T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wps_word_automation.py:14- Finding
Untrusted Documents Are Opened Without Explicitly Disabling Active Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Tiangong Wps Word Automation
Security checks for vulnerabilities and agentic risk
Overview
This is a real document automation skill, but it needs Review because it opens Word/WPS documents through COM without active-content protections and has under-scoped write and merge behavior.
Install only if you intend to automate trusted Word/WPS documents on Windows. Avoid using it on documents from unknown sources unless Office/WPS macro and Protected View policies are enforced, use separate output paths, keep backups, and consider pinning pywin32 before installation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:13- Finding
Runtime Dependency Installation Is Unpinned and Unverified
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented behavior conflicts with the stated scope: the skill says it is for single-document actions, yet it includes a multi-document merge command, and it claims image replacement without documenting or evidencing that behavior. Description-behavior mismatches are dangerous because they can mislead users and reviewers about operational scope, causing broader file processing or unexpected modifications than intended.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises file-modifying capabilities through documented save, export, split, merge, and image operations, but it does not declare any tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and informed consent, because an orchestrating system may not correctly surface that the skill can write or create files affecting user data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest states the skill is limited to single-document operations, but the documented merge command accepts multiple inputs and produces a combined output. This inconsistency can defeat user expectations and safety review assumptions by expanding the data scope from one file to many, increasing the chance of unintended disclosure or destructive processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Several commands save, export, split, merge, or otherwise create modified document files, but the documentation does not prominently warn about write effects, output creation, or overwrite risk. In a document automation context, this increases the chance of accidental data loss, unintended alteration of important files, or silent generation of derivative copies containing sensitive content.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The notes tell users to avoid batch usage and describe the skill as single-document only, yet the documented commands include multi-document processing via merge. Conflicting guidance is a safety issue because operators may rely on the note while the implementation still allows broader processing, leading to accidental handling of more data than expected.
- Content