Docx Template Strict

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says: fill Word templates locally, but users should only use templates they trust because the output preserves hidden DOCX package content.

Install only if you are comfortable running a local DOCX-processing script. Use templates from trusted sources, review generated documents before sharing them, and avoid using this as a sanitizer for unknown Word files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fill_template.py:61

Finding

Untrusted DOCX Package Content Is Preserved Without Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/fill_template.py, lines 61–68
Vulnerability Type: Unvalidated preservation of active and externally referenced DOCX content
Risk Level: Medium

Vulnerable Code:

python

with zipfile.ZipFile(template_path, "r") as zin, zipfile.ZipFile(tmp, "w", compression=zipfile.ZIP_DEFLATED) as zout:
    # copy all first
    for item in zin.infolist():
        data = zin.read(item.filename)
        zout.writestr(item, data)

    # patch in-place by rewriting the same members
    patch_fn(zin, zout)

Technical Analysis

A DOCX file is an OOXML ZIP package that may contain more than visible document text and formatting. It can include external relationships, embedded or attached objects, OLE content, ActiveX components, custom XML, and content associated with headers, footers, or other document parts.

The implementation copies every entry from the input package into the output without inspecting its type, relationship mode, destination, or necessity. It subsequently modifies only selected document parts. Consequently, potentially dangerous or privacy-sensitive content in an attacker-controlled template can survive unchanged in the generated output.

This behavior exceeds the minimum package access required to preserve ordinary formatting. The script does not enforce an allowlist of expected OOXML parts, reject external relationship targets, or remove active content and embedded objects.

The same archive-writing design also appends patched versions of existing XML members after first copying the originals. This can create duplicate ZIP member names for word/document.xml and word/_rels/document.xml.rels. Different consumers may select different duplicate entries, making validation and output behavior parser-dependent.

Attack Path

1. An attacker creates or supplies a DOCX template containing an external relationship, embedded object, attached package, or ...[truncated 1348 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat input templates as untrusted ZIP packages and validate every archive member before copying it.
2. Define an explicit allowlist of OOXML parts required for document text, styles, themes, numbering, fonts, images, headers, footers, and section formatting.
3. Parse all relationship files and reject or remove relationships with TargetMode="External" unless explicitly required and approved.
4. Reject or strip macros, ActiveX controls, OLE objects, embedded packages, attached files, and unexpected binary members.
5. Validate relationship targets to ensure they resolve only to permitted internal package paths.
6. Rewrite the archive in a single pass: skip members that will be patched and write exactly one final version of each member. Reject duplicate member names in the input.
7. Apply archive resource limits, including maximum member count, compressed size, uncompressed size, and compression ratio, when accepting untrusted templates.
8. Document the trust boundary clearly and warn users not to process templates from untrusted sources until comprehensive OOXML sanitization is implemented.
9. Add automated tests using templates containing external relationships, embedded objects, duplicate ZIP entries, and unexpected package members to verify that unsafe content is rejected or removed.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill mixes English metadata with core usage and behavioral instructions in Chinese, which effectively imposes a specific language for understanding the skill. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.