Security audit

sgcc-doc-format

Security checks across malware telemetry and agentic risk

Overview

This skill formats user-provided .docx files and returns a new copy via Feishu, with no hidden persistence or unrelated data access found.

Install only if you are comfortable having documents processed locally by the skill and returned through Feishu. For confidential or regulated documents, confirm the target recipient/channel before running it and keep the original file, since the skill creates a formatted copy rather than editing in place.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger condition includes examples followed by open-ended wording such as “等”, which makes activation boundaries ambiguous and can cause the skill to run on loosely related requests. In this context, accidental activation matters because the skill modifies user documents and transmits the output via Feishu, increasing the chance of unintended document handling.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill workflow explicitly says the finished document will be sent back through Feishu, but the user-facing description does not warn about that transfer. This is dangerous because users may upload sensitive internal documents without understanding that the content will be processed and redistributed through an external messaging channel, creating privacy and compliance risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.