Security audit
Security checks for vulnerabilities and agentic risk
This office toolkit needs review because unsafe file handling, unreliable task cancellation, and ineffective safety controls can expose documents or lose work.
Use an isolated workspace and copies of documents until these flaws are fixed. Avoid search-result auto-opening, untrusted templates or watcher rules, and unattended scheduling. Watcher dry-run is not side-effect-free. Save and close Office work before diagnostics or cleanup, select rule-engine for local meeting summaries, and verify Linux crontab entries directly after cancellation. Do not rely on the blanket offline or backup assurances.
scripts/doc_search.pyOpening a search result executes shell syntax in its filename
Shell command substitution remains active inside double quotes. A filename containing $() or backticks can therefore execute attacker-selected commands before xdg-open runs, potentially reading or modifying files accessible to the process.
scripts/template_manager.pyShared-template metadata escapes the template installation directory
A name such as ../existing_report causes the package's .docx content to overwrite an existing report outside user_templates when its parent directory exists and is writable. Absolute names can likewise bypass the intended directory. Destination suffixes remain constrained to the selected .docx, .xlsx, or .pptx source; arbitrary-extension code execution is not established.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
)
try:
with urllib.request.urlopen(req, timeout=60) as resp:
result = json.loads(resp.read().decode("utf-8"))
translated = result["choices"][0]["message"]["content"]
return {"text": translated}
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
)
try:
with urllib.request.urlopen(req, timeout=30) as resp:
result = json.loads(resp.read().decode("utf-8"))
content = result["choices"][0]["message"]["content"]
return {"summary": {"raw": content}, "structured": False}
The scanner reports executable YAML rules and document modifications in watch.py despite its event-only description, including writes during dry-run. If an attacker can influence those rules, the watcher could execute attacker-selected programs with the agent's privileges, while misleading dry-run behavior can cause unexpected data changes; source review is needed to verify these paths.
According to the scanner, generated reports load external JavaScript despite being advertised as inline, self-contained, and local-only. Such scripts execute in the report page and can access rendered business data, creating a third-party supply-chain and privacy exposure; the actual script URL and safeguards were not supplied.
The supplied module's primary purpose is document translation, rather than one of the specifically described capabilities. More importantly, it introduces an undeclared external data flow: when an external translation method is explicitly selected and credentials are available, document text may be submitted through llm_bridge or sent to a configurable API endpoint with bearer authentication. Default auto mode stays local and does not read API keys, which limits exposure but does not remove the description mismatch. The printed warning is not an interactive confirmation. The absence of other suite features from this individual code chunk is not itself treated as a mismatch.
The supplied module primarily implements a general-purpose LLM bridge rather than the declared Office automation features. Although text-processing assistance can support office workflows, the description does not disclose cn-llm-router integration or delegation of supplied content to it; the declared kingdoc bridge is a different integration. The code directly demonstrates local subprocess execution and prompt handoff, but does not establish whether the invoked router sends content over a network. No direct credential access or network requests are visible in this chunk. Missing implementations of other suite features are not themselves treated as mismatches.
The supplied script primarily implements email-response generation, a capability absent from the detailed declared feature list. Its optional DOCX export and spreadsheet input overlap with ordinary office-document operations, but those supporting features do not account for its main email-drafting purpose. No network access, credential collection, automatic sending, or external LLM invocation appears in the code. This is a functional disclosure mismatch, not evidence of malicious behavior; the absence of other suite features from this single code chunk is not itself treated as a mismatch.
Most visible behavior supports the declared reporting features, including local template access, document output, and usage-summary integration. However, --polish introduces a separate LLM-router integration and passes report text to it. The declared kingdoc upload and optional memory bridge do not describe this report-polishing data flow. The supplied chunk establishes delegation to cn-llm-router, but does not establish whether its implementation uses a remote service, reads credentials, or performs network requests. Those downstream behaviors cannot be confirmed from this code alone.
Although environment self-checks are declared, using their results to populate an email to an external feedback recipient is a distinct, undeclared capability. The supplied chunk primarily implements external feedback rather than the described Office operations. It launches browser or email handlers through subprocess; it does not itself send the email or demonstrate automatic diagnostic uploading. The mismatch concerns the undisclosed feedback destination and diagnostic-sharing workflow, not subprocess usage as an implementation detail.
Much of this dispatcher supports the stated office-workflow purpose, particularly reports, meeting minutes, and formulas. However, the description does not disclose its broader AI-writing functionality or the external model and speech-service integrations exposed here. The declared kingdoc cloud bridge and optional zwjh memory bridge are different integrations and do not explain these capabilities. The supplied code establishes delegation to llm_bridge and selectable external processing methods, but the imported implementations are absent, so actual network requests, credential access, and provider data handling cannot be verified. Missing implementations of other advertised suite features are not treated as mismatches because this is only one code chunk.
The main meeting-minutes workflow matches the description, but the description does not disclose these additional external processing services or their sensitive-data flows. Azure and Google transcription require explicit method selection; automatic ASR stays local or uses a template. External-LLM summarization likewise requires explicit selection because the always-available local rule engine precedes it in automatic selection. These restrictions reduce unexpected exposure but do not eliminate the undeclared capabilities. The Azure/Google warnings are printed notices, not interactive confirmation gates. Local audio segmentation, temporary files, MFCC clustering, and Word generation are supporting implementation details rather than mismatches. Other suite features cannot be assessed from this single module.
The reported implementation force-terminates Office processes without establishing ownership or obtaining confirmation, which can destroy unsaved work in unrelated sessions. Silent DLL registration and deletion of unrelated temporary files also exceed safe COM resource release; these implementation details are reported by the scanner but cannot be independently verified from SKILL.md alone.
Although spreadsheet writing and template creation fit the declared office-automation scope, invoice OCR and automated financial bookkeeping are distinct user-facing capabilities not disclosed in the description. The supplied chunk is primarily dedicated to those capabilities rather than merely implementing a supporting detail of a listed feature. Its visible resource access is limited to local input files, local OCR execution, and Excel output; no network transfer is shown. Features elsewhere in the declared suite are not treated as missing merely because this is a partial code sample.
Although troubleshooting and environment checks are declared, preparing system information for an email feedback workflow introduces an undisclosed communication and potential information-sharing capability. The supplied chunk does not show the script implementation, recipient, exact information included, or automatic sending, so it does not establish actual transmission or exfiltration.
The templates concern Office workflows, but this chunk's primary capability is managing a bridge to a separate multi-agent orchestration skill, which the description does not identify despite explicitly naming other integrations. The implemented bridge only stores local metadata: its claims of registering with an engine and falling back to local execution are not backed by engine calls or execution logic in this chunk. No network access, credential access, subprocess execution, or document processing is demonstrated; the subprocess import and template action names do not establish those behaviors.
Most visible operations fit the declared office-automation purpose. However, document translation and context-aware email-reply drafting are distinct user-facing capabilities not identified in the supplied description, rather than merely supporting implementation details. The code only drafts replies; it does not visibly send email. Backend implementations are not supplied, so external transmission or specific translation behavior cannot be established. Local subprocess delegation is consistent with the declared architecture, and features absent from this individual chunk are not treated as mismatches.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
��段式要素化纪要（待办清单+决策记录+风险异议，每节独立页眉）；增加：说话人标注 SpeakerDiarization（MFCC 聚类或显式报名，独立 diarize 子命令）；增加：--diarize/--no-diarize 参数控制说话人标注；增加：--num-speakers 参数指定说话人数 |
| v5.0.0 | 2026-08-16 | 增加：定时任务注册管理 schedule_register.py（schtasks/crontab 双平台，4个预定义任务，注册前展示命令确认，list/cancel/enable管理）；增加：目录轮询监听 watch.py（轮询间隔3秒无内核依赖，YAML规则表匹配，>50MB自动分片并行处理+合并输出，LibreOffice并发池控制）；增加：使用统计与稳定性中心 usage_stats.py（SQLite埋点：操作数/耗时/引擎命中/失败降级/重试成功率，stats日/周报表+引擎健康度，全局engine-info合并3脚本，引擎偏好优先级配置）；增加：COM三步自愈 com_health.py self-heal子命令（regsvr32重注册→WPS修复�
Cleanup equates Office process names with abandoned processes and unconditionally uses taskkill /F, even without the force option. Consequently, routine recovery can destroy unsaved user work across multiple Office applications rather than merely releasing the skill's COM resources.
On non-Windows systems, a search result's path is interpolated into a shell command, and double quotes do not prevent command substitution such as $(...). An attacker-controlled document filename or tampered index can therefore execute commands with the user's privileges when it becomes the top result and --open is requested.
if args.open and results:
top = results[0]
try:
os.startfile(top["file"]) if sys.platform == "win32" else os.system(f'xdg-open "{top["file"]}"')
print(f"📂 已打开：{top['file']}")
except Exception as e:
print(f"⚠️ 打开失败：{e}")
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# kingdoc 配置文件候选路径（相对 kingdoc 根目录）
KINGDOC_CONFIG_CANDIDATES = [
"config.json",
".env",
"engine/config.json",
]
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
has_secret = bool(data.get("appSecret") or data.get("app_secret"))
result["has_app_key"] = has_id and has_secret
else:
# .env 格式
has_id = "APP_ID" in content or "appId" in content
has_secret = "APP_SECRET" in content or "appSecret" in content
result["has_app_key"] = has_id and has_secret
The module promises that no data leaves the machine, yet forwards complete prompts and document text to an independently installed LLM router and automatically prefers that router when available. Although the provided code does not establish the router's actual network behavior, it provides no local-only enforcement or disclosure gate, so a cloud-configured router could receive sensitive office documents contrary to that assurance.
A managed Linux task occupies a comment line followed by a command line, but cancellation removes only lines starting with the comment marker. The command therefore remains active while the registry entry is deleted and success is reported, creating persistent execution that survives the user's cancellation.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
continue
pattern = rule.get("pattern", "")
if fnmatch(filename, pattern):
return rule
return None
def get_chain(self, rule: Dict) -> List[Dict]:
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
def get_chain(self, rule: Dict) -> List[Dict]:
"""获取处理链"""
return rule.get("chain", [])
def get_poll_interval(self) -> int:
return self.settings.get("poll_interval", DEFAULT_POLL_INTERVAL)