Security audit

Generate DOCX

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Chinese Word document formatting skill, but users should avoid its privileged install shortcuts and keep output paths controlled.

Install dependencies in a virtual environment or have an administrator provision Pandoc and fonts; do not let an agent run sudo or --break-system-packages automatically. Use explicit output paths in a private output directory, avoid shared writable directories, and do not pass untrusted raw Markdown/OpenXML into raw_markdown. Review generated legal, medical, financial, or official documents before relying on them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: converter.py:461
Finding: Predictable Temporary File Allows Local File Overwrite and Deletion
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:67
Finding: Unpinned Dependency Installation Bypasses System Package Protections
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` Hashes for all transitive dependencies must also be included when `--require-hashes` is used. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该描述把技能定位为一个面向用户的“文档导出/排版生成器”，但提供的代码片段只是其构建阶段的模板生成工具。脚本主要作用是用 python-docx 预生成模板 reference.docx：设置页边距、字体映射、段落样式、标题样式、页脚页码和基础编号体系。这与“把用户内容按规范输出为 Word 文档”的最终行为存在明显差距。尤其是描述中强调的 Markdown 语义层、Pandoc 渲染引擎、最终 docx 导出、19 种文档类型、14 个模板等关键能力，在此代码中并未体现，且部分数量与实现不一致。虽然跨平台字体适配、首页页码控制、编号体系等确有部分支撑，但整体上代码行为只覆盖了声明能力中的一小部分底层模板准备工作，因此属于明显的描述—行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明的核心能力是“生成/导出符合规范排版的 Word 文档”，即一个写出型、格式化型的文档生成器。实际代码却是一个 docx_reader，主要功能是输入现有 .docx，解析其中的段落、标题、列表、表格、代码块等结构，并输出结构化数据供后续处理，还附带 Markdown 调试输出和文档类型推断。这与声明的主用途明显不同：代码没有创建、修改、保存 .docx，也没有调用 Pandoc、模板系统或任何排版规范实现逻辑。虽然该读取器可能是更大系统中的辅助模块，但就该代码块本身而言，其行为与所述导出排版功能不符，且包含未声明的内容提取/分析能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: 该代码片段的主用途是“读取任意 .docx → 重新排版 → 输出新 .docx”。它依赖 docx_reader 提取原文档结构，再调用 DocxConverter 按识别出的块类型生成新文档。这与声明中的“将大模型生成或修改的内容导出为规范 Word 文档”并不完全一致：声明更像是一个从内容到 Word 的生成器，而代码是一个对既有 Word 文档进行解析和重排版的工具。虽然二者都与 Word 排版相关，且代码中也存在 Markdown 中间层，但核心输入形态、主要工作流和部分能力表述（如 19 种类型、Pandoc 引擎）与声明不完全吻合，因此应判定为存在描述与行为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill requires shell execution and file-writing behavior but does not declare any explicit tool scope or allowed-tools policy. That increases the chance an agent invokes broader-than-necessary capabilities, enabling unintended command execution or arbitrary file creation/overwrite during document generation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description states that the skill formats output according to Chinese national and industry standards and examples throughout the file assume Chinese document conventions, fonts, and numbering. This imposes a specific language/locale behavior, but the skill does not clearly present this as an explicit opt-in constraint or offer a locale choice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Overly broad trigger phrases can cause the skill to activate for common document-related requests that did not clearly ask for file generation. In an agent setting, this can lead to unexpected shell use, document creation, or overwriting outputs when the user only wanted advice or plain-text formatting.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The skill documentation instructs use of privileged package-install commands such as 'sudo apt install pandoc' and also recommends 'pip install ... --break-system-packages'. In an agent-assisted workflow, normalizing privileged or system-modifying commands increases the risk of unnecessary elevation, host modification, and damage to the runtime environment if these instructions are followed automatically or uncritically.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
bash
pandoc --version # 需要 Pandoc >= 2.0 # 安装：macOS: brew install pandoc | Ubuntu: sudo apt install pandoc # Windows: choco install pandoc 或 https://pandoc.org python3 -c "import docx" || pip install python-docx --break-system-packages

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill writes output documents but does not clearly warn users that it may create or overwrite files. In automated environments this can result in data loss, confusion about where artifacts are stored, or unauthorized modification of workspace files if paths are user-controlled or inferred implicitly.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 93% confidence
Finding: Recommending 'sudo apt install fonts-noto-cjk' in troubleshooting encourages privileged system modification for a formatting issue. While less severe than arbitrary command execution, it still expands the blast radius of a document-formatting skill and can lead to unintended host changes in automated or semi-automated agent contexts.
Content: Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.
md
|------|---------| | `pandoc: command not found` | 安装 Pandoc | | 模板文件不存在 | `python3 build_templates.py` | | 中文字体异常（Linux） | `sudo apt install fonts-noto-cjk` | | 编号未从1重置 | 确保两个列表间有 `h1/h2/body` 调用 | | 代码缩进丢失 | 确认 Pandoc >= 2.0；使用 `code_block()` | | 四级标题不显示 | `GOV_DOC`/`LEGAL_DOC` 类型支持 h4 |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains natural-language instructions and output text entirely in Chinese, including the module docstring that explains how to run the script. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring is written as prescriptive Chinese-language documentation and includes locale-specific formatting conventions such as Chinese numbering and Chinese font rules, but does not indicate that users may choose another language or that the converter is limited to a China-specific regulatory context. This can amount to a language/locale policy violation under the requirement to avoid forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The raw_markdown API allows arbitrary Markdown insertion even though the skill is supposed to be a constrained DOCX formatter. In this codebase, Markdown is rendered by Pandoc with raw OpenXML support enabled, and there is also a page_break method that injects raw OpenXML directly, so untrusted callers can potentially smuggle active content or unsafe document constructs into the generated .docx beyond intended formatting controls.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · converter.py (reported line 477)May include surrounding context.
python
f"--reference-doc={self.template}", "--output", output_path, ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: raise RuntimeError(f"Pandoc 转换失败:\n{result.stderr}")

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file’s top-level description states its behavior entirely in Chinese, including output expectations, and later docstrings and summary labels are also fixed to Chinese. This creates a locale policy concern because the skill appears to impose a specific language on users without offering any language selection or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The summary function returns user-facing text with fixed Chinese labels such as '标题' and '正文'. Because no option exists to choose another language or locale, this is a natural-language policy violation under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring, CLI help text, status messages, and usage instructions are entirely in Chinese, indicating the skill is designed to communicate in a specific language by default. There is no indication that users can choose another language or opt in to this locale constraint, which matches the policy's language/locale violation criterion.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The top-level documentation states '输出：templates/ 目录下 9 个模板文件', but TEMPLATES contains 14 entries and the main routine iterates over all of them, printing the final count via len(TEMPLATES). This is an active documentation-to-code contradiction about what the script produces.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script's user-facing print statements at runtime are Chinese-only, which forces a specific language for operational feedback. The file does not offer an alternative language or indicate that the tool is intentionally restricted to a Chinese-speaking environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill's stated purpose is document formatting/export, but the implementation depends on launching the external pandoc binary via subprocess.run(). Spawning subprocesses is a broader execution capability than a pure formatter typically needs at the code boundary, and it increases operational risk if exposed in a wider agent runtime.
Content: No source excerpt is available for this finding.