T09 · Insecure Skill Coding Practices
Error
- Location
scripts/form_filler.py:31- Finding
Untrusted Word Documents Are Opened Without Disabling Automation Macros
- Content
View full analysis
- Remediation
View remediation
Security audit
sanxin_form_filler1
Security checks for vulnerabilities and agentic risk
Overview
This skill appears intended to fill Word application forms, but it opens user-supplied Word documents through Office automation without macro safeguards, which creates a real review-level safety concern.
Install only if you will process trusted Word documents and are comfortable with local Microsoft Word automation. Avoid opening forms from unknown sources, especially .doc or macro-enabled files, keep backups of originals, use a distinct output path, and consider pinning pywin32 before deployment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:8- Finding
Unpinned Third-Party Dependency Is Installed from the Active Package Index
- Content
View full analysis
- Remediation
View remediation
bins: [] ``` 2. Use a lock file or requirements file containing cryptographic hashes, and install with hash verification: ```text pywin32== --hash=sha256: ``` ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Restrict package retrieval to an approved package index and use a controlled internal mirror where appropriate. 4. Disable or carefully review unexpected pip configuration that introduces additional indexes. 5. Perform dependency updates through a review process rather than automatically resolving the newest available release. 6. Run installation and execution with the least-privileged account required by the Skill. 7. Generate and retain a software bill of materials so the deployed dependency version and artifact can be verified. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The usage instructions tell users to provide report and form paths for automatic filling but do not warn that the target application form will be modified in place. In a document-automation skill, this can lead to accidental overwrites, loss of original content, or corruption of important application materials if users assume the operation is preview-only or non-destructive.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The README is entirely written in Chinese and presents the skill as a general-purpose form-filling tool, but it does not state that the skill is limited to Chinese-language users or documents, nor does it offer an alternative language or opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is clearly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description and usage guidance do not clearly warn users that the tool will open, modify, and save Word documents on disk. For a file-writing skill, missing disclosure reduces informed consent and makes accidental data alteration, overwriting, or processing of sensitive documents more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The invocation examples use a very generic trigger phrase ('请帮我填写申报表') that could cause the skill to activate in response to ordinary conversation without making the document-modifying behavior explicit. Because this skill edits and saves Word files, ambiguous activation increases the chance of unintended file modification or execution against the wrong documents.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest and module/function documentation describe taking content from a申报报告 and intelligently filling the application form, and the function even accepts a source_doc parameter for that purpose. However, the implementation only opens form_doc and inserts caller-provided content_map text; source_doc is never used, so the described report-to-form filling behavior is not actually implemented.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The function docstring explicitly states that source_doc is the report path '用于提取内容', which implies the function reads that document. In reality, the code only opens form_doc and never references source_doc afterward, so the documentation contradicts the implementation's actual behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code hard-codes Chinese typography settings such as '宋体' and the surrounding comments/docstrings are entirely Chinese, indicating the skill is designed to enforce a specific language/locale presentation. The policy allows locale constraints only when user choice is offered or the constraint is clearly documented and justified; this file does neither.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file specifies a fixed default format using the Chinese font '宋体' and Chinese typographic conventions, but it does not state that this is optional or limited to a China-specific workflow. Under the language/locale policy, forcing a specific locale presentation without user opt-in can be a policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file describes a tool that automatically fills Word application forms and preserves/changes formatting, which affects user documents. The README explains how to perform the operation but does not include any explicit warning to back up files, use copies, or note that document contents and layout will be modified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring and user-facing comments are entirely in Chinese, including the usage description, without indicating that the skill is region-specific or that other languages are supported. Under the policy rule, a natural-language skill artifact that implicitly enforces a single language without opt-in can be a locale-policy issue.
- Content
Static analysis
No suspicious patterns detected.