Security audit

word-to-pdf

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Word-to-PDF converter with limited robustness and documentation issues, but no hidden, persistent, or data-stealing behavior was found.

Install in a virtual environment and prefer pinned dependency versions. Use this for trusted or low-risk documents unless the markup-handling issue is fixed, and do not expect it to preserve complex Word layouts, images, tables, numbering, or all emoji rendering accurately.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: word-to-pdf.py:170
Finding: Untrusted DOCX Content Is Interpreted as ReportLab Markup
Content: View full analysis
Remediation: View remediation
`, `&`, quotes, malformed tags, nested tags, and hyperlink-like text. 3. Applying document-size, paragraph-count, and text-length limits when files can come from untrusted users. 4. Returning a controlled error without exposing a full traceback in user-facing or multi-user environments. ]]>

T08 · Insecure Dependencies

Note

Location: SKILL.md:27
Finding: Third-Party Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation
--hash=sha256: python-docx== --hash=sha256: ``` Install it in an isolated virtual environment with: ```bash python -m pip install --require-hashes -r requirements.txt ``` The maintainers should also: 1. Pin and review transitive dependencies through a lock-generation workflow. 2. Obtain hashes from trusted artifacts and review updates before changing the lock file. 3. Configure a trusted package index explicitly in controlled deployment environments. 4. Run dependency vulnerability and provenance checks in continuous integration. 5. Replace the unrestricted `--upgrade` guidance with an explicit, reviewed update procedure. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The overall primary purpose matches: this is indeed a Word-to-PDF converter implemented with reportlab and python-docx, exposed as a command-line utility. However, the declared description overstates what the implementation does. The code does not preserve Word formatting in a robust way; it ignores runs, inline styles, tables, images, page layout, rich formatting, and numbering semantics, and even duplicates the first paragraph by adding it as a title and then iterating all paragraphs again. It also only prefixes numbered lists with '1.' rather than preserving actual numbering. Additionally, while it tries to find a Chinese-capable font, it does not implement explicit emoji support or fallback fonts for emoji rendering. So the description is materially more capable than the code actually is, making this a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The natural-language instructions and operational guidance from the main heading onward are predominantly in Chinese, which can impose a language requirement on users without explicit opt-in. The policy allows locale constraints when clearly documented and justified, but this file does not state that the skill is intended only for Chinese-speaking users or offer an alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language description explicitly emphasizes Chinese-character support, which introduces a language-specific focus. Because the file does not present this as optional user choice or explain a region-specific requirement, it can be read as a locale-specific behavior without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.