Security audit

Fword Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Word/LaTeX conversion skill with expected AI-provider, setup, and local workspace side effects that users should understand before use.

Install only if you are comfortable with its setup and data flow. Use --raw for documents that should stay local, review setup.sh before running because it may use sudo or package managers, use trusted AI endpoints and scoped API keys, and delete the .fword workspace when you no longer need style-preserving back-conversion.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to read environment variables, read user-supplied files, and write output/workspace files, but it does not declare these capabilities as permissions. This undermines informed consent and makes it harder for users or a policy layer to understand that the skill can access API keys and persist document data on disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose presents the skill as a document converter, but the behavior also includes persistent storage of original documents and metadata, conversion history tracking, and host setup actions that may install software. Those extra behaviors expand the privacy and system-modification footprint beyond what a user would reasonably expect from the description, increasing the risk of silent data retention and unintended host changes.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The setup script automatically installs a system package using host package managers and invokes privileged commands, which exceeds simple local skill initialization and modifies the user's system state. In a skill context, this is risky because running setup can trigger unintended privileged changes on the host without explicit informed consent or review.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill supports multiple external AI providers for refinement, which implies document contents may be transmitted off-host, yet the description and notes do not prominently warn users about this data egress. For sensitive Word documents, this can lead to confidentiality, compliance, or contractual violations if users assume conversion is purely local.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The usage guide encourages sending documents to multiple external AI providers and even arbitrary OpenAI-compatible endpoints, but it does not warn users that document contents may be transmitted off-host. This creates a real privacy and compliance risk because users may process sensitive Word files under the false assumption that conversion is local unless they notice the provider/API-key details and infer the consequence themselves.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workspace section states that `.fword/` stores a copy of the original document as `reference.docx`, but it does not warn that this is a persistent local duplicate of potentially sensitive content. Users may delete or share the original document while overlooking the retained copy, increasing the chance of unintended disclosure through backups, source control, shared directories, or multi-user systems.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The function sends raw LaTeX document content, plus optional title and author metadata, to third-party LLM providers with no explicit consent gate, redaction, or privacy warning in this code path. In a document-conversion skill, inputs may contain sensitive unpublished manuscripts, personal data, or confidential business material, so silent external transmission creates a real confidentiality risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: When AI refinement is enabled, the script sends raw LaTeX derived from the document plus extracted metadata such as title and author to a configured external AI provider. Users may not realize their document contents and metadata are being transmitted off-host, which creates a real confidentiality and privacy risk, especially for sensitive or proprietary documents.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script performs privileged package installation with only a generic status message ('Attempting to install...') and no explicit warning that sudo/system-wide changes will occur. This reduces user awareness and increases the chance of users authorizing elevated operations they did not intend to permit.

Static analysis

No suspicious patterns detected.