chinese gongwen writing

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

This skill is a clearly scoped Chinese official-document drafting helper with one optional local DOCX rendering dependency that users should install carefully.

Install this only if you want Chinese official-document drafting guidance. For the optional DOCX renderer, use a virtual environment and consider pinning python-docx to a reviewed exact version before running pip install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Version

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unbounded third-party dependency
Risk Level: Medium

Vulnerable Code

text

python-docx>=1.1

The installation instructions in README.md:40 invoke this dependency specification:

bash

pip install -r requirements.txt

Technical Analysis

The lower-bound-only constraint permits pip to resolve any current or future python-docx release at or above version 1.1. Consequently, installations are not reproducible and do not remain tied to a version reviewed by the project maintainers.

This does not establish that the current python-docx package is malicious. The risk arises because a future compromised, malicious, or incompatible release could be selected automatically. The requirement file also lacks integrity hashes, so package artifacts are not cryptographically constrained to audited distributions.

Attack Path

1. An attacker compromises a future release, maintainer account, distribution artifact, or relevant package-delivery path.
2. The malicious release retains the expected package name and has a version equal to or greater than 1.1.
3. A user follows the documented command:

   bash

   pip install -r requirements.txt
   

4. pip resolves and installs the attacker-controlled release because it satisfies python-docx>=1.1.
5. Malicious package installation or import-time behavior executes under the privileges of the user or environment performing the installation.
6. The package may subsequently execute when scripts/render_docx.py imports docx.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the account installing or running the Skill. Depending on that environment, this could expose files and credentials accessible to the account, modify generated documents, tamper with the Python environment, or affect other workloads sharing it.

The project itself does not request elevated pri ...[truncated 201 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin python-docx to an exact version that has been reviewed and tested:

   text

   python-docx==<audited-version>
   

2. Generate and commit a hash-locked dependency file, for example:

   bash

   pip-compile --generate-hashes requirements.in
   

3. Enforce artifact integrity during installation:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Review and pin transitive dependencies as well as the direct dependency.
5. Use a trusted package index or an internally controlled package mirror.
6. Perform dependency vulnerability and provenance checks in CI.
7. Test dependency upgrades explicitly rather than accepting future releases automatically.
8. Install and run the Skill in an isolated, least-privilege virtual environment or container.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description states that the skill writes Chinese official documents, which imposes a specific language/locale behavior. The file does not mention any user opt-in, language choice, or clear region-specific limitation that would exempt this from the language policy concern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description states the skill writes Chinese official/administrative documents, which imposes a specific language/locale. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified as region-specific; the file does not explicitly frame this as an opt-in or region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file is entirely framed as a Chinese writing template and guidance artifact, with no indication that users may request another language or locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a violation unless the locale limitation is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all guidance in Chinese and prescribes Chinese-specific writing forms such as mandated Chinese date characters and official Chinese document conventions, but it does not state that the skill is China-specific or provide any language/locale opt-in. Under the policy, forcing a specific language or locale without user choice or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document is entirely written in Chinese and prescribes Chinese government document formatting conventions without offering any language or locale choice. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire reference is written only in Chinese and specifically prescribes Chinese official-document phrasing without stating that this is optional or limited to users seeking Chinese-language drafting help. This creates a natural-language policy concern because it effectively constrains output language/locale without any explicit user choice or opt-in documented in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file uses only Chinese throughout, including headings, examples, and instructional guidance. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or region-specific justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains only Chinese-language content and provides no opt-in, alternative locale, or justification that the skill is intended exclusively for Chinese-language users. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents all instructions and examples exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill document is written in Chinese and presents its guidance only in that language, with no indication that users may choose another language or that the restriction is optional. Under the stated policy, a skill that forces a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as python-docx>=1.1 without an upper bound or exact pin, which makes builds non-reproducible and can cause the environment to resolve to unexpected or newly vulnerable releases over time. While this is a supply-chain hygiene issue rather than an immediately exploitable flaw by itself, it increases risk because security posture depends on whatever version gets installed at runtime.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

python-docx>=1.1

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest does not pin python-docx, and historical advisories exist for vulnerable versions, including XXE-related behavior in older releases. In a document-writing skill, libraries that parse or manipulate Office XML formats may process attacker-controlled .docx content, so leaving the resolved version unverifiable creates a realistic path to exposure if an affected release is installed.

Content

No source excerpt is available for this finding.