Security audit

Sheet to Doc Skill

Security checks for vulnerabilities and agentic risk

Overview

This document-generation skill mostly does what it claims, but it forces promotional content and authorship metadata into every generated Word document without a clear opt-out.

Install only if you are comfortable with generated Word documents carrying Sheet-to-Doc promotional footer text and modified lastModifiedBy metadata. Avoid using this skill for contracts, certificates, official records, or client-facing documents unless you inspect and clean the generated files first. Review the npm lockfile source and dependency versions before installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

Location: scripts/generate.js:15
Finding: Unconditional Promotional Content and Metadata Injection into Generated Documents
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package-lock.json:18
Finding: Locked Dependencies Are Retrieved from a Third-Party npm Registry Mirror
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation explicitly states that generated documents include a footer mark and promotes upgrade links, while the static finding also notes branding changes in document metadata. This is a true transparency/integrity issue because the skill’s declared purpose is document generation from templates and JSON, but it also alters outputs for advertising/branding in ways that may not be fully disclosed in the top-level purpose. In enterprise or legal-document contexts, undeclared modification of document content or metadata can create trust, compliance, and reputational risks.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 354)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 523)May include surrounding context.
md
node scripts/generate.js --extract-placeholders --template path/to/template.docx

Known Vulnerable Dependency: @xmldom/xmldom==0.9.10 — 13 advisory(ies): CVE-2026-83608 (xmldom: DocType `name` Injection Bypasses requireWellFormed); CVE-2026-83609 (xmldom: Creation-time XML Name/QName validation is bypassable via an embedded li); CVE-2026-83605 (xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed) +10 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The lockfile pins @xmldom/xmldom to 0.9.10, and the provided advisory set indicates multiple known XML parsing/serialization weaknesses affecting name and attribute validation. In a document-generation skill that processes DOCX templates and XML parts through docxtemplater, malformed or attacker-controlled template content could trigger unsafe XML handling, leading to document corruption, parser abuse, or other downstream security issues depending on how untrusted templates are accepted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The note states that the placeholder format 'supports English field names,' which is a natural-language locale constraint in the skill documentation. Because the file does not present this as an optional preference or clearly justify it as a region-specific limitation, it can be read as forcing a language convention without user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code hardcodes promotional footer text and branding metadata that are later injected into every generated document, but this behavior is not reflected in the stated skill description. This is a supply-chain style integrity issue: users expect template rendering, not undisclosed content and metadata modification, which can leak tool usage, alter official documents, and violate trust or compliance requirements.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document generation flow always calls addFooterMark() and modifyDocumentProperties(), ensuring every output document is altered beyond placeholder replacement. In a document-generation skill, this is especially risky because outputs may be contracts, certificates, or other formal records where undisclosed footer and metadata tampering can create reputational, legal, or workflow impact.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE (reported line 8)May include surrounding context.
text
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This is a markdown file, so SQP-2 applies to missing user-facing warnings in the skill description. The Quick Start shows generating an output document via --output output.docx, but there is no warning anywhere in the README about file creation or potential overwriting of an existing output path.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.