Copyright Registration Helper

• Outcome: Review
• Latest audit: Jul 20, 2026 · 4:37 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a legitimate copyright-registration document generator, but it automatically installs a dependency at runtime and handles sensitive identity data in persistent local files without enough handling guidance.

Review before installing. Use this only in a workspace where generated legal documents and identity details can be stored safely, and install dependencies through your normal trusted process instead of relying on the skill's automatic pip install path.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

from docx.oxml.ns import qn
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "python-docx", "-q"])
    from docx import Document
    from docx.shared import Pt, Inches, Cm, RGBColor
    from docx.enum.text import WD_ALIGN_PARAGRAPH

• Confidence: 98% confidence
• Finding: The code invokes pip at runtime via subprocess to install python-docx if the import fails. Even though the package name is hardcoded, executing package installation during normal skill operation expands the attack surface, performs network-dependent code acquisition, and can run arbitrary installer code without user approval.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs use of shell commands such as `python main.py ...` and even mentions auto-installing `python-docx`, but it declares no corresponding permissions or execution capability constraints. This creates an implicit code-execution pathway that can surprise the host environment, expand the attack surface, and enable unintended command execution or package installation if the implementation follows the document literally.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This skill exceeds its expected document-generation behavior by automatically installing a package at runtime. In a user-facing helper that handles legal-registration documents, unexpected environment modification is risky because it can introduce unreviewed code, trigger network access, and surprise operators who expect a pure local document generator.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill requests highly sensitive identity data such as ID type/number, address, nationality, and contact details, but provides no clear privacy notice, retention policy, minimization guidance, or handling restrictions. Because this skill is aimed at document generation, users may disclose full legal identity data that could be exposed, logged, retained, or misused if the environment is not properly controlled.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill saves generated documents to a local `output/` directory without clearly warning the user that files containing potentially sensitive personal and rights information will be written to disk. Local file creation can leave sensitive materials accessible to other users, processes, backups, or later sessions, especially in shared or unmanaged environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill writes sensitive personal and legal-registration data, such as names, ID numbers, addresses, phone numbers, and emails, into Word documents without any consent notice, minimization, or storage warning. In the context of copyright registration, these documents are likely to contain high-value personal data, increasing privacy and accidental disclosure risk.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code performs automatic package installation without notifying the user or requesting approval. Silent installation is dangerous because it changes the runtime environment, may fetch code from external sources, and can violate security expectations for a document-generation skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx>=1.1.0

• Confidence: 92% confidence
• Finding: The dependency is specified with only a lower bound, which allows installation of any future python-docx release. This can introduce unpredictable behavior or a vulnerable upstream version through supply-chain drift, especially when builds are recreated at different times.

Static analysis

No suspicious patterns detected.