Security audit

ipo-doc-formatting

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Word-formatting skill, but it should be reviewed because broad automatic triggers and in-place/template edits could change important documents more broadly than users expect.

Install only if you want this skill to handle Word formatting tasks and are comfortable reviewing the target document and style family before it runs. Prefer saving outputs to a new file, make backups before local edits, and copy templates before customizing them because template changes affect future formatted documents.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill instructs the agent to read local files and invoke shell/Python commands, but it declares no corresponding permissions or trust boundaries. That creates a capability/visibility gap: operators and users cannot accurately assess what the skill may access or execute, increasing the chance of unintended file access or command execution in a sensitive document-processing workflow.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The skill promises template loading, tool routing, and document style application, but the analyzed content only specifies procedures and checks rather than an implemented, bounded execution path. This mismatch is dangerous because users may trust the skill to safely transform documents while it may fall back to ad hoc shell/script behavior or fail open, leading to unpredictable handling of sensitive IPO documents and possible integrity issues.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The generic trigger phrases include broad wording such as '排版规范' and '把这个 Word 改成 XXX 格式', which can overlap with ordinary document-editing requests. In an agent environment, this can cause unintended activation and application of IPO-specific formatting to unrelated files, leading to workflow errors or unintended document modification.

Vague Triggers

Low

Confidence: 82% confidence
Finding: The statement that the skill becomes 'automatically available' without clarifying activation boundaries may encourage assumptions that any formatting-related request is in scope. This increases the chance of over-triggering or misuse, especially when combined with already broad trigger phrases.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The trigger phrases include very broad wording such as generic Word formatting and document unification requests, which can cause the skill to activate outside the intended IPO-specific context. Over-broad activation is risky because it may route ordinary user documents into specialized formatting logic, file reads, and shell-assisted processing without clear user intent.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The instruction to trigger 'unconditionally' when broad formatting phrases are detected removes an important intent check and makes accidental activation more likely. In a skill that references local templates, scripts, and document tools, weak activation boundaries materially increase the chance of unintended processing of sensitive files.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The examples explicitly describe in-place saving and direct modification of the shared template file without warning users about overwrite risk, backup creation, or the fact that template edits will affect all future document outputs. In a document-formatting skill, this can lead to silent loss of original user data or unintended propagation of formatting changes across later documents, which is a real integrity and availability risk even if not a code-execution issue.

Static analysis

No suspicious patterns detected.