docx-footnote-reader

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local DOCX footnote reader, with a normal but improvable npm dependency setup.

Install and run this under a normal unprivileged account, and be aware that `npm install` may resolve newer dependency versions over time. For stronger reproducibility, pin `word-extractor` and use a committed lockfile before relying on it for sensitive documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package.json:5
• Finding: Unpinned Third-Party Dependency Without a Lockfile## Vulnerability Details **File Location**: `package.json:5-8` **Vulnerability Type**: Supply-chain exposure through mutable dependency resolution **Risk Level**: Medium ### Vulnerable Code ```json "main": "index.js", "dependencies": { "word-extractor": "^1.0.0" }, ``` The project does not include a package lockfile. In addition, `SKILL.md:68-76` instructs users to run a general `npm install` command: ```markdown ## Installation ```bash cd docx-footnote-reader npm install ``` ``` ### Technical Analysis The caret version constraint `^1.0.0` allows npm to install compatible releases newer than the version originally reviewed. Because no `package-lock.json` is present, direct and transitive package versions are resolved dynamically during installation rather than being restricted to an audited dependency graph. This does not demonstrate that the current `word-extractor` package is malicious. However, it creates a supply-chain weakness: a future compromised, malicious, or unexpectedly changed release satisfying the declared range could be installed without any change to this repository. npm dependencies may execute lifecycle scripts during installation and subsequently run with the privileges of the user invoking this skill. The dependency also receives the path of, and parses, potentially sensitive Word documents at `index.js:9-10`. ### Attack Path 1. An attacker compromises the publishing account or release pipeline for `word-extractor` or one of its transitive dependencies. 2. The attacker publishes a modified release that remains compatible with the `^1.0.0` range. 3. A user follows the documented installation procedure and runs `npm install`. 4. With no lockfile to preserve reviewed versions and integrity hashes, npm resolves the attacker-controlled release. 5. Malicious code can execute through an npm lifecycle script during installation or when `require('word-extractor')` loads the dependency. ...[truncated 836 chars]
• Remediation: ## Remediation Suggestions 1. Pin `word-extractor` to a specifically reviewed version rather than a mutable caret range. 2. Generate and commit a `package-lock.json` containing the complete resolved dependency graph and integrity hashes. 3. Update installation documentation to require `npm ci` instead of `npm install` for reproducible installations. 4. Review direct and transitive dependencies, including their npm lifecycle scripts, before approving the lockfile. 5. Use automated dependency monitoring and review lockfile changes before merging dependency updates. 6. Run installation and document processing under a dedicated, unprivileged account or sandbox with only the required file access. 7. Where operationally feasible, disable lifecycle scripts during installation with `npm ci --ignore-scripts`, after confirming that the dependency does not legitimately require them.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"description": "Read footnotes from docx in Ubuntu with JavaScript",
  "main": "index.js",
  "dependencies": {
    "word-extractor": "^1.0.0"
  },
  "scripts": {
    "start": "node index.js"

• Confidence: 95% confidence
• Finding: The dependency is specified with a caret range (^1.0.0), which allows newer minor and patch releases to be installed automatically. This creates supply-chain risk because a future compromised or breaking upstream release could be pulled in without explicit review, and this skill processes document files where parser libraries are part of the attack surface.

Static analysis

No suspicious patterns detected.