Security audit

Wps Skill

Security checks for vulnerabilities and agentic risk

Overview

This WPS Office skill mostly matches its stated purpose, but it needs review because it can modify local documents, drive the GUI, use optional WPS cloud credentials, and has unsafe conversion paths for untrusted files.

Install only if you are comfortable with an agent launching WPS, typing into the active desktop, and modifying office files. Keep WPS 365 credentials out of shared/project files when possible, leave cloud credentials blank unless needed, avoid using it on untrusted Markdown or Office files, and make backups or specify separate output paths before batch conversion or image/layout edits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/excel_converter.py:145
Finding: Spreadsheet Formula Injection in Markdown-to-Excel Conversion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:252
Finding: Active HTML Injection in Legacy Markdown Conversion
Content: View full analysis
str: """Simple Markdown-to-HTML conversion.""" import re html = '\n\n\n' html += '\n' html += 'Converted from Markdown\n' html += '\n\n' lines = md_content.split('\n') in_list = False for line in lines: if line.startswith('# '): if in_list: html += '\n' in_list = False html += f'
{line[2:]}
\n' elif line.startswith('## '): if in_list: html += '\n' in_list = False html += f'
{line[3:]}
\n' elif line.startswith('### '): if in_list: html += '\n' in_list = False html += f'
{line[4:]}
\n' elif line.startswith('- ') or line.startswith('* '): if not in_list: html += '
\n' in_list = True content = line[2:] content = re.sub( r'\*\*(.*?)\*\*', r'\1', content ) html += f'
{content}
\n' elif line.strip(): if in_list: html += '
\n' in_list = False content = line content = re.sub( r'\*\*(.*?)\*\*', r'\1', content ) html += f'
{content}
\n' if in_list: html += '\n' html += '\n' return html ``` ### Technical Analysis The converter inserts Markdown-derived text directly into HTML elements without HTML escaping or sanitization. Chara ...[truncated 1816 chars]
Remediation: View remediation
{safe_heading}\n' ``` 2. Perform Markdown formatting only after separating formatting tokens from text, and escape the text portions. 3. If raw HTML support is intentional, sanitize the rendered result using a strict allowlist that excludes scripts, event-handler attributes, iframes, forms, and unsafe URL schemes. 4. Add a restrictive Content Security Policy to generated HTML where practical. 5. Clearly report that the output is HTML rather than claiming that a Word document was created. 6. Do not automatically open generated active content from untrusted input. 7. Add tests for closing tags, script tags, event handlers, remote images, SVG payloads, and `javascript:` links. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:169
Finding: RTF Control-Word Injection Followed by Automatic Document Opening
Content: View full analysis
str: """Simple Markdown-to-RTF conversion.""" import re rtf = r'{\rtf1\ansi\ansicpg936\deff0\nouicompat\deflang1033\deflangfe2052' rtf += r'{\fonttbl{\f0\fnil\fcharset134 Default;}{\f1\fnil\fcharset0 Calibri;}}' rtf += r'{\colortbl ;\red0\green0\blue0;}' rtf += r'\viewkind4\uc1 \pard\sa200\sl276\slmult1\f0\fs22\lang2052 ' lines = md_content.split('\n') for line in lines: if line.startswith('# '): rtf += r'\b\fs32 ' + line[2:] + r'\b0\fs22\par ' elif line.startswith('## '): rtf += r'\b\fs28 ' + line[3:] + r'\b0\fs22\par ' elif line.startswith('### '): rtf += r'\b\fs24 ' + line[4:] + r'\b0\fs22\par ' elif line.startswith('- ') or line.startswith('* '): rtf += r'\bullet ' + line[2:] + r'\par ' elif '**' in line: parts = re.split(r'\*\*(.*?)\*\*', line) for i, part in enumerate(parts): if i % 2 == 1: rtf += r'\b ' + part + r'\b0 ' else: rtf += part + ' ' ...[truncated 2024 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:50
Finding: Path Traversal Outside the Configured Document Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: config.json:1
Finding: WPS Application Secret Stored in a Plaintext Project Configuration File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (50)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill metadata describes document automation and layout features, but the documented behavior also includes cloud API authentication with app_id/app_secret, token handling, and broad access to online forms, docs, sheets, flows, and mind maps. This is dangerous because users may supply credentials or enable the skill without realizing it can reach remote services and access or modify cloud-hosted organizational data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill metadata describes document automation and layout features, but the documented behavior also includes cloud API authentication with app_id/app_secret, token handling, and broad access to online forms, docs, sheets, flows, and mind maps. This is dangerous because users may supply credentials or enable the skill without realizing it can reach remote services and access or modify cloud-hosted organizational data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill metadata describes document automation and layout features, but the documented behavior also includes cloud API authentication with app_id/app_secret, token handling, and broad access to online forms, docs, sheets, flows, and mind maps. This is dangerous because users may supply credentials or enable the skill without realizing it can reach remote services and access or modify cloud-hosted organizational data.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list is very broad and includes common terms such as 'word', 'excel', '文档', '表格', and generic document-editing phrases. This can cause the skill to activate for many ordinary user requests, increasing the chance that an exec-capable automation skill is invoked unexpectedly and performs file-modifying or GUI-driving actions outside the user's specific intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown file documents a batch conversion feature that operates over an entire directory, which can affect large numbers of user documents. The README provides usage examples but does not include any warning about reviewing the target directory, output behavior, or possible file overwrites/data-impact before running it.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises substantial capabilities including local file operations, shell/subprocess execution, GUI automation, and networked API access, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent or user will invoke the skill with broader privileges than expected, enabling unintended file modification, command execution, or remote data access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language instructions, warnings, features, installation, and usage guidance are predominantly presented in Chinese, which effectively forces a specific language on users. The file does not indicate that Chinese is optional or provide an alternate language path, so it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description mentions document creation, Markdown conversion, and image-text layout for WPS Office automation, but this module also provides a reverse conversion capability from Excel files back into Markdown. That is a distinct behavior not reflected in this file’s own module description and broadens the practical scope beyond a one-way Markdown-to-office conversion helper.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The helper overwrites the input workbook by default when no output path is supplied, which can silently destroy or alter user data. In an automation skill context, this is risky because upstream callers may invoke the function on sensitive documents expecting a non-destructive transformation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This helper also saves back to the original Excel file by default, causing implicit in-place modification of user documents. In document automation workflows, accidental overwrites can lead to integrity loss, unexpected content changes, and irreversible corruption of important files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: insert_image_to_doc defaults output_path to docx_path, causing the function to overwrite the input document in place when no destination is provided. In an automation skill, this can silently destroy or alter original user documents, creating integrity and recovery risks if invoked on important files or through chained workflows.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/main.py (reported line 84)May include surrounding context.
python
else: cmd = [app, filepath] subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) # 如果有内容，等待 WPS 打开后输入 if content:

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/main.py (reported line 121)May include surrounding context.
python
else: cmd = [app, filepath] subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) # 如果有内容，等待 WPS 打开后输入 if content:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automated keystroke injection via pyautogui sends attacker- or user-controlled text to whatever window currently has focus, not necessarily the intended WPS document. In an agent environment this can cause unintended commands, data leakage, or modification of other applications, making the feature materially riskier than ordinary document creation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The _md_to_docx docstring says it converts Markdown to a Word document, yet in the non-Darwin branch it creates an .html file and returns that as output. This is an active contradiction between the documented intent and the implemented behavior, not merely an omitted detail.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/main.py (reported line 182)May include surrounding context.
python
f.write(rtf_content) # 用 WPS 打开 RTF 文件 subprocess.Popen(['open', '-a', 'WPS Office', rtf_file], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) return {

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file implements substantial WPS 365 cloud and sharing functionality that is not disclosed by the skill metadata, which only advertises local document automation and conversion. Hidden or under-disclosed capabilities increase the chance that an agent or user will transmit data remotely or create online shares without understanding the broader security boundary.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code performs outbound requests to WPS Open Platform using configured credentials, expanding the trust boundary from local automation to remote data transmission. In the context of a skill advertised mainly for local document creation and conversion, that mismatch can cause sensitive filenames, document metadata, or submitted content to be sent to a third party without sufficiently clear disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The access-token request transmits configured credentials to a remote service without any user-facing disclosure at the action level. In a skill framed as local office automation, silent credentialed network access increases the risk of users misunderstanding when secrets and associated account context are being used externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This generic API wrapper can transmit arbitrary parameters and JSON payloads to a remote WPS endpoint with no user-visible warning or consent checkpoint. Because it is a reusable primitive for multiple remote actions, it broadens the chance of sensitive document or form data being sent off-host unexpectedly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill can create shareable online document links, which is a data-sharing capability materially different from local editing or conversion. In an agent context, generating public or semi-public share links without prominent disclosure can lead to unintentional exposure of document content or collaboration endpoints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code hardcodes 宋体 as the default font and the file-level descriptions and comments are entirely Chinese, indicating a built-in locale preference without any opt-in or documented justification. Under the language/locale policy, forcing a specific locale behavior without user choice can be problematic for users expecting other language or font defaults.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The converter saves directly to a caller-controlled output path and can overwrite existing files without any confirmation, safety check, or atomic-write strategy. In an automation skill context, this can cause unintended destruction of user documents or replacement of important files if a path is mis-specified or influenced by untrusted input.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes document creation, Markdown conversion, and image-text layout for WPS Office automation, which aligns with generating Word documents from Markdown. However, this file also provides a full Word-to-Markdown converter, adding reverse conversion behavior that is not reflected in the manifest description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The Markdown export path is written to directly with no warning or overwrite protection, creating the same unsafe file-clobbering condition as the Word export path. If output_path is user-supplied or derived from external input, an automation flow could silently replace existing files and cause data loss.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

{line[2:]}

{line[3:]}

{line[4:]}

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Vague Triggers

Missing User Warnings

Undeclared Tool Scope

Natural-Language Policy Violations

Description-Behavior Mismatch

Missing User Warnings

Missing User Warnings

Missing User Warnings

subprocess module call

subprocess module call

Missing User Warnings

Intent-Code Divergence

subprocess module call

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Natural-Language Policy Violations

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

Static analysis