中文word文档通用格式标准化

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:44 PM UTC
• Version: 1.0.0

Overview

This skill appears to be a straightforward Chinese Word-document formatter, with disclosed file-writing behavior and no evidence of hidden access, persistence, credential use, or exfiltration.

Install and run this only for Chinese-format Word documents where applying Microsoft YaHei and Chinese punctuation conventions is desired. Use a copy of important documents, check the actual output filename after running, and consider pinning python-docx to a reviewed version before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependency Permits Unreviewed Package Updates

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1
Related Locations: SKILL.md:60-64, references/usage_guide.md:5-10
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Vulnerable Code Snippet:

text

python-docx

The dependency is installed through the following documented command:

bash

pip install -r scripts/requirements.txt

Technical Analysis

The python-docx dependency is specified without an exact version or cryptographic integrity hash. Consequently, each installation may resolve to whichever compatible release is available from the configured package index at that time rather than to a version that was reviewed during this audit.

This creates a supply-chain exposure if the upstream package, one of its transitive dependencies, the configured package index, or the dependency-resolution environment is compromised. It also prevents reproducible installation and allows future package changes to enter the execution environment without a corresponding change to this project.

The audit found no evidence that python-docx itself is malicious and no evidence of dependency confusion or typosquatting in the current package name. The risk arises from unrestricted future dependency resolution rather than from a confirmed malicious package payload.

Attack Path

1. An attacker compromises a future package release, a transitive dependency, or the package index used by the victim.
2. A user follows the documented instruction and runs pip install -r scripts/requirements.txt.
3. Because no version or hash is enforced, pip resolves and installs the compromised package content.
4. Malicious package installation logic or imported runtime code executes under the user's account.
5. The payload can access resources available to that account, subject to operating-system and environment restrictions.

Impact Assessment

Successfu ...[truncated 458 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin python-docx to a reviewed exact version:

   text

   python-docx==REVIEWED_VERSION
   

2. Generate and verify cryptographic hashes for the pinned package and all transitive dependencies, then install with:

   bash

   pip install --require-hashes -r scripts/requirements.txt
   

3. Use a lock-generation tool such as pip-tools to produce a reproducible dependency set that includes transitive dependencies.
4. Retrieve packages only from a trusted, explicitly configured package index or an internally controlled artifact repository.
5. Add automated dependency vulnerability and provenance scanning to the release process.
6. Review and update pinned dependencies through a controlled process rather than permitting automatic resolution to arbitrary future releases.
7. Perform dependency installation and document processing in a least-privileged isolated environment.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

文件中的自然语言描述明确要求“使用微软雅黑字体”并按“中文排版规范”统一处理，但未说明该技能仅适用于中文文档场景，或为用户提供非中文/其他本地化格式的选择。根据规则，强制特定语言/locale 而无用户选择或清晰限定，属于自然语言策略违规。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation instructs users to run a script that modifies and saves Word document content, but it does not clearly warn that output files will be created or that document contents will be transformed. This can lead to unintended data alteration, accidental overwrite/confusion around derivative files, and unsafe use on important originals, especially in automation contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The title explicitly defines the standard as a Chinese Word formatting standard, which signals a fixed language/locale requirement. Under the policy criteria, forcing a specific language or locale without user opt-in or documented regional justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These lines instruct users to use Chinese punctuation and full-width punctuation universally. This is a language/locale-specific requirement, and the file does not state that it is optional, user-selected, or limited to Chinese-language documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document instructs users to apply a Chinese formatting standard and explicitly requires use of the 微软雅黑 font, presenting this as the default behavior throughout the guide. This is a natural-language locale policy concern because it enforces a specific language/locale convention without stating that the user can opt in, choose another locale, or that the skill is restricted to a justified Chinese-only context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description states that the tool standardizes Word documents according to Chinese formatting standards, which imposes a specific locale/language policy. The file does not provide an opt-in, alternative locale handling, or a justification that this skill is intentionally region-specific beyond the text itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code overwrites the document's default font and East Asian font settings to 微软雅黑, and similar forced font changes recur for headings and paragraph runs. This is a language/locale-specific policy decision embedded in code, with no option for the user to choose a different locale or preserve original formatting.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is unpinned, so installs are not reproducible and may unexpectedly pull in vulnerable or incompatible releases over time. In a document-processing skill, this is relevant because the package parses Office document content and changes in resolved versions can introduce supply-chain or security risk without review.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

python-docx

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest does not pin python-docx, and the package has known historical XXE advisories affecting older versions. Because this skill processes Word documents, an affected installation could expose the environment to XML external entity processing risks when handling malicious documents, potentially leading to file disclosure or network interaction depending on parser behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.