docx

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:57 AM UTC
• Version: 0.1.0

Overview

This is a real document-processing skill, but it asks for privileged dependency installs and processes user documents with under-guarded archive and XML parsing paths.

Install only if you are comfortable with a document-editing skill that can modify files and run local converters. Do not let it run sudo or global package installs automatically; install dependencies separately in an isolated environment, avoid processing untrusted Office files outside a sandbox, and keep backups of documents before edits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: ooxml/scripts/validation/base.py:127

Finding

Untrusted OOXML Parsed with Unsafe Default lxml Settings

Content

View full analysis

Vulnerability Details

File Location: ooxml/scripts/validation/base.py:127, 149, 176, 391, 537, 762-768; equivalent default-parser calls also occur in ooxml/scripts/validation/docx.py:85, 129, 167, 189, 212 and ooxml/scripts/validation/pptx.py:86, 140, 153, 197, 240.

Vulnerability Type: Unsafe XML parsing
Risk Level: High

Vulnerable Code

python

for xml_file in self.xml_files:
    try:
        # Try to parse the XML file
        lxml.etree.parse(str(xml_file))
    except lxml.etree.XMLSyntaxError as e:
        errors.append(
            f"  {xml_file.relative_to(self.unpacked_dir)}: "
            f"Line {e.lineno}: {e.msg}"
        )

The XSD-validation path similarly creates a parser without security restrictions and then parses document-controlled XML with the default parser:

python

# Load schema
with open(schema_path, "rb") as xsd_file:
    parser = lxml.etree.XMLParser()
    xsd_doc = lxml.etree.parse(
        xsd_file,
        parser=parser,
        base_url=str(schema_path),
    )
    schema = lxml.etree.XMLSchema(xsd_doc)

# Load and preprocess XML
with open(xml_file) as f:
    xml_doc = lxml.etree.parse(f)

Technical Analysis

The validation code processes XML extracted from user-supplied DOCX and PPTX packages. It uses default lxml.etree parsing behavior without explicitly disabling DTD loading, external entity resolution, or network access.

This creates an XML External Entity and entity-expansion attack surface. Depending on the installed lxml/libxml2 version and parser behavior, crafted entity declarations may cause local resources to be read during parsing or may consume substantial CPU and memory. The project already uses defusedxml in other components, demonstrating that safer parsing is available but is not applied consistently.

The parser is invoked repeatedly across several validation passes, potentially multiplying the resource impact of one malicious XML part.

Attack Path

1. An attacker ...[truncated 1173 chars]

Remediation

View remediation

Remediation Suggestions

1. Create one hardened parser factory and use it for every untrusted XML parse:

python

def secure_xml_parser():
    return lxml.etree.XMLParser(
        resolve_entities=False,
        load_dtd=False,
        no_network=True,
        huge_tree=False,
        recover=False,
    )

2. Pass the hardened parser explicitly:

python

root = lxml.etree.parse(
    str(xml_file),
    parser=secure_xml_parser(),
).getroot()

3. Reject document XML containing DTD or entity declarations before validation.
4. Prefer defusedxml where advanced lxml functionality is unnecessary.
5. Apply the same restrictions in base.py, docx.py, and pptx.py.
6. Add input-size, tree-depth, element-count, attribute-count, and text-length limits.
7. Run document parsing in a sandbox with restricted filesystem access, memory limits, CPU limits, and no network access.
8. Add regression tests using external-entity payloads and entity-expansion payloads.

T09 · Insecure Skill Coding Practices

Warning

• Location: ooxml/scripts/unpack.py:15

Finding

Unbounded Extraction of User-Supplied Office Archives

Content

View full analysis

Vulnerability Details

File Location: ooxml/scripts/unpack.py:15-18; the same unrestricted extractall() pattern occurs in ooxml/scripts/validation/base.py:808-813, ooxml/scripts/validation/docx.py:182-185, and ooxml/scripts/validation/redlining.py:54-60.

Vulnerability Type: Unrestricted archive extraction and decompression denial of service
Risk Level: Medium

Vulnerable Code

python

# Extract and format
output_path = Path(output_dir)
output_path.mkdir(parents=True, exist_ok=True)
zipfile.ZipFile(input_file).extractall(output_path)

The shared validator also extracts the original document without inspecting archive metadata:

python

with tempfile.TemporaryDirectory() as temp_dir:
    temp_path = Path(temp_dir)

    # Extract original file
    with zipfile.ZipFile(self.original_file, "r") as zip_ref:
        zip_ref.extractall(temp_path)

The redlining validator contains the same operation:

python

with zipfile.ZipFile(self.original_docx, "r") as zip_ref:
    zip_ref.extractall(temp_path)

Technical Analysis

DOCX, PPTX, and XLSX documents are ZIP archives. The extraction paths do not impose limits on:

• Archive member count.
• Individual uncompressed member size.
• Total uncompressed size.
• Compression ratio.
• Nested archive behavior.
• Available disk capacity.
• Extraction duration.

Consequently, a small malicious Office file can expand into a very large amount of data. Validation may extract the original archive more than once, increasing resource consumption.

Python's current ZIP extraction implementation provides some filename sanitization, so path traversal was not established as the primary confirmed issue. Nevertheless, explicit resolved-path containment checks remain advisable for defense in depth.

Attack Path

1. An attacker creates an Office ZIP package containing highly compressible data or an excessive number of entries.
2. The package is given to the Skill as a document to read, edit, or ...[truncated 827 chars]

Remediation

View remediation

Remediation Suggestions

1. Inspect all ZipInfo records before extracting any member.
2. Enforce conservative limits for:
   • Maximum member count.
   • Maximum individual uncompressed size.
   • Maximum cumulative uncompressed size.
   • Maximum compression ratio.
   • Maximum filename length and path depth.
3. Reject encrypted entries, unsupported compression methods, and suspicious metadata.
4. Extract one member at a time rather than using extractall().
5. Resolve each destination path and verify that it remains under the intended extraction directory.
6. Abort extraction immediately when cumulative limits are exceeded.
7. Apply operating-system disk, memory, CPU, and execution-time limits.
8. Clean up partial extraction output on failure.
9. Reuse one validated extraction where possible rather than repeatedly extracting the original archive.
10. Add tests using high-ratio ZIP bombs, excessive member counts, absolute paths, parent-directory paths, and deeply nested names.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:191

Finding

Unpinned Third-Party Dependency Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:191-197; equivalent unpinned npm guidance appears in docx-js.md:9.

Vulnerability Type: Unpinned dependency and supply-chain exposure
Risk Level: Low

Vulnerable Code

markdown

## Dependencies

Required dependencies (install if not available):

- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
- **docx**: `npm install -g docx` (for creating new documents)
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
- **defusedxml**: `pip install defusedxml` (for secure XML parsing)

The DOCX creation documentation repeats the global unpinned npm installation:

markdown

If not installed: `npm install -g docx`

Technical Analysis

The documentation instructs users or Agents to install the latest package versions without version constraints, hashes, lockfiles, or integrity verification. The docx package is installed globally, increasing the scope of package installation scripts and making the effective dependency version dependent on registry state at installation time.

No malicious dependency or typosquatted package was identified in the reviewed project. The weakness is the non-reproducible and insufficiently verified installation process, which creates exposure to future package compromise, account takeover, or incompatible releases.

Attack Path

1. A user follows the Skill's setup instructions.
2. npm or pip resolves the current latest package release rather than a reviewed version.
3. A compromised, replaced, or unexpectedly changed package is downloaded.
4. Package-controlled installation or imported code executes in the user's environment.
5. A global npm installation may affect other projects and commands available to the user.

For operating-system packages, the actual version similarly depends on repository configuration and current repository ...[truncated 599 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed version or narrowly controlled version range.
2. Provide a lockfile for npm dependencies and use deterministic installation such as npm ci.
3. Avoid global npm installation; install dependencies in a project-local environment.
4. Use Python virtual environments and a requirements file with hashes.
5. Record package source registries and reject unexpected alternative registries.
6. Verify package signatures or checksums where available.
7. Document tested operating-system package versions.
8. Run dependency installation separately from document processing and require explicit user approval.
9. Use automated dependency auditing and controlled update review.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad, user-facing document manipulation skill focused on creating and editing professional .docx documents, including tracked changes, comments, formatting preservation, and text extraction. The supplied code does not provide those capabilities. Instead, it is a low-level packaging tool that takes an unpacked Office document directory, normalizes XML files by removing whitespace-only nodes and XML comments, zips the directory into a .docx/.pptx/.xlsx file, and optionally validates the output by attempting a headless LibreOffice conversion to HTML. This is materially different from the declared purpose and omits the headline features described, so the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a high-level document authoring/editing skill focused on professional .docx workflows, including tracked changes, comments, formatting preservation, and text extraction. The supplied code instead is a low-level OOXML inspection utility: it extracts ZIP-based Office files, reformats internal XML, and emits a random suggested RSID for .docx files. While the RSID hint is loosely related to tracked changes internals, the code does not actually create documents, modify document content, add comments, preserve formatting as a document-editing feature, or perform text extraction. It also supports .pptx and .xlsx files, which is broader and different from the declared .docx-centric document task description. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full-featured Office document manipulation and analysis skill focused on .docx workflows, including creating documents, modifying content, working with tracked changes, adding comments, and other document tasks. The supplied code instead is a narrow CLI validation utility: it takes an unpacked Office document directory plus an original file, checks file types, and runs schema/redlining validators. Its primary function is validation, not authoring or editing. It also includes support paths for .pptx and .xlsx file inputs, which is broader/different than the description centered on professional .docx document operations. While tracked changes validation is somewhat related to the declared mention of tracked changes, the overall implemented behavior is materially different from the claimed comprehensive document creation/editing capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not create or edit documents. It is a validation utility for unpacked OOXML packages across Word/PowerPoint/Excel, focused on detecting corruption or schema/reference issues. It parses XML, checks relationships and content types, validates IDs and namespaces, and compares XSD validation results against the original file. While this is loosely related to document analysis, the declared description emphasizes broad end-user document operations such as creating, modifying, tracked changes, comments, and text extraction, none of which are implemented in this code chunk. The code’s primary purpose is materially different: document/package validation rather than document authoring or editing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad document-processing skill centered on creating and editing .docx files, including tracked changes, comments, formatting preservation, and text extraction. The supplied code does not create or edit documents at all. Instead, it validates the internal XML structure of DOCX files, including schema checks and specific tracked-change consistency rules (e.g., deletion/insertion validation) plus paragraph count comparison. While there is partial thematic overlap with tracked changes and formatting/whitespace preservation, the primary purpose is validation rather than document authoring, editing, commenting, or extraction. Therefore the description materially overstates and misrepresents the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose focuses on creating, editing, and analyzing Word documents (.docx), especially features like tracked changes and comments. The code, however, is narrowly focused on validating internal XML and relationship integrity for PowerPoint presentations (.pptx). Its primary purpose is structural/schema validation, not document authoring or editing. This is not a minor implementation detail; it is a different file type, different task domain, and different capability set.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full-featured document-processing skill for .docx files, but the provided code chunk contains only a package initializer comment and no functional logic related to document handling. This is a clear mismatch in primary purpose and implemented capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description includes a broad catch-all trigger such as 'any other document tasks,' which can cause the skill to be invoked far outside a narrowly intended scope. Overbroad invocation increases the chance that the agent will apply file-writing and shell-based workflows in situations where simpler, safer handling would suffice, leading to unnecessary exposure to modification and execution capabilities.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ooxml.md (reported line 49)May include surrounding context.

Text Formatting

xml

<!-- Bold -->
<w:r><w:rPr><w:b/><w:bCs/></w:rPr><w:t>Bold</w:t></w:r>
<!-- Italic -->
<w:r><w:rPr><w:i/><w:iCs/></w:rPr><w:t>Italic</w:t></w:r>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ooxml.md (reported line 196)May include surrounding context.

md

</pic:nvPicPr>
              <pic:blipFill>
                <a:blip r:embed="rId5"/>
                <!-- Add for stretch fill with aspect ratio preservation -->
                <a:stretch>
                  <a:fillRect/>
                </a:stretch>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ooxml.md (reported line 246)May include surrounding context.

md

</w:r>
</w:hyperlink>

<!-- Bookmark target -->
<w:bookmarkStart w:id="0" w:name="myBookmark"/>
<w:r><w:t>Target content</w:t></w:r>
<w:bookmarkEnd w:id="0"/>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill directs the agent to read, write, and invoke shell commands, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where a broadly capable agent could perform filesystem and subprocess actions without a clear least-privilege boundary, increasing the chance of unintended file modification or command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill tells the agent to unpack documents, run scripts, and repack files, but it does not require any user-facing warning or confirmation before modifying documents or invoking subprocesses. In practice, that can lead to silent alteration of user files and shell activity that the user did not clearly authorize, especially when handling third-party or sensitive documents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to install packages using apt, npm, and pip, including global and system-level changes, without strong guardrails or a requirement for explicit user approval. In an agent setting, dependency installation expands the attack surface, can alter the host environment persistently, and may introduce supply-chain risk from external repositories.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Recommending 'sudo apt-get install pandoc' instructs the agent toward privileged system modification. Root-level package installation is dangerous in agent workflows because it changes the host persistently, may violate least privilege, and can be abused to broaden system access or destabilize the environment.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

Required dependencies (install if not available):

- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
- **docx**: `npm install -g docx` (for creating new documents)
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The instruction to run 'sudo apt-get install libreoffice' introduces the same privileged system-change risk, with the added concern that LibreOffice is a large external package that significantly expands the system footprint. Encouraging root installation from within a skill is unsafe because it normalizes privileged execution as part of routine document handling.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
- **docx**: `npm install -g docx` (for creating new documents)
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
- **defusedxml**: `pip install defusedxml` (for secure XML parsing)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill recommends 'sudo apt-get install poppler-utils,' again directing privileged package installation as part of normal operation. This is dangerous because an agent following the skill could make unauthorized persistent system changes and increase the attack surface solely to support an optional conversion workflow.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
- **docx**: `npm install -g docx` (for creating new documents)
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
- **defusedxml**: `pip install defusedxml` (for secure XML parsing)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guidance explicitly instructs use of w:author="Claude" for tracked changes, and later examples repeat that author identity. This is a natural-language policy concern because it forces a specific identity/label in generated document metadata rather than making authorship user-configurable or context-dependent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ooxml/scripts/pack.py (reported line 102)May include surrounding context.

python

with tempfile.TemporaryDirectory() as temp_dir:
        try:
            result = subprocess.run(
                [
                    "soffice",
                    "--headless",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script validates generated documents by passing them to an external office-suite parser, which processes complex attacker-influenced OOXML content. In the context of a document-processing skill, this increases attack surface substantially because malformed or malicious documents may trigger vulnerabilities in LibreOffice during conversion, potentially leading to denial of service or, if the dependency is vulnerable, code execution in the validation environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script calls zipfile.ZipFile(input_file).extractall(output_path) on a user-supplied Office archive without validating member paths. A crafted ZIP can contain entries with absolute paths or '..' segments, allowing files to be written outside the intended output directory and potentially overwriting arbitrary files accessible to the user running the script.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ooxml/scripts/validation/redlining.py (reported line 139)May include surrounding context.

python

modified_file.write_text(modified_text, encoding="utf-8")

                # Try character-level diff first for precise differences
                result = subprocess.run(
                    [
                        "git",
                        "diff",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes document creation, editing, analysis, tracked changes, comments, and text extraction for .docx files. This validator goes beyond direct document processing by spawning the system 'git' executable via subprocess to compute text diffs, which is not an obvious or necessary capability for a document skill and expands execution capabilities outside OOXML handling.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ooxml/scripts/validation/redlining.py (reported line 171)May include surrounding context.

python

return "\n".join(content_lines)

                # Fallback to word-level diff if character-level is too verbose
                result = subprocess.run(
                    [
                        "git",
                        "diff",

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The manifest emphasizes creating, editing, tracked changes, comments, formatting preservation, and text extraction for .docx files. Converting DOCX to PDF and then rasterizing pages to JPEG introduces a broader visual rendering pipeline through LibreOffice and Poppler that is not explicitly declared in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.