Document Sanitizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:08 AM UTC
• Version: 1.5.1

Overview

The skill does what it says, but its recovery file can expose the original sensitive data and some file-writing and conversion behavior needs review.

Use this only in a controlled workspace. Treat _sanitize_record.json as highly sensitive because it contains the values needed to undo redaction, keep it out of source control and shared folders, and delete it when no longer needed. Review _sanitize_config.json and _sanitize_record.json before running, and avoid --auto-convert unless the external converter skill in ~/.workbuddy is trusted and unchanged.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sanitize.py:666

Finding

Arbitrary File Write Through Unvalidated Sanitized and Restored Paths

Content

View full analysis

Remediation

View remediation

Path: if relative_path.is_absolute(): raise ValueError("Absolute output paths are not permitted") base = base_dir.resolve() destination = (base / relative_path).resolve() try: destination.relative_to(base) except ValueError: raise ValueError("Output path escapes the designated directory") return destination ``` 3. Apply this validation to both sanitized and restored destinations. 4. Treat `_sanitize_config.json` and `_sanitize_record.json` as untrusted input and validate their schemas and value types. 5. Refuse to overwrite existing files unless the user explicitly authorizes it. 6. Consider mapping only basename-to-basename values rather than allowing arbitrary relative paths in `filename_mapping`. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/sanitize.py:154

Finding

Unverified Execution of Scripts from a Mutable External Skill Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sanitize.py:66

Finding

Plaintext Storage of Reversible Sensitive-Data Mappings

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill prominently describes a unified restoration record that maps sanitized values back to original sensitive data, but it does not clearly warn that this record effectively stores the original secrets in plaintext-like form. If the workspace, output directory, backups, logs, or version control are accessed by others, the desensitization can be trivially reversed and all sensitive values exposed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents capabilities that imply reading files, writing output files, and invoking Python/shell commands, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent framework grants broader-than-necessary access or that users are not clearly informed about filesystem and command execution behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to match generic document editing, redaction, or privacy-related requests, which can cause the skill to activate in contexts the user did not specifically intend. In an agent environment, over-broad activation can expose sensitive documents to processing and create restoration records containing original values when a simpler, non-reversible action may have been expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions, help text, and runtime messages in this file are exclusively in Chinese, which effectively forces a specific language for users. There is no opt-in, alternate locale support, or documentation that this skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tool persists a reversible mapping from sanitized placeholders back to original sensitive values in _sanitize_record.json, which effectively stores all redacted secrets in plaintext. If that record is accessed, copied, committed, or shared alongside sanitized outputs, the redaction is defeated and sensitive company, personal, or identifier data can be fully reconstructed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest and in-file usage text frame the skill as a batch desensitizer for docx/xlsx files, with legacy formats merely detected and suggested for conversion. In practice, the code implements active .doc/.xls conversion via subprocess calls to another skill, which is additional behavior beyond straightforward docx/xlsx sanitization/restoration.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sanitize.py (reported line 179)May include surrounding context.

python

# 输出到同目录，扩展名改为 .docx
                output_path = doc_file.with_suffix(".docx")
                try:
                    result = subprocess.run(
                        [sys.executable, str(doc_script), str(doc_file), str(output_path)],
                        capture_output=True, text=True, encoding="gbk", errors="replace", timeout=120
                    )

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A document sanitization skill would be expected to read and rewrite supported document files, but spawning subprocesses to execute external scripts from another installed skill is a separate operational capability. This introduces cross-skill execution behavior that is not declared in the manifest's purpose or trigger language.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sanitize.py (reported line 209)May include surrounding context.

python

for xls_file in xls_files:
                output_path = xls_file.with_suffix(".xlsx")
                try:
                    result = subprocess.run(
                        [sys.executable, str(xls_script), str(xls_file), str(output_path)],
                        capture_output=True, text=True, encoding="gbk", errors="replace", timeout=120
                    )

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The JSON config uses fixed Chinese labels such as "手机号", "身份证号", and "邮箱" for detected patterns. Because this file contains natural-language values and does not indicate that the skill is region-specific or that users can choose their locale, it may violate the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.