公文格式转换

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 1.0.4

Overview

This appears to be a real document-formatting skill, but its Windows document handling can open Office files invisibly without clearly disabling active content.

Review this skill carefully before installing, especially on Windows. Avoid running it on untrusted .doc or .wps files unless Office/WPS macros and active content are force-disabled or the conversion is done in a sandbox. Pin and review dependency versions before production use, and check output paths before recursive directory formatting or saving configuration files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wfp_core.py:147
• Finding: Office Documents Are Opened Through COM Without Explicitly Disabling Active Content## Vulnerability Details **File Location**: `scripts/wfp_core.py:147-157`, `scripts/wfp_core.py:670-674`, and `scripts/wfp_core.py:688-706` **Vulnerability Type**: Unsafe processing of untrusted Office documents **Risk Level**: Medium ### Vulnerable Code ```python try: self.com_app = win32com.client.DispatchEx('KWPS.Application') self._log(" > 已成功连接到WPS。") except Exception: try: self.com_app = win32com.client.DispatchEx('Word.Application') self._log(" > 已成功连接到Word。") except Exception as e: raise RuntimeError(f"未能启动WPS或Word，请确保已安装。错误: {e}") try: self.com_app.Visible = False except Exception: pass try: self.com_app.DisplayAlerts = False except Exception: pass ``` ```python doc_com = None try: doc_com = app.Documents.Open(os.path.abspath(input_path), ReadOnly=1) doc_com.SaveAs2(os.path.abspath(temp_docx_path), FileFormat=12) finally: if doc_com is not None: doc_com.Close() ``` ```python try: app = self._get_wps_app() doc_com = app.Documents.Open(os.path.abspath(docx_path)) doc_com.TrackRevisions = False self._log(" > 已关闭修订追踪。") if doc_com.Revisions.Count > 0: doc_com.AcceptAllRevisions() self._log(" > 已接受文档副本中的所有修订。") doc_com.Content.ListFormat.ConvertNumbersToText() self._log(" > 已将副本中的自动编号转换为文本。") if doc_com.Revisions.Count > 0: doc_com.AcceptAllRevisions() doc_com.TrackRevisions = False doc_com.Save() ``` ### Technical Analysis On Windows, the formatter creates an invisible WPS or Microsoft Word COM instance and opens user-supplied Office documents. It disables visible alerts but does not explicitly configure the application to force-disable macros or other active content before opening the files. Opening a document as read-only only restricts document modification; it is not an active-content security boun ...[truncated 1653 chars]
• Remediation: ## Remediation Suggestions 1. Before opening any document, set the Office automation security policy to force-disable macros, such as Microsoft Office's `AutomationSecurity` force-disable mode. 2. Record the previous automation security value and restore it when processing finishes, including all exception paths. 3. Apply the security setting before the first `Documents.Open` call, not after opening the document. 4. If equivalent protection cannot be confirmed for WPS, reject untrusted macro-capable inputs or process them through an isolated conversion environment. 5. Prefer sandboxed LibreOffice conversion for untrusted legacy files, using a dedicated temporary profile and an operating-system sandbox with restricted filesystem and network access. 6. Consider rejecting macro-enabled formats and documents containing active content unless the user explicitly opts in after receiving a warning. 7. Add Windows integration tests that verify automation security is configured before every COM document-open operation.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Third-Party Dependencies Are Unpinned and Include an Apparently Unused Package## Vulnerability Details **File Location**: `requirements.txt:1-3` **Vulnerability Type**: Uncontrolled dependency resolution and unnecessary supply-chain exposure **Risk Level**: Low ### Vulnerable Code ```text python-docx tkinterdnd2 pywin32; platform_system == "Windows" ``` ### Technical Analysis None of the declared dependencies has an exact version or integrity hash. Each installation may consequently resolve to a different upstream release that has not been reviewed with this project. If a future release is compromised, malicious, or incompatible, installing the project can introduce attacker-controlled code. No import or use of `tkinterdnd2` was found in the audited scripts. The documented project is a command-line formatter, so this dependency appears unnecessary and expands the supply-chain attack surface without supporting observed functionality. The audit did not establish that any currently published dependency version is malicious. The finding concerns non-reproducible installation and avoidable exposure to future upstream changes. ### Attack Path 1. A user installs the project from `requirements.txt`. 2. The package installer resolves the newest versions allowed by the unpinned declarations. 3. A compromised or otherwise unsafe upstream release is selected because no reviewed version or hash is enforced. 4. Package installation or later import executes code from that release in the user's environment. For `tkinterdnd2`, the same exposure exists even though the audited application code does not appear to require the package. ### Impact Assessment A compromised dependency could execute with the privileges of the user performing installation or running the formatter. The potential scope includes files, environment data, and network resources available to that user. Actual impact depends on whether an unsafe package release is distributed and installed; no current dependency compromise was demonstrat ...[truncated 17 chars]
• Remediation: ## Remediation Suggestions 1. Remove `tkinterdnd2` unless a verified runtime path requires it. 2. Pin each direct and transitive dependency to a reviewed version. 3. Generate a locked requirements file containing cryptographic hashes. 4. Install with hash enforcement, such as `pip install --require-hashes -r requirements.lock`. 5. Review dependency updates through a controlled process that includes vulnerability scanning and automated tests. 6. Use a trusted package index and prevent dependency substitution through unapproved indexes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Ae1

High

• Category: analysis-evasion

Content

1. 确认脚本路径：脚本位于本 Skill 目录下的 `scripts/wfp_cli.py`。如果当前工作目录不是 Skill 目录，使用 `SKILL.md` 所在目录推导脚本绝对路径，或先 `cd` 到 Skill 目录。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to invoke a local Python CLI, read reference files, auto-read configuration from the current working directory, and process user-supplied paths, but it declares no explicit tool scope or permissions. In an agent environment, missing scope boundaries increases the chance of unintended shell execution, file reads, and file writes outside the minimally necessary surface, especially because the skill supports directory-recursive processing and config discovery from the cwd.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: L003 中的“格式化文档、统一文档格式、调整字体字号行距边距时使用此技能”覆盖面很广，接近日常通用编辑需求，而不仅限于公文排版。虽然前文强调“公文格式排版工具”，但这一触发描述和关键词仍缺少明确排除条件或更窄的适用范围，可能让代理在普通文档美化场景中错误调用该技能。

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: 文件多处将技能定义为“公文格式排版工具”并按固定“公文排版习惯”“标准 docx”输出，但未明确说明这是面向中文公文场景，或在用户非该语言/地区场景下提供选择。按规则，强制特定语言或区域格式而无用户 opt-in 可能构成自然语言层面的语言/locale 策略问题。

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: SQP-3 applies to all file types and includes language or locale policy violations. The document consistently presents all instructions and descriptions in Chinese, with no indication that users can select another language or that the locale restriction is intentional and documented.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: This markdown file contains formatting rules, headings, and examples exclusively in Chinese, including Chinese-specific fonts and numbering conventions. There is no indication that the language/locale restriction is optional, user-selectable, or justified as a region-specific policy, which may violate language/locale choice requirements.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code embeds user-facing installation/help text entirely in Chinese, and the rest of the CLI similarly uses Chinese-only descriptions and status/error messages. That imposes a specific language on all users without opt-in or any visible locale selection, which matches the language/locale policy violation criteria.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install --cask libreoffice

Debian/Ubuntu:
  sudo apt-get update
  sudo apt-get install libreoffice

Fedora:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install --cask libreoffice

Debian/Ubuntu:
  sudo apt-get update
  sudo apt-get install libreoffice

Fedora:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install --cask libreoffice

Debian/Ubuntu:
  sudo apt-get update
  sudo apt-get install libreoffice

Fedora:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install --cask libreoffice

Debian/Ubuntu:
  sudo apt-get update
  sudo apt-get install libreoffice

Fedora:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

creationflags = subprocess.CREATE_NO_WINDOW

        try:
            proc = subprocess.run(
                cmd,
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: This configuration file uses Chinese-named font sizes, Chinese font families, and locale-specific defaults such as '奇偶分页' throughout the default and preset options. Because the file does not indicate that these locale constraints are optional, user-selectable, or limited to a justified region-specific use case, it may violate the policy against forcing a specific language or locale without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This module hard-codes Chinese-language UI strings and Chinese-specific document heuristics, including punctuation normalization and heading detection, indicating the skill is designed to enforce a specific language/locale behavior. The file does not show any user choice or opt-in for locale, which matches the policy category for forced language/locale behavior.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

def main(argv=None):
    suite = unittest.defaultTestLoader.loadTestsFromModule(__import__(__name__))
    runner = unittest.TextTestRunner(verbosity=2)
    result = runner.run(suite)
    if result.wasSuccessful():

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing warnings about actions affecting user data. Lines L086-L087 describe default saving and reading/merging behavior, but they do not explicitly caution that running the command will create or overwrite configuration in the current directory.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The operational instructions and examples are written in Chinese, which can effectively force a specific language for users consuming this skill reference. The file does not indicate that Chinese is optional, provide an alternative language, or justify the locale restriction as region-specific.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file instructs the user to use `save-config` to persist settings to `wfp_config.json` in the current directory or another path, which is a file-writing operation. The description does not include any warning or disclosure about creating or overwriting files, so users may not realize the command modifies files on disk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx
tkinterdnd2
pywin32; platform_system == "Windows"

• Confidence: 95% confidence
• Finding: The dependency list is unpinned, so installations may resolve to different versions over time, including vulnerable or breaking releases. In a document-formatting skill that processes untrusted files, dependency drift increases supply-chain risk and makes it harder to ensure known-safe versions are deployed.

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: `python-docx` has known XXE-related advisories in older versions, and because no version is pinned, the manifest could install an affected release. This skill explicitly handles document files from users, so a vulnerable XML parser path in document processing is more relevant than in many other contexts and could lead to file disclosure or parser abuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx
tkinterdnd2
pywin32; platform_system == "Windows"

• Confidence: 90% confidence
• Finding: `tkinterdnd2` is also unpinned, which allows non-reproducible builds and could silently introduce malicious, compromised, or incompatible releases. Although this package is for UI drag-and-drop support, it still expands the supply-chain attack surface of the skill.

Unverifiable Dependency: pywin32 has 2 known advisory(ies) (CVE-2021-32559 (Integer overflow in pywin32); CVE-2021-32559 (An integer overflow exists in pywin32 prior to version b301 when adding an acces)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: `pywin32` has known advisories in some prior versions, and the lack of version pinning means Windows installs may resolve to an affected build. The risk is somewhat limited because it is Windows-only and likely auxiliary, but it still creates avoidable uncertainty in a package set that may process untrusted user content.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The manifest describes a document formatting tool for converting and standardizing office documents, but this file also exposes a `test` command that imports and runs an internal test suite. Running bundled tests is a developer/maintenance capability rather than an end-user formatting function justified by the stated skill purpose.

Static analysis

No suspicious patterns detected.