WPS macOS Helper

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:09 PM UTC
• Version: 0.1.0

Overview

This skill is a focused WPS/macOS document-workflow helper, with one disclosed but unpinned document-conversion dependency users should treat cautiously.

Before installing, understand that conversion of docx, PDF, PowerPoint, or Excel files may run markitdown through uvx if uvx is available. Prefer pinning or preinstalling a trusted converter, run conversions on copies of documents, and avoid processing highly sensitive files unless the execution environment is appropriately sandboxed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/prepare_doc_workflow.sh:26

Finding

Unpinned Third-Party Package Is Retrieved and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: scripts/prepare_doc_workflow.sh, lines 26-28
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: Medium

Vulnerable Code

bash

if command -v uvx >/dev/null 2>&1; then
  echo "Running: uvx --from 'markitdown[all]' markitdown '$INPUT' -o '$OUTPUT'"
  uvx --from 'markitdown[all]' markitdown "$INPUT" -o "$OUTPUT"

Technical Analysis

The script invokes uvx with the unversioned package specification markitdown[all]. No exact package version, dependency lockfile, package hashes, or other integrity verification is provided.

When the required package is not already available locally, uvx may resolve and retrieve the current package and its transitive dependencies from its configured package source before executing the markitdown entry point. Consequently, the effective code executed by the Skill can change after the Skill itself has been audited.

This creates a supply-chain exposure: a compromised package release, compromised transitive dependency, unsafe package source, or package-resolution attack could cause arbitrary dependency code to run under the invoking user's account. It also makes conversions non-reproducible.

Attack Path

1. An attacker compromises a future markitdown release, one of its transitive dependencies, or a package source used by uvx.
2. A user asks the Agent to process a supported docx, pdf, pptx, xlsx, or xls file and supplies an output path.
3. The Agent invokes scripts/prepare_doc_workflow.sh.
4. The script detects that uvx is installed and executes the unpinned uvx --from 'markitdown[all]' command.
5. uvx resolves and, where necessary, retrieves the currently available dependency set.
6. Malicious package installation, import, or entry-point code executes with the privileges of the user running the Skill.

Exploitation depends on compromise or manipulation of the dependency supply chain; no evidence of a currently malici ...[truncated 571 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin markitdown to an audited exact version rather than resolving the latest available release at runtime.
2. Lock all transitive dependencies and verify package hashes through a reviewed lockfile.
3. Configure uvx to use a trusted, controlled package index where feasible.
4. Prefer a preinstalled and reviewed converter so ordinary document processing does not retrieve executable dependencies dynamically.
5. Separate dependency installation from document processing and require explicit user approval before any network-backed package retrieval.
6. Run conversion in a sandbox with minimal filesystem access, restricted network access, and no unnecessary credentials.
7. Document the dependency and network behavior clearly, including the fact that uvx may download packages.
8. Update the release checklist to test pinned dependency resolution and integrity verification.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

- Use `scripts/prepare_doc_workflow.sh` for low-risk preprocessing suggestions and Markdown conversion entry points.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.