word-formatter 黑灰白

• Outcome: Review
• Latest audit: Jul 28, 2026 · 7:02 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches Word document formatting, but its installer can fetch and update code from an external Git repository and install external toolchains, so it should be reviewed before use.

Review the installer before running it. Prefer installing from the reviewed artifact rather than the remote Git repository, pin Python and npm dependencies, and use the structured renderer unless you explicitly need Mermaid/Chromium rendering for trusted diagram input.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = [node_bin, mmd_js, "-i", mmd_file, "-o", out_name,
               "-b", "transparent", "-t", "default"]
        # mmdc 在工作目录输出
        subprocess.run(cmd, cwd=out_dir, env=env, check=True,
                       stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    finally:
        os.unlink(mmd_file)

• Confidence: 93% confidence
• Finding: The code executes an external Mermaid CLI via subprocess using document-controlled diagram content and an output path derived from user input. Although it avoids shell=True, invoking a browser/Node-based renderer expands the trust boundary and can expose the host to parser bugs, unexpected networked behavior in dependencies, or execution of unreviewed local toolchains.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to use environment variables, read/write local files, and execute shell commands, but no permissions are declared in the manifest. This creates a capability transparency gap: operators and policy layers may assume the skill is low-risk formatting logic while it can actually invoke local tooling and manipulate documents on disk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented behavior extends beyond the stated pure python-docx formatting scope by introducing external toolchains such as Node/npm and mermaid-cli, and the finding indicates remote code retrieval/update behavior. Hidden or under-disclosed dependency execution materially increases supply-chain and arbitrary command-execution risk because a user invoking a formatting skill may unknowingly authorize execution of externally sourced code.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The skill documentation adds a Mermaid/Node/Chromium rendering path that is broader and riskier than the declared formatting-only Python workflow. Even if intended for richer diagrams, this expands the attack surface to external binaries and package ecosystems, which can introduce supply-chain issues or unsafe subprocess behavior in an environment that users may perceive as offline document processing.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This module claims Word-formatting functionality but can invoke an external Node/Mermaid rendering stack, which materially changes the security model. Processing untrusted Mermaid text through external tooling may introduce supply-chain, sandbox escape, or parser exploitation risk beyond normal offline document formatting.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The script claims strict black/white/gray formatting, yet `set_run_font()` preserves existing explicit RGB colors unless `enforce_color` is set. In a document-processing skill used for client deliverables, this can allow hidden or unexpected colored emphasis to survive sanitization, and the header can also inject client-identifying text into every page, increasing metadata/privacy exposure if configuration is untrusted or mistaken.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrase at line 16 is broad enough to activate on common document-assistance requests that may not actually require this specialized skill. In an agent environment, overbroad routing can cause unintended handling of user content, leading to unnecessary access to sensitive documents or incorrect application of formatting logic.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger at line 17 is ambiguous because it does not clearly constrain the supported formatting scope, so it may match generic editing or layout requests outside the skill's intended domain. This increases the chance of accidental invocation and misrouting of potentially sensitive business documents.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrase at line 22 is too general and likely to collide with ordinary requests for editing, proofreading, or document cleanup. In a document-processing skill, that broad match surface can expose confidential report contents to the wrong toolchain or cause unintended automated modifications.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger at line 23 is underspecified and could match unrelated content-editing actions like inserting ordinary images or diagrams into non-report documents. Because this skill is designed for high-value consulting deliverables, accidental activation could lead to inappropriate processing of documents containing regulated or confidential information.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code can launch external rendering tooling without any user-facing confirmation, which is risky in an agent skill expected to perform local document formatting. Hidden external execution reduces informed consent and may surprise operators in restricted environments where subprocesses or browser-based renderers are disallowed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx>=1.1.0
matplotlib>=3.7.0
pillow>=10.0.0

• Confidence: 92% confidence
• Finding: `python-docx>=1.1.0` is unpinned, so installs may drift to different versions over time and pull in unexpected dependency changes or regressions. While this is primarily a supply-chain hygiene issue rather than an immediate exploit by itself, it reduces build reproducibility and can expose the skill to newly introduced vulnerable releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx>=1.1.0
matplotlib>=3.7.0
pillow>=10.0.0

• Confidence: 94% confidence
• Finding: `matplotlib>=3.7.0` is unpinned, which allows future package resolution to install any newer release, including versions with breaking behavior or undiscovered security issues. In a document-formatting skill that may render user-influenced charts and graphics, reproducibility and controlled dependency updates are important.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx>=1.1.0
matplotlib>=3.7.0
pillow>=10.0.0

• Confidence: 97% confidence
• Finding: `pillow>=10.0.0` is unpinned, which is especially risky because Pillow processes image data and has a long history of parser-related vulnerabilities. In this skill, image handling is part of the core feature set ('图件处理'), so allowing arbitrary newer versions without review increases exposure to supply-chain and image-parsing risk.

Known Vulnerable Dependency: pillow==10.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: The finding indicates use of `pillow==10.0.0`, a version associated with multiple advisories including memory-safety and potential code-execution issues in image parsing paths. This skill explicitly performs document image/figure processing, so vulnerable Pillow code would likely be reachable when handling user-supplied images embedded into reports, making the context materially more dangerous.

Static analysis

No suspicious patterns detected.