Minimax Docx

• Outcome: Review
• Latest audit: May 28, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a DOCX generator, but it needs Review because ordinary commands can automatically download and run .NET installer scripts and modify the user’s home-level .NET installation without a clear consent step.

Install only if you are comfortable with this skill managing .NET on your machine. Prefer installing .NET 9 yourself before use, avoid running doctor/render/audit/map-apply on systems where ~/.dotnet contains important existing runtimes, and review any generated filler or template edits before relying on the output.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

$execution = [scriptblock]::Create($installer.Content)
            & $execution -Channel {channel} -InstallDir '{target_dir}'
            """
            subprocess.run(
                ["powershell", "-Command", powershell_script],
                capture_output=True, text=True, timeout=300
            )

• Confidence: 98% confidence
• Finding: This code downloads remote content from https://dot.net and immediately executes it inside PowerShell as a scriptblock. That creates a remote code execution path dependent on network content integrity and trust in a third-party bootstrap script, which is especially dangerous in a document-generation skill whose stated purpose does not require arbitrary script execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

target_dir = Path.home() / ".dotnet"

            installer_path = Path(tempfile.gettempdir()) / "dotnet-bootstrap.sh"
            subprocess.run(
                ["curl", "-sSL", installer_url, "-o", str(installer_path)],
                check=True, timeout=60
            )

• Confidence: 97% confidence
• Finding: This fetches an external installer script over the network into a temporary location, enabling the application to stage executable code from the internet. Even though the execution happens in the next step, this network bootstrap behavior materially expands trust and attack surface beyond the skill's declared function.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

check=True, timeout=60
            )
            installer_path.chmod(0o755)
            subprocess.run(
                [str(installer_path), "--channel", channel, "--install-dir", str(target_dir)],
                check=True, timeout=300
            )

• Confidence: 97% confidence
• Finding: This executes the downloaded installer script from a temporary directory after making it executable, which is equivalent to running remotely sourced code on the host. If the script source, transport, temp file, or install flow is compromised, the host can be fully compromised.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and instructs use of capabilities equivalent to shell execution, file read/write, and environment inspection, but does not declare any permissions or capability boundaries. This is dangerous because consumers and policy engines may treat the skill as lower risk than it is, while it can invoke external tooling and manipulate local files during document generation and validation workflows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is narrow—enterprise DOCX generation—but the described behavior is much broader, including auditing existing files, modifying templates, invoking subprocesses, browser automation, and even provisioning the .NET SDK via network downloads. This mismatch is dangerous because it hides materially different trust requirements and attack surface; a user expecting offline document creation may unknowingly authorize command execution, downloads, file modification, and external tool invocation.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill advertises document generation but also includes automatic runtime acquisition and installation, which significantly exceeds the minimal capability needed for that function. Hidden or unexpected installation behavior is dangerous because it changes the host environment and introduces remote code execution and supply-chain risk during ordinary use.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code makes external requests to fetch installer scripts and then executes them, a capability far more sensitive than Word document generation. In this context, network retrieval of executable setup logic is unjustified and creates a high-risk supply-chain and host-compromise avenue.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: guarantee_dotnet() can trigger automatic installation or reinstallation of .NET with only status messages and no explicit consent checkpoint at the moment of execution. Silent or near-silent environment modification is risky because users invoking a document tool may not expect dependency downloads, filesystem changes, or remote script execution.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly instructs the agent to generate supplementary or filler content when user-provided material is insufficient. In a document-generation skill, this can cause unauthorized fabrication in professional, legal, academic, or enterprise documents, undermining integrity and potentially introducing false statements presented as user-authorized content.

Static analysis

No suspicious patterns detected.