Security audit

docxport

Security checks for vulnerabilities and agentic risk

Overview

This document-conversion skill mostly matches its purpose, but it can run downloaded tooling and create HTML that loads remote JavaScript without a clear user approval step.

Install only if you are comfortable with a conversion skill that may create or overwrite output files, run local office/conversion tools, use npx to fetch and execute Marp tooling, and generate Mermaid HTML that contacts jsDelivr when opened. Prefer using it in a project directory with non-sensitive test files first, preinstall trusted converter versions where possible, and review generated HTML before sharing or opening it in sensitive environments.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill instructs users to load mermaid.js from a public CDN into generated HTML, creating network-dependent active content in what should be a local document-conversion workflow. This enables supply-chain and privacy risks: opening the HTML can trigger third-party fetches and execute remotely served JavaScript, which is especially risky because the same file also encourages inline HTML/script usage via Marp's --html mode.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list is unusually broad and includes generic phrases like 'document export', 'export pdf', and 'document analysis', which can cause the skill to activate for requests outside its intended scope. Over-broad activation increases the chance that this skill handles inputs better suited for other workflows, potentially leading to unintended file conversion, tool invocation, or policy bypass through misrouting.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to 'execute directly' given a file path and flags, which can cause immediate writes to disk and invocation of external converters without an explicit confirmation or safety gate. In an agent setting, that increases the risk of unintended file modification, unsafe processing of untrusted documents, and surprise execution of local tooling such as LibreOffice or Word COM.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill directs the agent to execute conversion commands directly and write output files without an explicit confirmation or warning about filesystem modification. In an agentic environment, this weakens safety boundaries by normalizing unattended command execution and file creation, which can lead to unintended overwrites, writes to sensitive locations, or processing of attacker-supplied paths.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Using npx --yes to run @marp-team/marp-cli can trigger network retrieval and immediate execution of package code, effectively combining download and execution in one step without warning. In a security-sensitive agent workflow, this increases supply-chain risk and can expose environments with restricted-network or untrusted-package policies to unexpected remote code execution pathways.

Static analysis

No suspicious patterns detected.