Security audit

kingdoc

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad cloud-document automation tool with expected document features, but it exposes powerful delete, overwrite, sync, subprocess, and memory-retention behavior without enough enforced safeguards.

Install only if you are comfortable granting an agent broad access to create, modify, share, overwrite, and delete Kingsoft/WPS documents. Use a least-privilege app credential, avoid unattended use, require host-level confirmations for delete/overwrite/share/sync actions, disable or avoid the memory bridge unless you want document activity retained, and do not run setup or bridge features in sensitive directories without reviewing paths first.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: } """ try: proc = subprocess.Popen( cmd, stdin=subprocess.PIPE if input_data else None, stdout=subprocess.PIPE,
Confidence: 89% confidence
Finding: The code launches an external process based on paths discovered from the local system and executes a script from that installation directory without any trust verification. Although shell injection is avoided by using an argument list, this still creates an arbitrary code execution boundary if a malicious or trojanized `wps` binary or adjacent `scripts` directory is found via PATH or attacker-controlled installation paths.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The manifest declares no permissions while the skill documentation describes capabilities spanning environment access, file read/write, MCP integration, network access, and shell/subprocess execution. This mismatch undermines informed consent and policy enforcement because users and hosts cannot accurately assess or constrain what the skill may do.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The front-matter description is effectively empty despite the skill exposing a very broad and sensitive feature set, including cloud document access, OCR, subprocess bridges, local sync, and memory integration. Sparse manifest metadata makes the skill materially less transparent and can conceal risky behaviors from users, reviewers, and automated governance systems.

Intent-Code Divergence

High

Confidence: 90% confidence
Finding: The document presents deletion as safely limited to recycle-bin behavior, but later documents permanent-destruction features such as trash destroy and history destroy. This inconsistency can mislead users into authorizing actions under a false assumption of recoverability, increasing the risk of irreversible data loss.

Intent-Code Divergence

Medium

Confidence: 79% confidence
Finding: One section states handwritten/formula OCR is forced local and external OCR is forbidden, while other sections still describe cloud OCR fallback. Contradictory data-handling guarantees create a privacy and compliance risk because users may provide sensitive images believing they will stay local when the implementation or operator behavior may still permit remote transmission.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Refreshing templates via git/network update expands the skill from document processing into fetching and updating local content from an external source. If the template source or update path is compromised, this can introduce untrusted artifacts or unsafe content into subsequent document generation workflows.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The bridge processing tool exposes local WPS script execution/automation behind a generic action+params interface, which is a code-execution-adjacent capability on the host machine. Even if intended for document processing, such automation can become a vehicle for unsafe local actions, macro-like behavior, or abuse of installed office tooling.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: Exporting document events into an external long-term memory system extends data flow beyond the core document-management purpose and can leak sensitive metadata or content-derived details. In enterprise document contexts, event histories may reveal confidential activity patterns, filenames, IDs, sharing actions, or business processes.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The `force=True` path reports a successful irreversible deletion but does not actually call any backend delete operation. This creates a dangerous integrity mismatch between reported state and real state: users or higher-level automation may believe sensitive data was destroyed when it still exists, potentially causing retention, compliance, or privacy failures.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README presents very broad natural-language trigger examples such as writing, summarizing, uploading, rolling back, and restoring files without clear activation boundaries, confirmation requirements, or scope restrictions. In an agent setting, this can cause the skill to be invoked for ordinary user requests and perform document-affecting actions unexpectedly, increasing the risk of unintended data modification or disclosure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The top-level description markets direct creation, editing, management, rollback, restore, delete, and overwrite-style capabilities as a convenience feature, but does not consistently warn about irreversible or data-modifying behavior at the point those capabilities are introduced. In a skill ecosystem, this increases the chance that users or calling agents invoke destructive operations without appreciating that cloud documents, history, or shared content may be changed or permanently removed.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger examples are broad everyday phrases like creating documents, searching files, uploading files, recovering deleted content, and changing sharing permissions. Overly permissive natural-language activation raises the chance of unintended invocation of powerful file-management actions, especially in conversational contexts where user intent is ambiguous.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The advanced trigger section relies on free-form phrases for powerful actions such as web clipping, version rollback, permission changes, and notifications without clear invocation boundaries. In a multi-skill or assistant setting, this increases the risk that normal conversation is interpreted as authorization for sensitive actions.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill advertises automatic local hardware profiling but does not prominently warn users that device characteristics such as CPU and memory will be collected and cached. Even limited device telemetry can be privacy-sensitive and can contribute to fingerprinting when combined with other metadata.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The bridge feature describes automatic synchronization of local file changes back to the cloud based on mtime monitoring. Automatic upload of local edits without a prominent, explicit warning and consent model can cause inadvertent disclosure of sensitive local content and unexpected overwrites of remote documents.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The memory bridge stores document events into long-term memory or local migration logs, but the feature description lacks a clear privacy warning and scope limitation. Persisting creation, editing, and sharing events can expose sensitive activity history beyond the user's expectations and expands the attack surface for data leakage.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The local automation capability is presented without a strong warning that it may invoke host-side office scripts or automation. That increases the chance of unsafe operator use and social-engineering abuse, especially in an agent setting where users may not realize a 'process' action crosses into local execution territory.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The memory bridge transmits document events to an external persistence layer without an obvious privacy warning or clear consent language. In practice, this can cause users or calling agents to export sensitive activity metadata off-platform without understanding the retention and access implications.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: kdoc_file_download writes remotely retrieved document content to any caller-supplied target_path without path restrictions, sandboxing, or confirmation. In an agent context, this can overwrite arbitrary files the process can access, enabling data clobbering, persistence file tampering, or writing sensitive content into unexpected locations.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The permanent delete method performs irreversible destruction with a single API call and no confirmation, safety interlock, or warning in this layer. In agent-driven workflows, accidental invocation or prompt-manipulated actions could cause unrecoverable loss of user documents at scale.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI test path prints the first 20 characters of a live OAuth access token to stdout. Even partial bearer tokens are sensitive because logs, terminals, CI output, shell history capture, or screenshots can expose credentials or materially aid token reconstruction/identification, especially in operational environments where output is centrally collected.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The HTML rendering path inserts item['text'] directly into table cells without HTML escaping. If compared documents contain attacker-controlled HTML or JavaScript, opening the generated report in a browser can execute script or inject active content, creating a stored/reflected XSS-style issue in the report consumer context.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The background listener continuously detects local file changes and uploads them to the cloud automatically, with no consent gate, policy check, or per-file authorization at sync time. In a skill that bridges local files and remote cloud documents, this can cause unintended exfiltration of sensitive edits or accidental propagation of malicious local changes to remote documents.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The upload path overwrites the remote cloud document using a local file with no version check, conflict detection, integrity verification, or explicit confirmation despite the operation being destructive. In this bridge context, a wrong or tampered local path can silently replace authoritative cloud content, causing data loss and potentially propagating malicious document content upstream.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This code transmits document activity metadata, filenames, document IDs, and arbitrary action details to an external zwjh subprocess without any explicit consent, notice, or transfer gate at the point of use. In a memory/agent skill context, that is sensitive behavioral data, and silent cross-component sharing can violate user expectations, privacy boundaries, or policy requirements even if the destination is local.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.