T08 · Insecure Dependencies
Warning
- Location
SKILL.md:15- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
ODT File Manager & Editor
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local ODT document editor with disclosed setup and examples; the main cautions are unpinned dependency installation and optional handoff to a separate NextCloud skill.
Install dependencies in a virtual environment, prefer pinned and reviewed package versions where possible, and only use the NextCloud examples when you intend the agent to download or upload those documents through the separate NextCloud skill.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The reference includes an end-to-end pattern that invokes subprocess-based download and upload actions via another skill, expanding this skill's practical scope from local ODT editing into external file transfer and command execution. While the example uses fixed arguments rather than obvious shell injection, embedding cross-skill subprocess usage in documentation can encourage agents to execute commands on untrusted paths or content and weakens the boundary between document editing and system-side effects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says to use the skill when the user asks to "create, edit, read, update, append to, inspect, or manipulate any ODT file," which is a very broad activation condition without explicit constraints or negative examples. In a markdown skill description, this can overlap with many ordinary document-related requests and makes it unclear when this skill should or should not activate.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes creating, parsing, and editing ODT files locally using Python and odfdo. Documenting shell commands such as odfdo-replace, odfdo-show, and related utilities broadens the implied operational model to command execution, which is not necessary from the stated purpose and could encourage implementations that spawn external processes.
- Content