PLS Office Docs

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:32 PM UTC
• Version: 1.0.0

Overview

This skill provides straightforward office-document examples with expected local file handling and no hidden execution, persistence, or data exfiltration.

Install the dependencies in a virtual environment and consider pinning reviewed versions before using the examples on sensitive documents. Only run the read/extract examples against files you intend to process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:26, SKILL.md:96, SKILL.md:178, and SKILL.md:287
Vulnerability Type: Unpinned and integrity-unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# SKILL.md:26
pip install fpdf reportlab pdfplumber pymupdf pypdf

# SKILL.md:96
pip install python-docx

# SKILL.md:178
pip install openpyxl pandas xlsxwriter

# SKILL.md:287
pip install python-pptx

Technical Analysis

The skill instructs users or agents to install third-party Python packages without exact version constraints, cryptographic hashes, a lockfile, an isolated environment, or an explicitly trusted package repository. Consequently, the content resolved by pip can change after the skill has been reviewed.

If a package release or one of its transitive dependencies is compromised, pip may retrieve attacker-controlled content. Source distributions can execute build-system code while being built, and malicious installed packages can execute code when imported by the document-processing examples. The absence of version pinning and hash verification also prevents reproducible dependency resolution.

The reviewed package names do not themselves demonstrate dependency confusion or typosquatting, and the project does not contain a malicious payload. The risk arises from trusting mutable, integrity-unverified supply-chain content.

Attack Path

1. An attacker compromises a named package, a transitive dependency, or the package repository/account used to distribute a future release.
2. A user or agent follows one of the documented pip install commands.
3. pip resolves the latest eligible package graph because no reviewed versions are pinned.
4. The compromised artifact is downloaded without verification against project-maintained hashes.
5. Attacker-controlled code executes during a source build or when the installed package is subsequently imported by ...[truncated 744 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unconstrained package installation commands with exact, reviewed versions.
2. Maintain dependencies in a lockfile generated by a tool such as pip-tools, Poetry, or uv.
3. Require cryptographic hashes, such as through pip install --require-hashes -r requirements.txt.
4. Review and pin transitive dependencies rather than only direct dependencies.
5. Install packages in a dedicated virtual environment or restricted container under a non-privileged account.
6. Configure an approved package index or internal mirror and disable unexpected supplemental indexes.
7. Prefer reviewed binary wheels where appropriate, and avoid untrusted source builds.
8. Scan locked dependencies regularly for known vulnerabilities and update them through a controlled review process.
9. Document the tested Python and dependency versions to make the workflow reproducible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.