Security audit

kdocs skill

Security checks across malware telemetry and agentic risk

Overview

This Kdocs skill is coherent for cloud document work, but it needs Review because it can broadly read, modify, share, and bulk-process cloud files while also using fallback bearer-token handling and a self-installing/updating CLI.

Install only if you intentionally want an agent to operate your Kdocs/WPS cloud account. Treat document contents, share links, download URLs, and tokens as sensitive; prefer browser login over pasting tokens into chat. Before allowing bulk reads, public sharing, overwrite/replace operations, knowledge-base archiving, or URL scraping, verify the exact files, destination, visibility, and rollback plan.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (65)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill invokes shell-capable commands (`bash`, `powershell`, `node`, and `kdocs-cli`) but does not declare corresponding permissions or clearly constrain that capability. This creates hidden execution power: an agent may run local commands, install software, or modify environment state without the permission model making that explicit.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is described as a document-operation skill, but its instructions also direct the agent to download archives, install/upgrade binaries, detect OS/architecture, and modify the local PATH via setup scripts. That is a materially broader trust boundary than users would infer, increasing supply-chain and local-environment risk if the remote package, CDN, or scripts are compromised.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documentation for `dbsheet.update_sheet` claims the tool only renames a data table, but its parameters also allow changing `primary_field` and `prefer_id`. This mismatch can mislead an agent or user into invoking a broader-mutating operation than intended, causing unintended schema changes or record-key handling changes in a cloud document system.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: `upload_attachment` permits the service to fetch arbitrary remote URLs, which introduces a server-side network ingestion capability beyond simple local document manipulation. In a cloud-document skill, this can expose users and the platform to SSRF-like behavior, unintended access to internal resources, metadata endpoints, or privacy leaks when agent-supplied URLs are fetched without strong restriction or disclosure.

Vague Triggers

High

Confidence: 91% confidence
Finding: The keyword list contains many broad everyday phrases such as writing help, summarization, translation, PPT generation, and report drafting, which can cause the skill to activate for generic productivity requests unrelated to Kdocs. Over-broad invocation can expose user content to an unnecessary external integration and trigger file operations in the wrong context.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The description frames the skill as applicable to very broad categories like writing reports, handling contracts/invoices, translation, content generation, note organization, and office assistance without clear activation limits. In context, this makes accidental invocation more likely and increases the chance that sensitive business content is routed into a cloud-document workflow when the user did not explicitly request that service.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation states that AI PPT performs online research and saves generated results to cloud storage, but it does not clearly warn that user prompts and source document contents may be transmitted to remote services for processing. This can lead users or integrators to submit sensitive business, personal, or regulated data without informed consent or appropriate data-handling controls.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The document instructs the user to copy an authentication token and provide it directly to the Agent, which exposes a bearer credential outside the normal browser/OAuth flow. Any party, log, prompt transcript, or downstream tool handling that message could reuse the token to access the user's Kdocs account and documents, making compromise of sensitive cloud documents possible.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This reference enumerates destructive and security-sensitive operations such as deleting sheets/records, changing permissions, enabling sharing, and creating webhooks, but gives no guidance to require explicit user confirmation or to warn about irreversible or external-exposure effects. In an agent skill, that omission increases the chance that the agent will perform high-impact actions from ambiguous or under-specified user requests, leading to data loss or unintended disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation exposes a capability to open a shared view, including options such as `share_to: anyone` and editable permissions, but it does not require an explicit user-facing warning or confirmation that this may expose document data externally. In a cloud document skill, this increases the risk of unintended public disclosure or over-broad sharing if an agent follows the procedure mechanically.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The permission-update operation allows changing a shared link to broader access (`anyone`) or stronger privileges (`edit`) without an explicit warning that access may be widened. In the context of a document-sharing skill, silent permission broadening can lead to accidental data exposure, unauthorized edits, or persistence of insecure sharing configurations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This reference enumerates powerful operations that can delete, move, restore, overwrite, upload, download, share, and modify cloud documents, including collaborator permissions and public link controls, but provides no cautionary guidance about user confirmation, least privilege, or handling sensitive content. In an agent skill context, such omissions can normalize unsafe automation and increase the chance that an LLM-driven agent performs privacy-impacting or destructive actions without explicit user awareness or consent.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The `scrape_url` flow automatically fetches external webpages and persists their contents as a new document, but the documentation does not prominently warn that this causes outbound network access and creates/stores a file as a side effect. That can surprise users, capture sensitive or access-controlled content into cloud storage, and increase the risk of unauthorized persistence of third-party data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: `upload_replace_file` performs full replacement of an existing file, a destructive action that can overwrite valuable content or attacker-targeted documents if invoked incorrectly. Without strong user warning or confirmation guidance, accidental or manipulated use can cause data loss, integrity compromise, and difficult-to-reverse changes in shared cloud documents.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: Allowing attachment upload via remote URL without documenting privacy and network implications can mislead users about the fact that the platform will contact third-party hosts. This may leak request metadata, fetch sensitive resources unexpectedly, or persist content from untrusted origins into documents without informed consent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This section documents creation and modification of labels that change user-visible metadata, but it does not clearly signal that these are state-changing operations requiring user awareness or confirmation. In an agent setting, weak distinction between read and write actions can cause unintended metadata changes, duplicate labels, or broad reclassification of documents when the model selects tools autonomously.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: These bulk add/remove/update operations can modify labels across multiple files or drives at scale, yet the documentation lacks prominent warnings about mass metadata changes. In an agentic environment, this increases the risk of accidental bulk retagging, removal of organizational labels, or silent workflow disruption if the tool is invoked from ambiguous user prompts.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation states that `download_attachment` returns a direct downloadable URL and that it should be used quickly because it is time-limited, but it does not warn that such URLs function as bearer-style access tokens and may expose sensitive file contents if logged, echoed to the user, pasted into chats, or stored in telemetry. In a document-management skill, this omission is materially risky because agents may treat the URL as harmless metadata rather than sensitive secret material.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The `read_file` interface allows reading full document contents via `url`, `link_id`, or `file_id`, including shared links, but the documentation does not include a privacy or authorization warning about the sensitivity of document contents or the need to verify user intent and scope before reading. Because this skill is specifically designed to access cloud documents, omission of such guardrails increases the chance that an agent will retrieve and expose confidential business documents, contracts, reports, or knowledge-base content too broadly.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The documentation describes a state-changing action that restores deleted files, but it provides no warning that the operation modifies user data or may have side effects. In an agent-skill context, weak emphasis on destructive or restorative state changes can lead to unintended actions being triggered without clear user confirmation, affecting data integrity and user expectations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents that creation is non-idempotent and mentions post-verification, but it does not clearly warn the user or calling agent that invoking this action will create persistent documents/folders and that retries can generate duplicates. In an agent setting, missing this warning can lead to unintended resource creation, clutter, and accidental duplicate records when the model retries after uncertainty or partial failure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation exposes a `status=3` option that makes a knowledge base internet-public, but it does not warn about privacy, confidentiality, or accidental data disclosure risks. In a cloud document and knowledge-base skill, this omission can lead users or downstream agents to publish internal business content publicly without informed consent or additional safeguards.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly recommends destructive operations such as block deletion and full-content replacement, but it does not clearly warn that these actions can irreversibly remove user data or overwrite important document content. In a cloud document skill, this increases the chance that an agent or operator performs high-impact edits without confirmation, backup, or recovery guidance.

Missing User Warnings

Low

Confidence: 77% confidence
Finding: The file documents exporting media links and downloading document attachments, including time-limited URLs, but does not warn about confidentiality or data-sharing risks. In a document platform that may contain contracts, invoices, reports, and knowledge-base content, this can lead to unintended disclosure or wider propagation of sensitive files and images.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This documentation describes a content-modifying operation that inserts blocks into a cloud document but does not explicitly warn that invoking it will change persistent user data. In an agent setting, missing modification warnings can cause unintended edits, duplicate insertions, or automation abuse, especially since the document itself notes the operation is not idempotent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup.cjs:80