtual environment and avoid privileged installation.
• Review dependency provenance and vulnerability reports during every update.
• Limit network and filesystem access when processing untrusted documents.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill claims to detect grammar, typos, and punctuation issues, but the documented implementation only extracts text, splits sentences, and exports JSON while leaving the substantive checking to manual or unspecified AI steps. This is dangerous because it can create false assurance and trigger downstream modification of documents without any trustworthy checking mechanism.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to detect grammar, typos, and punctuation issues, but the documented implementation only extracts text, splits sentences, and exports JSON while leaving the substantive checking to manual or unspecified AI steps. This is dangerous because it can create false assurance and trigger downstream modification of documents without any trustworthy checking mechanism.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to read and write files (including creating corrections.json and modified .docx outputs) but does not declare any explicit tool scope or permission boundary. This can lead to unintended file access or modification if the skill is invoked in a broader workspace, because the runtime capabilities are stronger than what the metadata communicates.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include broad everyday expressions such as grammar check, typo, punctuation, and document checking, which increases the chance that the skill will activate unintentionally. In this skill, accidental invocation matters because the workflow includes file processing and possible file creation/modification, so an overly broad trigger surface can cause unreviewed access to user documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L003 和 L006-L012 将技能定位为“中文”校对，并在角色设定中直接要求作为中文校对编辑工作，但未说明这是用户主动选择的语言模式或提供其他语言/locale 选项。按规则，强制特定语言而无用户 opt-in 可能构成语言/区域策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill includes behavior that generates a modified document, but it does not prominently warn users that a new file will be written. This is risky because users may not expect persistent changes or duplicate outputs, which can lead to accidental overwrite-like confusion, data handling mistakes, or unauthorized document generation in sensitive directories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains its primary docstring entirely in Chinese, including usage instructions, and the runtime print messages are also Chinese-only. For a general-purpose document correction script, that imposes a specific language/locale on users without opt-in or an explicitly documented region-specific justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The module docstring, usage examples, and generated report labels are all written in Chinese, which signals a fixed language experience for the skill. There is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regional/compliance context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a tool for Chinese punctuation, grammar, and typo checking, which suggests analysis of document text rather than exporting full document contents. This script not only splits sentences for analysis but also persists all extracted paragraph, textbox, and table text into a JSON file, creating a document-content export capability not stated in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The workflow requires creating and writing corrections.json, but the file-generation side effect is not clearly surfaced as a user-facing warning. Even though this is less severe than modifying the original document, hidden intermediate file creation can expose document content in plaintext JSON and create privacy or workspace hygiene issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire markdown file is written only in Chinese and presents language-specific guidance without offering any user language/locale choice. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The module docstring states that sentence position information is preserved as paragraph index and sentence index. In practice, the code emits heterogeneous location metadata: table content uses table/row/cell indexes instead of paragraph indexes, and textbox content stores textbox numbering under the field name paragraph_index, which does not match the documented meaning.

Content

No source excerpt is available for this finding.