officecli-academic-paper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:04 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent academic document-generation guide, but its setup instructions ask users to execute downloaded installer scripts directly.

Review before installing. Prefer the GitHub release or another verifiable, version-pinned installation method for officecli, and avoid running the curl|bash or irm|iex commands unless you trust the installer source and have checked what it will execute.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Unverified Remote Installer Scripts Are Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–17
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

markdown

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Technical Analysis

The setup instructions download mutable scripts from d.officecli.ai and immediately execute them using Bash or PowerShell. The commands do not pin an immutable installer version, verify a checksum or cryptographic signature, or provide an inspection step before execution.

HTTPS protects the connection in transit but does not protect users if the hosting server, domain, publishing account, TLS endpoint, or installer deployment process is compromised. Because the effective executable payload remains external to the reviewed Skill, it can change after this package has passed an audit.

Installing officecli is relevant to the Skill's declared document-generation function. However, executing an unaudited remote response is not the least-risk installation method, particularly because the file also identifies a release-download alternative. The issue affects both supported installation paths:

• On macOS and Linux, curl sends the response body directly to bash.
• On Windows, Invoke-RestMethod retrieves the response and Invoke-Expression evaluates it as PowerShell code.

No subsequent credential theft, persistence, destructive operation, or privilege-escalation command was found in the audited file. Nevertheless, these commands create an unrestricted code-execution channel through which such behavior could be delivered later.

Attack Path

1. An agent or user loads the Skill and finds that officecli is unavailable.
2. The agent or user follows one of the documented setup commands.
3. An attacker compromises the installer host, domain, TLS termination point, deployment creden ...[truncated 1292 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash and irm | iex installation instructions.
2. Direct users to a version-pinned release hosted on the identified official GitHub releases page.
3. Publish SHA-256 or stronger checksums through an independently protected channel and require verification before execution.
4. Prefer cryptographically signed binaries or packages and verify the publisher signature and expected signing identity.
5. If installer scripts must remain available:
   • Download the script to a local file rather than piping it into an interpreter.
   • Use a versioned, immutable URL.
   • Verify its checksum or signature.
   • Display or inspect it before execution.
   • Execute it without administrative privileges unless a documented operation strictly requires elevation.
6. Document the files, network destinations, PATH changes, and other system modifications performed by the installer.
7. Provide platform-native, version-pinned package-manager instructions where package authenticity and integrity verification are supported.
8. In automated agent workflows, require explicit user approval before installing software or running any downloaded executable content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The curl -fsSL https://d.officecli.ai/install.sh | bash command is a classic external-script-fetching antipattern that grants immediate code execution to whatever content is returned at request time. In a skill context, this is more dangerous because users may treat setup commands as endorsed operational steps and run them without scrutiny, amplifying supply-chain and compromise risk.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

If `officecli` is missing:

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Verify with `officecli --version` (open a new terminal if PATH hasn't picked up). If install fails, download a binary from https://github.com/iOfficeAI/OfficeCLI/releases.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to pipe remotely fetched scripts directly into a shell (curl ... | bash and irm ... | iex), which enables arbitrary code execution from the network with no integrity verification, review step, or trust pinning. If the remote host, CDN path, DNS, TLS termination, or publishing pipeline is compromised, users executing the setup command can have their machines fully compromised.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

## Mental Model & Inheritance

**Inherits docx v2.** You should have read `skills/officecli-docx/SKILL.md` first. This skill assumes you know how to add paragraphs, set styles, build tables, insert images, manage TOC/footer/headers, force page breaks, and run the Delivery Gate. If any of those are unfamiliar, open a second session on docx v2 before continuing.

## Shell & Execution Discipline

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Quick Start example uses the heading text "1. Introduction" for an APA paper, but later documentation explicitly states that APA 7 Level-1 headings must be centered, bold, and unnumbered, and specifically says not to prefix APA headings with "1./2.". This is an active contradiction in the skill's own guidance, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.