sgcc-doc-format

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

The skill mostly performs the promised Word formatting, but its output can make Word auto-update existing fields from an untrusted document, which deserves review before use.

Install only if users understand that DOCX files will be processed locally and returned through Feishu. Avoid using it on untrusted or externally supplied DOCX files unless the formatter is changed to sanitize existing fields and external relationships or to avoid global automatic field updates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/format_sgcc.py:368

Finding

Automatic Updating of Untrusted Word Fields

Content

View full analysis

Vulnerability Details

File Location: scripts/format_sgcc.py, lines 368–372
Vulnerability Type: Global activation of fields preserved from an untrusted DOCX file
Risk Level: Medium

Vulnerable Code

python

settings = doc.settings.element
uf = settings.find(qn("w:updateFields"))
if uf is None:
    uf = OxmlElement("w:updateFields")
    settings.append(uf)
uf.set(qn("w:val"), "true")

Technical Analysis

The script accepts a user-supplied DOCX file at line 240, modifies it, and enables the document-wide w:updateFields setting before saving the result. This setting is not limited to the TOC and page-number fields generated by the script. It also applies to pre-existing fields retained from the untrusted input.

The implementation does not inspect or remove existing field instructions, external relationships, or linked content before enabling automatic field updates. Consequently, a malicious input can contain attacker-controlled external fields or links that remain in the output and may be processed by Microsoft Word when the recipient opens it.

The vulnerability does not grant privileges to the formatting script itself. Exploitation depends on the recipient opening the generated file in a Word environment that permits or attempts the relevant field or external-content update.

Attack Path

1. An attacker creates a DOCX containing a field or linked object that references an attacker-controlled external resource.
2. The attacker submits the document for formatting.
3. The script loads the untrusted document and preserves its existing field instructions and relationships.
4. The script sets the global w:updateFields option to true.
5. The generated DOCX is returned to the recipient through the documented file-delivery workflow.
6. The recipient opens the output in Microsoft Word.
7. Word attempts to update the preserved attacker-controlled content, subject to the recipient's Word security configuration and prompts.
8. The ex ...[truncated 764 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not enable document-wide automatic field updates for untrusted input files. Remove the w:updateFields setting and instruct recipients to update the generated TOC manually.
2. Before saving, enumerate all existing field instructions and reject or remove fields not explicitly generated by this formatter.
3. Allow only a narrow field allowlist, such as the locally generated TOC and PAGE fields.
4. Inspect the DOCX relationship files and remove or reject external relationships, including externally linked images, templates, OLE objects, and other linked content.
5. If automatic TOC refresh is essential, generate a sanitized document from approved content rather than mutating an untrusted package while preserving its original relationships.
6. Add regression tests using DOCX fixtures containing external fields and relationships. Verify that the output contains no unapproved external targets and does not globally request field updates.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to return the finished document via Feishu, but the user-facing description does not clearly disclose that the uploaded file will be transmitted through that channel. Because Word documents often contain sensitive business content, the lack of transparent notice can lead to inadvertent data exposure or privacy-policy violations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger condition uses open-ended wording like “等”, which broadens activation beyond clearly bounded user intents. In a document-handling skill, this can cause the agent to invoke the formatter on unintended requests or attachments, increasing the chance of processing sensitive files without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file specifies Chinese trigger phrasing and a Chinese-only formatting workflow, but it does not indicate that this locale constraint is optional or user-selectable. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue unless the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This Python file contains natural-language descriptions and console output entirely in Chinese, including usage instructions and status messages. Under the policy rule for language/locale, this is a violation because the skill does not offer user opt-in or an alternative language, and the locale restriction is not explicitly justified as region-specific in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.