T09 · Insecure Skill Coding Practices
Warning
- Location
ooxml/scripts/validation/base.py:129- Finding
Unhardened Parsing of Attacker-Controlled OOXML
- Content
View full analysis
- Remediation
View remediation
Security audit
Docx
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent DOCX editing helper, but it needs Review because it includes privileged/global install guidance and unsafe handling of untrusted Office archives.
Install only if you are comfortable letting the agent read and modify local Office documents and run document conversion tools. Do not let it process untrusted DOCX/PPTX/XLSX files without sandboxing and resource limits, and treat the sudo/global dependency commands as administrator-reviewed setup steps rather than something the agent should run automatically.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
ooxml/scripts/unpack.py:14- Finding
Unbounded Extraction of Untrusted Office Archives
- Content
View full analysis
- Remediation
View remediation
max_files: raise ValueError("Archive contains too many members") total = 0 for info in infos: total += info.file_size if total > max_total: raise ValueError("Archive exceeds extraction size limit") target = (destination / info.filename).resolve() if destination != target and destination not in target.parents: raise ValueError(f"Unsafe archive path: {info.filename}") for info in infos: zf.extract(info, destination) ``` Production code should also impose per-file limits and compression-ratio limits and clean up partial extraction results after errors. ]]>
T08 · Insecure Dependencies
Note
- Location
SKILL.md:191- Finding
Unpinned and Globally Installed Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
" npm install --save-exact "docx@" ``` 2. Maintain a lockfile such as `package-lock.json` for npm. 3. Use a hashed Python requirements file and install with `--require-hashes`. 4. Install Python dependencies inside a virtual environment. 5. Install npm dependencies locally to the project rather than with `-g`. 6. Review package provenance, maintainers, release signatures, and published integrity metadata. 7. Disable package lifecycle scripts where they are unnecessary and operationally compatible. 8. Avoid recommending `sudo` as the default installation workflow; instead, instruct users to use an approved package-management process appropriate to their environment. 9. Document the exact dependency versions tested with this Skill. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broad document-processing capability centered on creating, modifying, analyzing, and annotating .docx files while preserving formatting. The supplied code does not implement those user-facing document operations. Instead, it is a low-level packaging tool: it copies an unpacked Office file directory, removes whitespace-only text nodes and XML comments from XML content, zips the directory into an Office container, and optionally validates the produced file using soffice. This is materially narrower and different from the declared purpose. While repacking OOXML is related to document internals, the code chunk does not provide the advertised editing, tracked changes, comment handling, or text extraction behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad end-user document authoring and editing capability centered on .docx workflows, including tracked changes, comments, formatting preservation, and text extraction. The supplied code instead performs a narrow developer-oriented utility function: it extracts Office Open XML package contents from an input file into a directory and pretty-prints XML and relationship files. While the RSID suggestion is loosely related to tracked changes, the code does not actually edit documents, apply tracked changes, add comments, preserve formatting during edits, or extract text. It also supports .pptx and .xlsx files, which is broader in file type but different in purpose from the declared document-focused capability. Therefore the description does not accurately represent the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad document authoring/editing/analysis capability for professional .docx files, including creation, modification, tracked changes, comments, formatting preservation, and text extraction. The supplied code instead is a narrow CLI validation utility: it takes an unpacked Office document directory plus an original file, verifies file paths and extensions, and runs schema validators and a redlining validator. This aligns only partially with the tracked-changes/analysis aspect, but materially differs from the stated primary purpose because it does not manipulate documents at all. Additionally, the code supports validating .pptx files, which is outside the description's .docx-centric document-workflow framing. Therefore the description does not accurately represent the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code does not create or edit documents or perform user-facing document operations. Instead, it provides low-level validation utilities for unpacked OOXML packages across Word/PowerPoint/Excel, including XML syntax checks, namespace validation, relationship/reference integrity, content type declarations, unique ID checks, and XSD validation. While some checked elements relate to comments and tracked-change-adjacent structures, the code only validates structural correctness; it does not add comments, apply tracked changes, preserve formatting during edits, or extract document text. This is a materially different primary purpose from the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad document authoring/editing skill for .docx files, including creating new documents, modifying content, adding comments, and handling tracked changes. The supplied code does not create or edit documents at all. Instead, it validates the internal XML structure of DOCX files and enforces schema and tracked-change consistency rules. While some checks relate to tracked changes and whitespace/format integrity, the primary purpose is validation, not comprehensive document creation/editing/analysis. This is a material description-behavior mismatch because the implemented capability is much narrower and different in kind from the declared functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about a broad Word document manipulation skill focused on .docx creation, editing, tracked changes, comments, and analysis. The supplied code is specifically a PPTXSchemaValidator for PresentationML/PowerPoint files. Its behavior is narrowly limited to validating unpacked PowerPoint XML and relationships against structural rules and schemas. This is a materially different primary purpose and file type from the declared description, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a broad document-processing skill for creating, editing, analyzing, and handling comments/formatting in .docx files. The supplied code only validates whether Claude's tracked changes in a Word document are properly represented by comparing text after stripping Claude-authored insertions/deletions. It does not create documents, perform general edits, add comments, preserve formatting as a user-facing function, or provide comprehensive document analysis. While it is related to one declared area—tracked changes—the actual code is much narrower and its primary purpose is validation, not document authoring or full-featured document manipulation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises substantial document-processing functionality, but the provided code chunk does not perform any of those tasks. It is only an empty package initialization file with a comment about relative imports in tests. This is a materially different actual behavior from the declared purpose, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The declared description presents a broad, user-facing Word document skill for creating and editing professional .docx documents, including tracked changes, comments, formatting preservation, and text extraction. The supplied code instead implements a utility class for direct manipulation of OOXML XML files. It can parse and edit XML nodes, search by line number, attributes, or text, and save the modified XML, which supports some editing use cases indirectly. However, it does not handle the .docx container as a whole, does not implement explicit tracked-changes/comment operations, does not provide document creation or analysis features, and does not include text extraction beyond recursive node text gathering for search. This is a material description-versus-behavior mismatch: the description overstates the scope and features compared with the actual code.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
Text Formatting
xml <!-- Bold --> <w:r><w:rPr><w:b/><w:bCs/></w:rPr><w:t>Bold</w:t></w:r> <!-- Italic --> <w:r><w:rPr><w:i/><w:iCs/></w:rPr><w:t>Italic</w:t></w:r>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md </pic:nvPicPr> <pic:blipFill> <a:blip r:embed="rId5"/> <!-- Add for stretch fill with aspect ratio preservation --> <a:stretch> <a:fillRect/> </a:stretch>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md </w:r> </w:hyperlink> <!-- Bookmark target --> <w:bookmarkStart w:id="0" w:name="myBookmark"/> <w:r><w:t>Target content</w:t></w:r> <w:bookmarkEnd w:id="0"/>
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill describes workflows that require file reads, file writes, and shell execution, but it declares no explicit tool scope or permissions boundary. In practice this can cause overbroad invocation and allow an agent to perform sensitive local operations without a clearly constrained contract, increasing the chance of misuse or accidental damage.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description uses broad invocation language such as 'any other document tasks,' which can cause the skill to trigger in situations beyond its safe or intended scope. Overbroad matching is dangerous because it may route unrelated requests into workflows that read, write, unpack, repack, and shell out on local files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill provides file-modifying workflows without warning about overwrite, corruption, or irreversible document changes. In document-editing contexts, especially with unpack/repack flows, omission of backup and integrity checks can easily destroy user data or produce subtly corrupted professional documents.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs use of package managers and shell-based conversion utilities, expanding activity from document manipulation into host-level software installation and command execution. In an agent setting, this broadens the attack surface and can lead to unauthorized environment changes, execution of risky binaries, or abuse through crafted files and commands.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Recommending 'sudo apt-get install pandoc' normalizes privileged execution inside a skill and can lead an agent or operator to perform root-level system modifications. If followed in a sensitive environment, this increases the blast radius from a document task to full host compromise or unwanted persistence through package installation.
- Content
md Required dependencies (install if not available): - **pandoc**: `sudo apt-get install pandoc` (for text extraction) - **docx**: `npm install -g docx` (for creating new documents) - **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion) - **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Recommending 'sudo apt-get install libreoffice' introduces privileged package installation for a non-core runtime step. This is especially risky because LibreOffice is a large external dependency and expanding a document skill into root-level package management materially increases host exposure.
- Content
md - **pandoc**: `sudo apt-get install pandoc` (for text extraction) - **docx**: `npm install -g docx` (for creating new documents) - **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion) - **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images) - **defusedxml**: `pip install defusedxml` (for secure XML parsing)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Recommending 'sudo apt-get install poppler-utils' again pushes the skill toward root-level host changes. In an agent environment, any sudo guidance is high risk because it can convert a limited document-processing task into privileged system administration.
- Content
md - **pandoc**: `sudo apt-get install pandoc` (for text extraction) - **docx**: `npm install -g docx` (for creating new documents) - **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion) - **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images) - **defusedxml**: `pip install defusedxml` (for secure XML parsing)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python with tempfile.TemporaryDirectory() as temp_dir: try: result = subprocess.run( [ "soffice", "--headless",
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes document creation, editing, tracked changes, comments, formatting preservation, and text extraction for
.docxwork. Invoking a system-installed office binary viasubprocess.runis a separate execution capability that is not declared in that purpose and goes beyond ordinary in-process document manipulation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code performs a potentially significant file-write operation by extracting the entire Office archive into the specified output directory. Although the script's docstring says it unpacks Office files, there is no user-facing prompt, logging, or warning at the point of execution describing that it will create and overwrite extracted contents on disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
After extraction, the script overwrites every discovered XML and .rels file with pretty-printed output, which is a bulk file modification operation. The code contains no print/log statement, prompt, or inline disclosure making this rewriting behavior explicit to the user.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python modified_file.write_text(modified_text, encoding="utf-8") # Try character-level diff first for precise differences result = subprocess.run( [ "git", "diff",
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes creating, editing, and analyzing .docx documents, but this validator shells out to the system
gitbinary for diff generation. Spawning external processes is not an obvious or necessary requirement for Word document validation and expands capability beyond normal in-process document handling.- Content
Static analysis
No suspicious patterns detected.