Security audit

officecli

Security checks for vulnerabilities and agentic risk

Overview

The skill is for Office document work, but it asks users to run unverified remote installers and to follow dynamically generated sub-skill instructions that persist across turns.

Review this skill carefully before installing. Do not run the provided remote installer commands unless you independently trust the source and have verified what will execute. Treat any `officecli load_skill` output as untrusted unless the sub-skill content is pinned, reviewable, and approved for the current document task.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:16
Finding: Unverified Remote Installation Scripts Are Executed Directly
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:375
Finding: Runtime-Generated Skill Instructions Are Trusted and Retained Across Turns
Content: View full analysis
— output is a SKILL.md, follow its rules. ``` ```text Loading rule: - Pick the most specific match in "When to use"; if none fits, load the format default (word / pptx / excel). - Scenes already contain the format default's rules — load one skill per artifact, never stack. - Loaded rules persist across turns; don't re-load each reply. - Two distinct artifacts → two separate loads. ``` ```text Example: a fundraising deck task → officecli load_skill pitch-deck → use the printed rules. ``` ### Technical Analysis The Skill instructs the Agent to execute `officecli load_skill`, interpret the command's output as another `SKILL.md`, and follow the emitted rules. The generated subskills are not included in the audited project, so their contents, provenance, constraints, and safety properties cannot be statically reviewed. This creates an instruction channel controlled by the installed executable and whatever source it uses to produce the subskill. If the binary or its subskill source is compromised, it can emit attacker-controlled text that attempts to redirect the Agent's objectives, weaken operational safeguards, request sensitive information, or trigger unsafe tool use. The instruction that loaded rules “persist across turns” increases the scope. Malicious or unsafe instructions can continue influencing later interactions rather than being restricted to the command that generated them. This behavior exceeds what is necessary to edit Office documents: format-specific guidance can ...[truncated 1327 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL https://d.officecli.ai/install.sh | bash is a classic arbitrary code execution pattern: it fetches code over the network and immediately runs it in a shell. In an agent skill, this is especially dangerous because it can be blindly followed during setup, turning documentation into an execution vector.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
bash
# macOS / Linux curl -fsSL https://d.officecli.ai/install.sh | bash # Windows (PowerShell) irm https://d.officecli.ai/install.ps1 | iex

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The shell pipeline into bash enables command chaining abuse by taking uninspected remote content directly into an interpreter. This removes opportunities for review and makes any compromise of the source or transport immediately exploitable on the host running the skill.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
bash
# macOS / Linux curl -fsSL https://d.officecli.ai/install.sh | bash # Windows (PowerShell) irm https://d.officecli.ai/install.ps1 | iex

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs users to install the tool by downloading and immediately executing remote scripts (curl ... | bash and irm ... | iex). That is an unjustified escalation for a document-editing skill because it delegates full code execution to an unauthenticated network response at runtime, creating a supply-chain and remote code execution risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The install instructions tell the agent/user to execute remote scripts directly without any warning, review step, integrity check, or provenance validation. In a skill context, this can normalize unsafe behavior and lead to arbitrary code execution if the remote host, TLS chain, or delivery path is compromised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest describes operations on .docx, .xlsx, and .pptx documents, but this file states that officecli plugins list extends support to .doc, .hwpx, and .pdf export. Supporting additional non-Office formats and plugin-extended functionality broadens capability beyond the stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The manifest emphasizes creating, analyzing, proofreading, and modifying Office documents with a CLI tool, but the file also documents watch launching a local HTTP preview server for browser interaction. While related to document inspection, running a server and coordinating browser state is a broader operational behavior than the manifest description suggests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.