Copyright Registration Helper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its copyright-registration document purpose, but it needs Review because it can automatically install an unpinned package and can persist sensitive identity details in generated files.

Install only if you are comfortable with a Chinese-language helper that collects copyright-registration PII and saves generated Word files locally. Prefer installing dependencies explicitly in an isolated environment first, and remove generated files containing ID numbers or addresses when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: main.py:9

Finding

Automatic Runtime Installation of an Unpinned Third-Party Dependency

Content

View full analysis

=1.1.0 ``` ### Technical Analysis When the `docx` module is unavailable, importing or executing `main.py` automatically invokes pip and installs `python-docx`. This changes the environment without an explicit installation or approval step. The package constraint specifies only a minimum version. It does not pin a reviewed release or verify package hashes. Consequently, the package selected at runtime can vary based on the execution date, configured Python package indexes, dependency resolver behavior, and available releases. Python packages may execute code during installation and are imported immediately afterward. If an attacker compromises a configured package index, a permitted package release, or the dependency distribution channel, attacker-controlled code could execute under the account running the Skill. This is a supply-chain weakness rather than evidence that the current `python-docx` package is malicious. ### Attack Path A viable exploitation path requires the dependency to be missing and an attacker to influence the package source or release: 1. ...[truncated 1490 chars]

Remediation

View remediation

``` 3. **Use hash verification** through a lock file or hash-pinned requirements generated by a dependency-management tool: ```text python-docx== \ --hash=sha256: ``` Include verified hashes for all transitive dependencies. 4. **Install dependencies during an explicit deployment or setup phase**, not while handling user requests. Use a dedicated virtual environment or isolated container. 5. **Restrict package sources** to an approved HTTPS index and disable untrusted supplemental indexes. Apply controls through deployment configuration rather than dynamically accepting the host's arbitrary pip configuration. 6. **Perform dependency review and update testing.** Upgrade pinned versions deliberately after vulnerability scanning and integrity verification. 7. **Run the Skill with least privilege** and restrict access to sensitive files, credentials, and network resources to reduce the impact of any future dependency compromise. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill includes explicit shell execution patterns such as python main.py ... and even an instruction to auto-install python-docx, but it declares no permissions or allowed-tools scope. This creates an undeclared execution surface where the agent may run local commands without clear sandboxing or operator awareness, increasing the risk of unintended command execution or environment modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description matches many broad copyright-related phrases without meaningful exclusions, so the skill may activate in contexts where users are only asking general legal, policy, or educational questions. Overbroad activation is dangerous here because the skill also collects sensitive identity data and can write files or run commands, causing unnecessary data exposure and tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs collection of highly sensitive personal data including identity document type/number, address, nationality, and contact details, but it provides no explicit privacy notice, retention limits, masking guidance, or minimization controls. In a registration-assistance context this data is plausible, which makes the issue more dangerous because users are likely to comply and disclose full PII unnecessarily.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This skill can modify its environment by installing packages through pip, which exceeds the expected behavior of a copyright-registration helper. In context, that makes the behavior more suspicious because the function does not need package-management privileges to fulfill its business purpose once dependencies are properly provisioned.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic dependency installation occurs without warning, consent, or disclosure to the operator. That is dangerous because it causes hidden environmental changes, may trigger network access, and can pull unreviewed code into the runtime through the package supply chain.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The code automatically invokes pip via subprocess at runtime when python-docx is missing. This introduces unexpected code execution and network/package-supply-chain risk in a skill whose stated purpose is only local document generation, especially because dependency installation happens without explicit user approval.

Content

Scanner excerpt · main.py (reported line 21)May include surrounding context.

python

from docx.oxml.ns import qn
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "python-docx", "-q"])
    from docx import Document
    from docx.shared import Pt, Inches, Cm, RGBColor
    from docx.enum.text import WD_ALIGN_PARAGRAPH

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill writes generated documents containing sensitive personal data such as names, ID numbers, addresses, phone numbers, and emails to disk under a local output directory. In the context of copyright registration, this is more sensitive than generic document generation because the files aggregate PII and rights-related records, yet the user is not warned about storage location, retention, or access controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill writes generated documents to a local output/ directory and exposes file paths, but it does not clearly warn the user that local files will be created and may persist on disk. Because the generated files may contain identity and rights-ownership information, silent local persistence increases confidentiality and data-handling risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest promises end-to-end assistance including determining work type and providing registration process, fee, and timing guidance. In this file, the implementation is limited to producing application forms, statements, templates, and batch document output, with no logic for classification or process navigation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The module description and all user-facing messages are written exclusively in Chinese, with no indication that other language options are supported. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as python-docx>=1.1.0, which allows future unreviewed versions to be installed and makes builds non-reproducible. Unpinned dependencies increase supply-chain risk because a later compromised or breaking release could be pulled in without notice.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

python-docx>=1.1.0

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin python-docx, so it is not possible to verify from this file alone whether the installed version is affected by known advisories such as older XXE-related issues. In a skill that generates or processes .docx documents, dependency ambiguity is more relevant because document-handling libraries may interact with attacker-supplied files in adjacent workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.