Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Kdocs/WPS cloud-document CLI integration, but it needs review because it handles account tokens, installs an external binary, and has some unsafe or conflicting guidance around destructive document actions.
Install only if you trust the Kdocs/WPS CLI distribution channel and are comfortable granting it access to your personal WPS cloud documents. Prefer browser-based kdocs-cli auth login over pasting tokens into chat, confirm any delete/share/webhook operation explicitly, and review generated actions before allowing bulk edits or deletions.
声明描述的是面向用户的云文档操作能力，而实际代码并未执行任何文档的新建、读取、编辑、搜索、分享、知识库管理等操作。相反，它的主要功能是安装一个本地 CLI 工具：访问远程 CDN、下载发布包与 checksums、校验 SHA256、解压、复制二进制到 ~/.local/bin，并写入 .source 文件。这属于本地软件安装/部署行为，是与所声明的云文档处理能力 materially different 的主要用途，因此构成明显不匹配。
Referenced artifact was not completely inspected
| 安装 | `bash scripts/setup.sh` / `powershell scripts/setup.ps1` / `node scripts/setup.cjs` |
Referenced artifact was not completely inspected
| 安装 | `bash scripts/setup.sh` / `powershell scripts/setup.ps1` / `node scripts/setup.cjs` |
Referenced artifact was not completely inspected
| 安装 | `bash scripts/setup.sh` / `powershell scripts/setup.ps1` / `node scripts/setup.cjs` |
At L31, the document instructs the user to hand a Token to the Agent, which is a sensitive authentication credential. The surrounding guidance does not warn that the token grants account access, should be treated like a secret, or should only be shared with trusted tooling, so the user is not adequately informed of the risk.
The step '用户将 Token 提供给 Agent' is a natural-language instruction to disclose a sensitive credential to the model or agent. This is an explicit data-leak pattern conveyed semantically rather than through technical exfiltration code, because it normalizes handing over a secret for onward use.
L38-L47 明确描述了按页删除浮动图片，并直接执行 delete 操作，这是会影响用户数据且可能不可逆的行为。该 markdown 未提醒用户删除后果、建议确认范围，也未说明应在执行前进行用户确认，因此缺少必要的用户警示。
The delete operation is marked 幂等性：是 — safe, and the name-setting capability is also marked safe despite supporting update. Describing mutating or destructive actions as safe can mislead users into thinking there is no data-modification risk, and the markdown provides no corrective warning elsewhere.
wpp.slide.items.delete is clearly a destructive state-changing action, but the documentation labels it as safe. This directly contradicts the described behavior and could cause an agent to execute deletion under assumptions reserved for read-only operations.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| 字段 | 类型 | 说明 |
|------|------|------|
| `code` | number | 0 表示成功 |
| `data` | object | 渐变读回（content 为 JSON 字符串：fill_type/gradient_style/gradient_variant/fore_color/back_color/begin/end） |
| `message` | string | 结果说明 |
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
#!/bin/sh
# kdocs-cli installer — downloads the platform-specific binary to a global PATH location.
# No Node.js or Go required. Only curl/wget needed.
#
# Usage:
# bash scripts/setup.sh
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
#
# Usage:
# bash scripts/setup.sh
# curl -fsSL <CDN>/setup.sh | sh
#
# Environment variables (all optional):
# KDOCS_CLI_VERSION — version to install (default: read from SKILL.md or "latest")
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
#
# Usage:
# bash scripts/setup.sh
# curl -fsSL <CDN>/setup.sh | sh
#
# Environment variables (all optional):
# KDOCS_CLI_VERSION — version to install (default: read from SKILL.md or "latest")
Without declared permissions the skill's intent is opaque and cannot be validated.
The description says to use the skill whenever a user's task involves cloud document operations, followed by a very broad "including but not limited to" list spanning writing, translation, summarization, PDF work, filing, and note organization. This makes the activation boundary unclear and risks invoking the skill for many generic productivity requests that may not require Kdocs.
The manifest keyword list contains broad phrases such as "帮我总结", "帮我整理", "帮我写", and "帮我翻译". These overlap heavily with common user requests outside the Kdocs domain, and the file does not provide exclusion conditions or negative examples to narrow when the skill should activate.
This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. The document states that aippt.execute can generate PPTs from user themes or existing documents, and later notes AI联网研究, but it does not warn that user-provided text or linked document contents may be processed remotely, which has privacy implications.
The markdown explicitly supports doc_ppt using an existing document link/link_id, which means user document content is consumed by the generation pipeline. There is no adjacent warning about sensitive data, confidentiality, or ensuring the user is authorized to process/share that document through the service.
技能清单描述的是对金山文档进行创建、读取、编辑、搜索、分享和整理等操作，认证是实现这些能力的配套细节。这里的说明却要求用户复制 Token 并直接提供给 Agent，相当于让技能接触原始认证凭据，这超出了用户从描述中通常会预期的文档操作行为边界。
This markdown reference enumerates destructive actions such as deleting sheets and batch-deleting sheets, but does not warn users about the data-loss risk or advise confirmation before use. The file does include explicit confirmation guidance for some irreversible dashboard actions later, which makes the omission for other delete operations more noticeable.
The documentation describes opening shared views, modifying share permissions, and creating webhooks, all of which can expose document data or send updates externally. However, this reference does not include a user-facing warning about privacy implications, external access, or the need to confirm intended exposure before enabling these features.
This markdown file presents all operational instructions, warnings, and examples only in Chinese, which effectively forces a specific language/locale on users. The policy allows locale constraints only when explicitly documented and justified, or when users are given a language choice, neither of which appears here.
This markdown file presents all operational instructions, warnings, and examples exclusively in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue unless the regional constraint is explicitly justified, which is not stated here.
The 功能说明 says "修改数据表名称" and the example only shows renaming, which communicates a narrow intent. However, the documented parameters also include primary_field and prefer_id, indicating the operation can change more than just the sheet name, creating an active mismatch between the tool's stated purpose and what it can do.
This markdown file presents all operational instructions, warnings, and examples only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.
Detected: suspicious.dangerous_exec