ClawHub
Back to skill

Security audit

Word Vba

Security checks for vulnerabilities and agentic risk

Overview

This is a local Microsoft Word automation skill whose file access and document changes match its stated purpose, with no evidence of hidden network, credential, or persistence behavior.

Install only if you need local Microsoft Word automation on Windows. Use explicit output paths, keep backups of important documents, and avoid opening untrusted Word files because the skill drives Word under your user account.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description presents a broad Word read/write skill with complete read/write, batch handling, merge, and template-fill features. However, this code chunk is narrowly focused on reading Word documents through Word COM automation: opening documents, extracting paragraph/table data and formatting, producing plain text, and exporting results as JSON. That is a substantial description-to-behavior mismatch for the supplied code chunk because the declared primary capability set is much broader than what is actually implemented here. The JSON export is a minor undeclared capability, while the larger issue is that several declared core functions are absent from the code shown.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description is broader than the supplied code. While the code does match the VBA/ActiveX Word automation aspect and supports writing doc/docx-like outputs with formatting, tables, and opening existing documents, its implemented behavior is primarily document creation and writing. The only quasi-read-related behavior is opening an existing document and consuming a JSON file produced elsewhere; it does not extract content from Word documents. Important advertised features such as batch processing, document merging, and template filling are absent from this code chunk. Therefore the description does not accurately represent what this specific supplied code actually does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language documentation forces a specific language for users without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific context. Per the policy, a fixed language choice without user choice or justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents clear file read/write capabilities but does not declare any tool scope, permissions, or allowed-tools constraints. In an agent environment, this can lead to over-broad file access and makes it harder to enforce least privilege, especially since the skill performs document creation and modification on arbitrary paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill prominently describes document creation, overwriting, replacement, merge, and batch-processing workflows without warning that files may be modified or created. In an agent setting, users may trigger destructive operations on important documents without realizing the extent of filesystem changes, increasing the risk of accidental data loss or unauthorized modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This Python file contains user-facing descriptions and console output entirely in Chinese, starting with the module docstring and continuing throughout the script. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language descriptions and console messages that assume Chinese as the required language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and class documentation describe a Word document reading component, but the embedded test routine imports a writer, creates a document, writes content, and saves it to disk. That write behavior is not necessary for the runtime purpose of a read-only reader module and exceeds the file's documented intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

When output_path is None, batch_replace defaults to overwriting the source document and then saves it with SaveAs2. Although the docstring notes '默认覆盖原文件', there is no explicit warning, confirmation, or stronger disclosure that the operation will modify user data in place, making this safety-critical file write easy to trigger unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

generate_toc writes changes back to the original document when output_path is omitted, altering user content by inserting a table of contents and saving over the source. The method describes the default in the docstring, but it lacks a clear caution or confirmation for this destructive file-modification behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The batch_process method accepts an arbitrary caller-supplied processor(doc) callback and passes it a live Word COM document object with full automation capabilities. In this skill context, that effectively exposes unrestricted Word automation beyond the advertised utility helpers, enabling callers to run macros, access linked resources, alter security-sensitive document properties, exfiltrate content, or perform other COM-driven actions under the host user's privileges.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This Python file contains user-facing natural-language content such as the module description and runtime messages in Chinese only. Because the file does not provide any user opt-in, fallback language, or documented region-specific justification, it may violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code prints operational messages directly to users in a single language, and the same pattern continues throughout the file. Forcing one locale without user choice can create a natural-language policy violation when broader-language support is expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file documents file-creation and save operations such as creating a document and writing it to output.docx, which can affect user data on disk. The README does not include any caution about overwriting files, modifying documents, or using a safe output path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language description and invocation guidance are presented in Chinese, and the trigger phrases are also only specified in Chinese. This can amount to a language/locale policy issue because the skill appears to force a specific language without user opt-in or an explicit statement that it is intended for a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language documentation is primarily presented in Chinese, including the title, module descriptions, and requirements, with no indication that users may choose another language or that the skill is intentionally region-specific. This can violate a language/locale policy when a specific language is imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency is specified as pywin32>=227, which permits installation of any future version and prevents reproducible builds. This increases supply-chain risk because vulnerable or incompatible releases could be pulled in unintentionally, and security review cannot determine exactly what version will be deployed.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text
# 安装命令: pip install -r requirements.txt

# 核心依赖
pywin32>=227

# 可选依赖
# python-docx  # 如需与docx-tools协同使用

Unverifiable Dependency: pywin32 has 2 known advisory(ies) (CVE-2021-32559 (Integer overflow in pywin32); CVE-2021-32559 (An integer overflow exists in pywin32 prior to version b301 when adding an acces)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The manifest references pywin32 without pinning to a version that can be verified as patched, while known advisories exist for older releases. Because this skill is built around Word/VBA/ActiveX automation on Windows, pywin32 is a core dependency, so uncertainty about its version leaves open the possibility of installing a vulnerable build in a high-trust desktop automation context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description claims a broad Word document read/write capability set, including batch operations, merge, and template filling. In this file, the implemented behavior is limited to opening a single Word document, extracting paragraph/table data, and optionally exporting the extracted data to JSON.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module description and user-facing status/error strings throughout the file are presented only in Chinese, which imposes a specific language on users without any opt-in or locale selection. This is a natural-language policy issue because the skill does not offer a language/locale choice or document a justified regional constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes a Word read/write skill supporting doc/docx formats, and the module docstring likewise says it supports creating doc and docx files. However, the save logic accepts additional formats via file_format and maps pdf and rtf to Word export constants, extending behavior beyond the stated format scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.