Docx Tools

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

This is a local Word-document utility with ordinary file read/write risks, not evidence of hidden access, exfiltration, persistence, or malicious behavior.

Install only if you are comfortable with a local Python tool reading and writing the document paths you provide. Use explicit output filenames, keep backups of important documents, and prefer pinned dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:268

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:268, SKILL.md:292, README.md:12, and skill.json:13
Vulnerability Type: Unpinned and unnecessary third-party dependencies
Risk Level: Medium

Complete Code Snippets:

SKILL.md:268:

bash

pip install python-docx markdown

SKILL.md:292:

text

pip install python-docx

README.md:12:

bash

pip install python-docx

skill.json:12-14:

json

"dependencies": {
  "python": ["python-docx", "markdown"]
}

Technical Analysis

The project instructs users to install third-party packages without version constraints, integrity hashes, or a lockfile. Consequently, package resolution depends on the mutable state of the configured Python package index at installation time.

If an upstream release, maintainer account, package index, or dependency artifact is compromised, the installation process could retrieve attacker-controlled code. Python packages may execute build-system or installation logic during installation, and imported packages execute module initialization code at runtime.

The declared markdown package is not imported by any reviewed Python script. Keeping this unused dependency unnecessarily expands the software supply-chain attack surface.

No evidence shows that the currently named packages are malicious. The vulnerability is the unsafe, non-reproducible dependency acquisition process.

Attack Path

1. A user follows the documented installation command or an agent processes the dependencies declared in skill.json.
2. pip resolves the latest package versions available through the environment's configured package index.
3. An attacker compromises an upstream release, publishing account, index, mirror, or resolved dependency artifact.
4. The unpinned installation retrieves the compromised artifact because no approved version or cryptographic hash is enforced.
5. Malicious installation or i ...[truncated 710 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unused markdown dependency unless a reviewed implementation genuinely requires it.
2. Pin every direct dependency to an explicitly reviewed version.
3. Generate a lock or requirements file containing hashes for all direct and transitive artifacts.
4. Install with hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

5. Configure installations to use an explicitly trusted package index or an internally controlled artifact repository.
6. Perform dependency installation in an isolated virtual environment using an unprivileged account.
7. Add automated dependency vulnerability and provenance checks to the release process.
8. Keep README.md, SKILL.md, and skill.json synchronized so they all specify the same reviewed dependency set.

T09 · Insecure Skill Coding Practices

Warning

• Location: docx_to_md.py:13

Finding

Implicit Output-Path Derivation Can Overwrite Source Documents

Content

View full analysis

Vulnerability Details

File Location: docx_to_md.py:13-14,46-47 and md_to_docx.py:13-16,46
Vulnerability Type: Unsafe file-path handling and destructive source-file overwrite
Risk Level: Medium

Complete Code Snippets:

docx_to_md.py:13-14:

python

if not output_path:
    output_path = input_path.replace('.docx', '.md')

docx_to_md.py:46-47:

python

with open(output_path, 'w', encoding='utf-8') as f:
    f.write('\n'.join(md_content))

md_to_docx.py:13-16:

python

if not output_path:
    output_path = input_path.replace('.md', '.docx')

with open(input_path, 'r', encoding='utf-8') as f:
    md_content = f.read()

md_to_docx.py:46:

python

doc.save(output_path)

Technical Analysis

Both converters derive a default destination using case-sensitive str.replace(). If the expected lowercase substring is absent, Python returns the original string unchanged. The input and output paths can therefore become identical.

For example, a valid DOCX package named report.DOCX, report.bin, or simply report can be successfully parsed by python-docx, after which docx_to_md.py opens that same path in write mode and replaces the original package with Markdown text. Similarly, md_to_docx.py can read text from a path that does not contain lowercase .md and then save a DOCX package over that same path.

The code does not compare canonical input and output paths, require confirmation before replacement, create a backup, or use an atomic temporary-file workflow. This makes the behavior destructive when a caller supplies a valid source with an uppercase, missing, or unconventional suffix.

Attack Path

1. A user or automated agent invokes a converter without specifying an explicit output path.
2. The input is valid for the parser but its path does not contain the expected lowercase suffix. Examples include proposal.DOCX for docx_to_md.py or `no ...[truncated 1096 chars]

Remediation

View remediation

Remediation Suggestions

1. Use pathlib.Path.with_suffix() rather than case-sensitive string replacement:

   python

   from pathlib import Path
   
   source = Path(input_path)
   destination = Path(output_path) if output_path else source.with_suffix(".md")
   

2. Resolve and compare the source and destination before writing:

   python

   if source.resolve() == destination.resolve():
       raise ValueError("Input and output paths must be different")
   

3. Validate the expected input suffix case-insensitively and reject unexpected file types unless explicitly supported:

   python

   if source.suffix.lower() != ".docx":
       raise ValueError("Input must have a .docx extension")
   

4. Refuse to overwrite an existing destination by default. Require an explicit overwrite=True option for intentional replacement.
5. Write to a temporary file in the destination directory, flush and validate the result, and then atomically rename it into place.
6. Add regression tests covering uppercase extensions, missing extensions, multiple suffixes, identical canonical paths, symbolic links, and existing destination files.
7. Apply the same protections consistently to both docx_to_md.py and md_to_docx.py.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code is local-only and does write a Word document, which partially aligns with the description's local document handling claim. However, the declared purpose presents a broader Word processing toolkit with DOCX/Markdown conversion, document read/write support, and multi-chapter integration. The actual code only creates one predefined DOCX file with hardcoded content for a grant proposal section. It does not convert Markdown, does not read documents, and does not generally merge multiple input chapters or documents. The primary purpose is therefore materially narrower and different from the declared toolkit description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied code is limited to a single local capability: reading .docx content from paragraphs and tables. It does not perform network access, which is consistent with the description's local-only claim. However, the declared description presents a broader toolkit with conversion, writing, and chapter-integration functionality, none of which appear in this code chunk. While the implemented behavior is related to the general domain of Word document handling, the description overstates what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code is consistent with part of the declared description in that it performs local Word document writing and does not use the network. However, the declared purpose describes a broader toolkit including DOCX/Markdown conversion, document reading, and multi-chapter consolidation. This specific code chunk only supports creating and saving DOCX files with simple content and headings. That is a materially narrower behavior than the declared description, so the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises and demonstrates local file read/write behavior but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity: an agent or reviewer cannot easily verify what filesystem access is intended, increasing the risk of over-broad file operations or accidental access to sensitive local documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code hard-codes Chinese-language document content, font selection, headings, return messages, and a Chinese default filename, with no option for the user to choose another language or locale. That is a natural-language policy concern because the skill enforces a specific language by default rather than offering a language choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents capabilities to write .docx files and convert documents between formats, including a save operation example, but it provides no user-facing warning about file modification or overwrite risks. Under the markdown-specific SQP-2 criteria, descriptions of behaviors that can affect user data should disclose that impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file’s description, instructions, examples, and operational guidance are presented in Chinese as the default, with no indication that users may choose another language. This can violate a language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This manifest lists tool names but provides no invocation constraints, trigger examples, or exclusion conditions describing when the skill should activate. For a manifest file, the lack of specificity can make activation overly broad or ambiguous if downstream systems infer capability from generic document-processing terms alone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown content is entirely written in Chinese, and there is no indication that the skill offers a language choice or documents a justified locale restriction. Per the policy, forcing a specific language without user opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file content is entirely in Chinese and provides no indication that language choice is optional or that the skill is specifically intended for a Chinese-language or region-specific context. This can violate language/locale policy when users are not given an explicit choice or justification for the locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.