T03 · Remote Payload Retrieval and Execution
Error
- Location
docx_engine.py:221- Finding
Automatic Execution of an Unverified Remote .NET Installer
- Content
View full analysis
- Remediation
View remediation
Security audit
Minimax Docx
Security checks for vulnerabilities and agentic risk
Overview
This DOCX-generation skill is useful but can automatically run remote .NET installer scripts and delete a user-level .NET directory without confirmation.
Install only if you are comfortable with the skill running local build commands and, when .NET is missing or broken, downloading and executing Microsoft-hosted installer scripts into your user profile. Prefer preinstalling .NET yourself and reviewing or disabling the automatic provisioning and ~/.dotnet cleanup paths before using it on important workstations, CI runners, or untrusted DOCX templates.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
check/pipeline.py:60- Finding
Unbounded Archive Extraction in the DOCX Validation Pipeline
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
docx_engine.py:1382- Finding
Unbounded Archive Extraction During Mapping Application
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (51)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generating PNG assets via HTML/CSS browser rendering is not inherently malicious, but when undisclosed in a skill expected to perform deterministic DOCX work, it changes the trust and attack model substantially. Hidden rendering subsystems can process untrusted markup/templates and bring in complex dependencies that increase exploitation and supply-chain risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill executes remote installer scripts and other external system commands not narrowly required for transforming document content. In this context, that behavior is especially dangerous because a content-generation skill should not need to run internet-fetched code, making the attack surface disproportionate to its stated purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
When the runtime is deemed corrupted, the code deletes the user's entire ~/.dotnet directory automatically. This is destructive behavior that can remove unrelated SDKs or user-installed components, causing data loss and denial of service beyond the scope of the skill.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This path performs a destructive operation by removing ~/.dotnet without prior warning or approval. That can break other applications and SDK setups on the machine and is excessive for a document-generation skill.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python print(" + Compiled") print(">> Generating...") run_env = os.environ.copy() run_env.setdefault("DOTNET_ROLL_FORWARD", "LatestMajor") proc = subprocess.run( [
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and invokes shell execution, file read/write, and environment inspection, but declares no explicit tool scope such as permissions or allowed-tools. In an agent setting, that creates an avoidable expansion of operational authority and makes it harder to constrain or review what the skill may execute.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes the skill as focused on creating validated .docx files with formatting and compatibility, but this module is explicitly a document validation framework for OOXML compliance checking and exposes multiple detectors plus a validation pipeline. Validation may relate to generation quality, but the code here implements a broader standalone checking capability that is not reflected in the manifest description.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python return ("absent", None, None) try: proc = subprocess.run( [str(binary), "--version"], capture_output=True, text=True, timeout=10 )
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill's declared purpose is document generation, but it silently includes runtime bootstrapping that downloads and installs .NET components. That mismatch increases risk because users may not expect system modification or network-retrieved executables from a document-generation tool.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
This code downloads a remote PowerShell installer script and executes its returned content directly in memory. That creates a remote code execution and supply-chain risk: if the network path, upstream host, or downloaded content is compromised, arbitrary code runs on the user's machine with the user's privileges.
- Content
python $execution = [scriptblock]::Create($installer.Content) & $execution -Channel {channel} -InstallDir '{target_dir}' """ subprocess.run( ["powershell", "-Command", powershell_script], capture_output=True, text=True, timeout=300 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 92% confidence
- Finding
This fetches an installer script from the internet into a temp location as part of normal skill execution. While downloading alone is not code execution, in this workflow it feeds directly into later execution and expands the attack surface to network tampering, mirror compromise, or unintended system modification.
- Content
python target_dir = Path.home() / ".dotnet" installer_path = Path(tempfile.gettempdir()) / "dotnet-bootstrap.sh" subprocess.run( ["curl", "-sSL", installer_url, "-o", str(installer_path)], check=True, timeout=60 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 97% confidence
- Finding
This executes the just-downloaded installer script from a temporary directory. Running network-fetched code without independent integrity verification is a direct code-execution risk and can lead to full compromise of the user environment.
- Content
python check=True, timeout=60 ) installer_path.chmod(0o755) subprocess.run( [str(installer_path), "--channel", channel, "--install-dir", str(target_dir)], check=True, timeout=300 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python binary = target_dir / "dotnet" if binary.exists(): verify = subprocess.run([str(binary), "--version"], capture_output=True, text=True) if verify.returncode == 0: print(f" + Provisioned: {verify.stdout.strip()}") return binary
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill modifies the user's system by installing .NET automatically without an explicit confirmation gate. Even if intended as convenience, silent dependency installation violates least surprise and can be abused to introduce unwanted software or persistent environment changes.
- Content
Static analysis
No suspicious patterns detected.