Markdown to Word Converter

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:29 AM UTC
• Version: 3.112.0

Overview

This skill is a straightforward Markdown-to-Word converter with expected local file creation and no evidence of hidden execution, persistence, credential access, or data exfiltration.

Before installing, note that the skill creates a local .docx file at the chosen output path and may overwrite an existing file. Install python-docx in an isolated virtual environment, preferably from a pinned requirements file, and review whether the default Chinese font formatting fits your documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63-67
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

Install if needed:
```bash
pip install python-docx

text

The dependency is subsequently imported in `scripts/md_to_word.py`, lines 17-24:

```python
try:
    from docx import Document
    from docx.shared import Pt, Inches, Cm, RGBColor
    from docx.enum.text import WD_ALIGN_PARAGRAPH
    from docx.enum.table import WD_TABLE_ALIGNMENT
    from docx.oxml.ns import qn
    from docx.oxml import OxmlElement
except ImportError:
    print("Error: python-docx is required. Install with: pip install python-docx")
    sys.exit(1)

Technical Analysis

The installation instruction retrieves python-docx without pinning a reviewed version, validating package hashes, specifying a trusted package index, or using a dependency lock file. As a result, dependency resolution is mutable and depends on the package index and pip configuration present at installation time.

This is a supply-chain weakness rather than evidence that the named package is currently malicious. Exploitation would require compromise or manipulation of an applicable package source, release, dependency, or package-resolution configuration. Malicious installation hooks could run during installation, while malicious package code could run when the converter imports the dependency.

Attack Path

1. A user or Agent attempts to use the converter without python-docx installed.
2. The user follows the documented pip install python-docx instruction.
3. pip resolves content from its configured package source without a pinned version or required hash.
4. An attacker who has compromised or influenced that source or its resolution path supplies malicious package content.
5. Attacker-controlled code executes during installation or when scripts/md_to_word.py imports the installed package.

Impact Asse

...[truncated 670 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare the dependency in a version-controlled requirements file using a reviewed, exact version.

2. Record and enforce cryptographic hashes, for example:

   text

   python-docx==REVIEWED_VERSION --hash=sha256:VERIFIED_DISTRIBUTION_HASH
   

3. Install it with strict hash validation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate hashes separately for every supported platform and artifact, or constrain installation to a specifically reviewed distribution.

5. Use an isolated virtual environment and avoid elevated installation.

6. Explicitly configure a trusted package index rather than relying on uncontrolled global or user-level pip settings.

7. Add automated dependency scanning and a controlled process for reviewing and updating pinned versions.

8. Update the script's ImportError message so it points to the verified requirements-based installation procedure instead of recommending the unpinned command.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file describes converting Markdown into a Word document and shows an output path parameter, but it does not explicitly warn users that running the skill will create or overwrite a local .docx file. For markdown files, user-facing descriptions should disclose behaviors that affect user data or the filesystem.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The supported-features table specifies the font '微软雅黑' for headers, which imposes a locale-specific formatting choice in the skill's natural-language description. Because no opt-in or justification is provided, this may violate language/locale policy expectations for offering user choice or documenting regional constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code repeatedly forces the document font to '微软雅黑', a locale-specific Chinese font, in its default formatting path. This imposes a specific language/locale presentation choice on all generated documents without user opt-in or documented justification.

Content

No source excerpt is available for this finding.