Back to skill

Security audit

python-docx

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward python-docx guide for creating formatted Word documents, with only normal document-writing behavior disclosed in examples.

Install only if you want a Chinese-oriented python-docx formatting reference. Review or change the sample output filename and default font before running copied code in a real project.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation presents Microsoft YaHei as the required default font and labels the font-setting step as mandatory, which imposes a specific locale-oriented formatting choice. The skill does not offer users an explicit language or locale option or explain that this configuration is specifically for Chinese-language documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file includes executable example code that writes a file via doc.save('output.docx'), which affects user data on the local filesystem. The surrounding skill description does not include any warning or note that running the example will create or potentially overwrite a document file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.