Word Document Organizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.0

Overview

The skill is a real Word document formatter, but it needs Review because its execution instructions can run unsafe generated Python and silently install an unpinned dependency.

Install only if you trust the environment and are prepared to review or rewrite the execution snippets first. Prefer a version that pins dependencies, passes parameters through argv or JSON instead of generated source code, restricts inputs to .docx, and writes to a new output file unless overwrite is explicitly requested.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:84

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 84
Vulnerability Type: Supply-chain exposure through automatic installation of an unpinned package
Risk Level: Medium

Vulnerable Code:

bash

python3 -c "import docx" 2>/dev/null || pip3 install python-docx -q

Technical Analysis

If the docx module is unavailable, the Skill automatically installs python-docx from the package index configured for pip3. No exact version, package hash, trusted index URL, or lock file is specified.

Consequently, the code installed during a Skill invocation can differ from the code reviewed during the audit. A compromised package-index account, malicious package mirror, unsafe local pip configuration, or compromised future release could introduce attacker-controlled installation or runtime code.

This behavior also conflicts with the statement at SKILL.md:311 that the Skill requires no network access. The installation may initiate an external network connection without clearly requesting user approval.

Attack Path

1. The Skill runs in an environment where the docx import is unavailable.
2. The import check fails and automatically invokes pip3 install python-docx -q.
3. Pip resolves the package through its configured index or mirror without enforcing a reviewed version or integrity hash.
4. A compromised package release, index, mirror, or pip configuration supplies malicious package content.
5. Malicious installation code executes during installation, or malicious module code executes when the document-processing script imports docx.

Impact Assessment

Malicious dependency code could execute with the same operating-system identity and privileges as the Agent. It could read or modify files accessible to that identity, including the Word document being processed, access available credentials or environment variables, initiate network connections, and execute additional local commands.

The Sk ...[truncated 221 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic package installation from the Skill's execution path.
• Declare dependencies in a reviewed lock file and pin python-docx to an exact approved version.
• Verify downloaded artifacts with cryptographic hashes, such as pip's --require-hashes mode.
• Use an explicitly configured trusted package repository rather than inheriting an arbitrary user or system pip configuration.
• Install dependencies in a dedicated virtual environment with minimal permissions.
• Require explicit user approval before any operation that needs network access or changes the Python environment.
• Correct the security documentation to disclose dependency-related network access when installation remains necessary.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:102

Finding

Python Code Injection Through Direct Parameter Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 102–105
Vulnerability Type: Code injection caused by embedding untrusted parameters in generated Python source
Risk Level: High

Vulnerable Code:

python

doc_path = "${document_path}"
output_path = "${output_path}" if "${output_path}" else doc_path
template = "${style_template}"
operations = [op.strip() for op in "${operations}".split(",")] if "${operations}" else ["all"]

Technical Analysis

The Skill inserts document_path, output_path, style_template, and operations directly into double-quoted Python string literals. There is no demonstrated Python-string escaping, structured argument transfer, or validation before interpolation.

A parameter containing a quotation mark and suitable Python syntax can terminate the intended string literal and append attacker-controlled statements. Newline characters can further simplify injection when the surrounding execution mechanism permits them. Merely validating a file extension in the preceding shell workflow does not make textual source-code generation safe, because an attacker can construct injected input that also includes an expected extension where required.

This is distinct from ordinary path manipulation: exploitation occurs while the generated Python program is parsed, before Document(doc_path) needs to successfully process the supplied path.

Attack Path

1. An attacker supplies a crafted value for one of the interpolated parameters, such as output_path, style_template, or operations.
2. The value contains syntax that closes the surrounding Python string literal.
3. The value appends a Python statement that imports a system-execution API or performs another unauthorized action.
4. The generated document-processing script is launched by the Agent.
5. Python parses and executes the injected statement with the Agent process's operating-system privileges.
6. The attacker ca ...[truncated 643 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct Python source code by substituting user-controlled text.
• Store the processing logic in a static, reviewed Python file and pass values through sys.argv using an argument array.
• Alternatively, use a structured input channel such as a JSON file opened by the script; parse it with a standard JSON parser rather than evaluating it.
• If environment variables are used, retrieve them with os.environ inside static code and never interpolate them into source.
• Restrict style_template to the documented template names and operations to the documented operation names using explicit allowlists.
• Reject control characters, including null bytes and unexpected newlines, in path parameters.
• Canonicalize paths and, where appropriate, restrict input and output to user-authorized directories.
• Use subprocess APIs with argument arrays and shell=False for all process execution.
• Add tests containing quotes, backslashes, newlines, shell metacharacters, and Python syntax to verify that every value remains data rather than executable code.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

L004 的描述全文使用中文，且文档整体未说明是否支持其他语言或允许用户选择输出/交互语言。根据语言/地区策略，若技能隐含固定语言而无用户选择或明确合理限定，属于自然语言层面的策略风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L017-L023 列出的多个触发短语如“格式化文档”“排版优化”“修复word格式”“规范文档格式”等表述较泛，缺少足够上下文约束，容易与普通办公求助或一般文档编辑请求重叠。文档也未提供排除条件或负面示例来界定何时不应激活该技能。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The shell validation in L068-L070 explicitly allows both .docx and .doc, and the manifest parameter description also says support for .docx, while the core processor at L113 uses Document(doc_path) from python-docx. That library does not natively open legacy .doc files, so the skill's claimed file-format behavior does not match what the code can actually do.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill claims atomic behavior, but the code saves directly to output_path and may overwrite the original document when output_path is omitted. If saving fails mid-operation, the user may end up with a partially written or corrupted destination file, which is especially risky because this skill is designed to modify valuable local documents.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:102