Write Literature Review

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.2

Overview

This skill is a coherent literature-review assistant that processes user-provided documents and creates local Word output, with normal document-processing risks but no evidence of hidden data theft, persistence, or deception.

Install only if you intend to let the agent read the documents or folders you provide and create extracted text plus DOCX files locally. Avoid giving it broad directories, be careful with untrusted DOCX/PDF files, and review any optional sudo package install before running it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract_documents.py:77

Finding

Unbounded DOCX Decompression and XML Parsing Can Cause Denial of Service

Content

View full analysis

Vulnerability Details

File Location: scripts/extract_documents.py, lines 77–92
Vulnerability Type: Uncontrolled resource consumption during archive decompression and XML parsing
Risk Level: Medium

Vulnerable Code

python

with zipfile.ZipFile(path) as archive:
    names = set(archive.namelist())
    if "word/document.xml" not in names:
        raise ValueError("DOCX 缺少 word/document.xml")
    for part in parts:
        if part not in names:
            continue
        root = ET.fromstring(archive.read(part))
        for paragraph in root.iter(W_NS + "p"):
            chunks: list[str] = []
            for node in paragraph.iter():
                if node.tag == W_NS + "t" and node.text:
                    chunks.append(node.text)
                elif node.tag == W_NS + "tab":
                    chunks.append("\t")
                elif node.tag in {W_NS + "br", W_NS + "cr"}:
                    chunks.append("\n")

Technical Analysis

The document extractor treats user-provided DOCX files as ZIP archives and reads selected OOXML entries directly into memory with archive.read(part). It does not enforce limits on:

• Compressed archive size
• Uncompressed entry size
• Aggregate uncompressed size
• Compression ratio
• XML depth or node count
• Memory or CPU consumption

A malicious DOCX can contain a highly compressed or extremely large word/document.xml, word/footnotes.xml, or word/endnotes.xml. Calling archive.read(part) fully decompresses the selected entry into memory. ET.fromstring(...) then constructs an additional in-memory XML tree, further increasing resource use.

Although the parser does not appear vulnerable to external entity expansion, the missing resource limits permit archive-bomb or oversized-XML denial-of-service attacks.

Attack Path

1. An attacker creates a syntactically valid DOCX archive.
2. The archive includes word/document.xml or another processed OOXML entry with an extremely large unco ...[truncated 1229 chars]

Remediation

View remediation

Remediation Suggestions

1. Inspect every relevant ZipInfo object before decompression and reject entries exceeding a configured uncompressed-size limit.
2. Enforce a maximum aggregate uncompressed size across all processed OOXML entries.
3. Reject suspicious compression ratios by comparing ZipInfo.file_size with ZipInfo.compress_size.
4. Limit the number of archive entries and reject malformed or unexpectedly complex DOCX packages.
5. Replace full-buffer reads with bounded streaming or incremental XML parsing.
6. Enforce maximum XML depth, node count, text length, and parsing duration where practical.
7. Process untrusted documents in a sandbox with strict memory, CPU, file-size, and execution-time limits.
8. Add regression tests for oversized XML, high-compression-ratio entries, excessive node counts, and malformed archives.
9. Return a controlled validation error when any resource budget is exceeded rather than attempting to parse the document.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个文献处理与综述生成型技能，包含多种输入文档解析、文献内容整合、溯源写作以及期刊格式适配。实际代码只是一个独立的 DOCX 生成脚本：读取本地 UTF-8 Markdown 文件，转换为 WordprocessingML，打包成 .docx，并做基本完整性校验。它不读取或解析 PDF、.doc/.docx、知网格式，也不涉及任何文献抽取、总结、引用管理、综述生成或期刊模板规则。虽然“生成 Word”这一小部分与声明末尾有弱相关，但这只是最终输出形式，不足以覆盖其余核心承诺，因此属于明显的描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个更高层的文献综述写作工具：不仅要解析多种文档，还要基于文献生成可追溯综述、适配期刊风格并输出 Word。实际代码块只覆盖前半部分中的“解析文档”，且具体是将多种输入格式转换为纯文本，必要时对 PDF 做 OCR，并生成处理结果清单。代码中没有任何综述生成、引文追溯整理、期刊风格适配、Word 文档写出等逻辑。因此，描述与代码实际行为存在明显且实质性的能力不匹配。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

python3 scripts/extract_documents.py <文件或目录> --out-dir extracted

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes file reads, file writes, and shell commands but does not declare any explicit tool scope or permissions boundary. That creates an authorization ambiguity: an agent may execute powerful local operations that the user did not clearly consent to, increasing the chance of unintended filesystem access or command execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/document-ingestion.md (reported line 77)May include surrounding context.

Ubuntu/WSL 可根据需要安装：

bash

sudo apt install antiword

或：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/document-ingestion.md (reported line 83)May include surrounding context.

Ubuntu/WSL 可根据需要安装：

bash

sudo apt install antiword

或：

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's instructions and field labels are entirely in Chinese, which effectively forces a specific language for users of the skill. The policy allows language constraints only when users are given a choice or when the locale restriction is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese and does not indicate that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_documents.py (reported line 33)May include surrounding context.

python

def run(command: list[str], timeout: int = 300) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        command,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This is a code file, so SQP-3 applies. Multiple raised errors and warnings are hard-coded in Chinese (for example at L074 and throughout the file), which imposes a specific language on users without opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill explicitly instructs local creation of Markdown and DOCX files and, if attachment delivery fails, disclosure of the absolute saved path. This can leak environment details such as usernames, workspace layout, or host filesystem structure, and it performs persistence without clearly warning the user that local artifacts will remain on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file contains user-facing instructional content exclusively in Chinese, and there is no indication that users may choose another language or that the language restriction is intentional for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The generated DOCX run properties explicitly force East Asian fonts to 宋体, and later styles force 黑体, which imposes a specific locale/language presentation choice. This is a natural-language/locale policy concern because users are not given any opt-in or configuration for alternative language or font settings.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.