Security audit

md-docx

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a document converter, but it asks for unrelated persistent memory access and has a resource-exhaustion risk when extracting DOCX images.

Install only if you are comfortable granting it file conversion authority and can withhold persistent memory permissions. Use it on trusted documents or in a sandboxed environment with file size, memory, CPU, and disk limits, especially for DOCX files with embedded media.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:44
Finding: Unnecessary Access to Agent Memory Capabilities
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/converter.py:342
Finding: Unbounded Decompression of Embedded DOCX Media
Content: View full analysis
Remediation: View remediation
MAX_MEDIA_FILES: raise ValueError("Too many embedded media files") if info.file_size > MAX_ENTRY_SIZE: raise ValueError("Embedded media file is too large") if info.compress_size == 0 and info.file_size > 0: raise ValueError("Suspicious compressed media entry") if info.compress_size > 0 and info.file_size / info.compress_size > 100: raise ValueError("Suspicious compression ratio") if total_written + info.file_size > MAX_TOTAL_SIZE: raise ValueError("Total extracted media size exceeds the limit") image_name = Path(info.filename).name image_path = images_dir / image_name written = 0 with zip_ref.open(info, "r") as source, open(image_path, "wb") as target: while chunk := source.read(CHUNK_SIZE): written += len(chunk) total_written += len(chunk) if written > MAX_ENTRY_SIZE or total_written > MAX_TOTAL_SIZE: raise ValueError("Extraction limit exceeded") target.write(chunk) ``` 4. Validate file signatures and permit only explicitly supported image formats. 5. Extract into a quota-controlled directory and remove partial files when extraction fails. 6. Run conversion in a sandbox ...[truncated 216 chars]

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares required tools and operational behavior but does not define any explicit tool scope such as allowed-tools or permissions. Because it processes user-supplied files, reads paths, writes outputs, and invokes a converter script, the absence of scope boundaries increases the chance of overbroad file access or unintended tool use if the agent/runtime grants broader capabilities than necessary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language description, instructions, and user-facing examples are entirely in Chinese and implicitly direct the interaction in that language, without offering a language choice. This can violate language or locale policy when users have not opted into Chinese or when the surrounding system expects language neutrality.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include very generic terms such as '文件转换' and '格式转换', which can cause the skill to activate in situations unrelated to markdown/docx conversion. Unintended invocation can expose uploaded files to the conversion workflow, cause unnecessary tool execution, or override a more appropriate skill for the user's real task.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Natural-language strings in the module docstring are entirely in Chinese, and the same monolingual behavior continues in the command-line description and help text. Because this is a general document conversion tool rather than an explicitly region-specific skill, forcing a single language without user opt-in is a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The argparse description and argument help strings are presented only in Chinese. This creates a natural-language locale restriction in a general-purpose utility without offering users a choice or stating a justified regional requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The visible instructional/content text in this file is written entirely in Chinese, which can constitute a language or locale policy violation when no user choice, opt-in, or justification is provided. The file does not indicate that Chinese is optional or that the skill is specifically intended for a Chinese-only context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.