公文写作

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.6.0

Overview

This skill is a coherent Chinese official-document drafting aid with disclosed local document handling and validation scripts, but users should invoke it deliberately and avoid confidential materials.

Install through a trusted marketplace flow when possible or pin/verify the installer version before using npx. Use this skill only for non-confidential Chinese official-document drafting, explicitly invoke it for sensitive workplace material, and avoid running the validation scripts on untrusted or unusually large DOCX files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:39

Finding

Unpinned npm Package Execution During Installation

Content

View full analysis

Remediation

View remediation

install gov-report-writing ``` 2. Prefer the platform's authenticated and trusted marketplace installer when available. 3. Publish the expected package source, version, and integrity information. 4. Use npm lockfiles and integrity hashes where the installation workflow supports them. 5. Recommend reviewing package provenance and publisher identity before execution. 6. Avoid instructing users to run the installer with administrator or root privileges. 7. Consider providing a non-executing manual installation method from a signed release archive. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/quality_score.py:347

Finding

Unbounded DOCX Decompression and XML Parsing in Quality Scoring Script

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/format_check.py:151

Finding

Unbounded DOCX Entry Decompression in Format Checker

Content

View full analysis

Remediation

View remediation

MAX_XML_BYTES: raise ValueError('DOCX XML entry exceeds the supported size') if info.compress_size == 0 or info.file_size / info.compress_size > MAX_RATIO: raise ValueError('Suspicious DOCX compression ratio') ``` 2. Enforce maximum values for archive size, entry count, individual uncompressed entry size, and total uncompressed size. 3. Apply the same validation to footer entries and all other document parts. 4. Stream XML through a bounded reader and use incremental parsing. 5. Enforce XML element-count, text-size, and nesting-depth limits. 6. Process untrusted documents in a sandboxed worker with memory, CPU, and timeout restrictions. 7. Do not silently suppress footer-processing failures; return a controlled diagnostic while preserving resource limits. 8. Add regression tests using oversized entries and high-compression-ratio DOCX fixtures. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Beyond writing, the skill describes automated scoring of existing documents, parsing .docx/.md/.txt files, secrecy-signal detection, and machine-readable validation workflows. When a skill's actual behaviors exceed its stated purpose, users and platforms may authorize or trigger it under false expectations, leading to unintended access to sensitive local documents and metadata.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Beyond writing, the skill describes automated scoring of existing documents, parsing .docx/.md/.txt files, secrecy-signal detection, and machine-readable validation workflows. When a skill's actual behaviors exceed its stated purpose, users and platforms may authorize or trigger it under false expectations, leading to unintended access to sensitive local documents and metadata.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Single-word and underspecified triggers are particularly risky because they can fire on many unrelated requests. Given that this skill includes document parsing, local file reads, and validation/scoring features, such triggers can unintentionally expose sensitive workspace files or cause unexpected automated processing.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

+ 7 种行政公文 + 11 种专题模板 + 信函式文件 + 应急预案/会议议程/慰问信/专项总结/联合行文）、公文专用措辞规范及安全保密要求；成稿后可用 `scripts/quality_score.py` 做五维 100 分质量评分（合规/完整/规范/准确/文风），用 `scripts/format_check.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

md

+ 7 种行政公文 + 11 种专题模板 + 信函式文件 + 应急预案/会议议程/慰问信/专项总结/联合行文）、公文专用措辞规范及安全保密要求；成稿后可用 `scripts/quality_score.py` 做五维 100 分质量评分（合规/完整/规范/准确/文风），用 `scripts/format_check.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.

md

+ 7 种行政公文 + 11 种专题模板 + 信函式文件 + 应急预案/会议议程/慰问信/专项总结/联合行文）、公文专用措辞规范及安全保密要求；成稿后可用 `scripts/quality_score.py` 做五维 100 分质量评分（合规/完整/规范/准确/文风），用 `scripts/format_check.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 439)May include surrounding context.

md

+ 7 种行政公文 + 11 种专题模板 + 信函式文件 + 应急预案/会议议程/慰问信/专项总结/联合行文）、公文专用措辞规范及安全保密要求；成稿后可用 `scripts/quality_score.py` 做五维 100 分质量评分（合规/完整/规范/准确/文风），用 `scripts/format_check.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger examples and usage text are broad enough to match common phrases like '帮我写…', '写报告', or '整理成正式会议纪要', which can cause the skill to activate in contexts the user did not clearly intend. In an agent environment, overbroad triggering can route sensitive workplace content into this skill automatically, increasing the chance of unintended processing, formatting actions, or exposure of internal material.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README states '仅支持中文公文写作,' which is a language restriction. While the domain is Chinese official document writing, the file does not explicitly present this as a user-selectable locale choice or clearly justify the restriction as a documented regional/locale constraint in policy terms.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The FAQ states that users can 'directly say the requirement' and that the skill may auto-trigger, but it does not define exclusions, confidence thresholds, or when confirmation is required. In a government/state-owned-enterprise writing context, ambiguous auto-triggering is more dangerous because user messages may contain internal, sensitive, or regulated content that should not be processed without explicit intent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to read local reference files and user-supplied materials and to invoke local validation scripts, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates a least-privilege gap: an agent/runtime may grant broader file access than users expect, increasing the risk of unintended local file reads during activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description specifies writing formal Chinese government and SOE documents, and later content states the skill only supports Chinese official documents. This is a natural-language locale restriction that does not present a user choice or explicit opt-in within the skill definition.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Broad trigger phrases like '写公文' and '写报告' overlap with ordinary writing-help requests, making accidental activation likely. Because this skill can read local materials and invoke validation workflows, overbroad activation expands the chance that higher-privilege behaviors run in contexts where the user only wanted generic assistance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Several workplace-common triggers in this range are ambiguous enough to match benign office conversations, increasing unintentional routing to this skill. In this skill's context, mistaken activation is more dangerous than for a pure text-only formatter because the instructions include reading attachments and local reference content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains natural-language instructions that prescribe a specific language/locale context ('公文', Chinese official-document style) and all guidance is presented only in Chinese. Under the policy rule, forcing a specific language or locale without user opt-in or an explicit justified regional constraint is a reportable issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file states that '英文公文' is unsupported when the input contains English requests or English materials. This is a natural-language policy issue because it forces a Chinese-only scope without offering the user a language choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents the skill title, purpose, and loading conditions only in Chinese, which can amount to forcing a specific language without user opt-in. The policy explicitly calls for flagging language or locale constraints unless the file offers a choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This file contains natural-language guidance exclusively in Chinese, including the title, usage notes, and all examples, with no indication that users may opt into another language or locale. Under the policy rule for language or locale constraints, forcing a single language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

该文件全文以中文公文写作为唯一适用语境，围绕“公文”“院党委”“政治术语”等中文正式文本规范展开，但未说明这是仅适用于中文公文场景的受限技能，也未向用户提供语言/locale 选择。按照规则，若技能隐含强制特定语言或地区写作规范而无用户选择，应视为自然语言政策风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L012 将“润色”“优化语言”“再读一遍”列为明确要求时优先执行的触发条件，其中“优化语言”和“再读一遍”都可能出现在普通写作或对话场景中，缺少公文场景限定，容易与日常表达重叠。该段也未给出排除条件或负例，无法清楚界定何时不应触发本技能。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents all templates, instructions, and user-facing guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title states this is a dedicated vocabulary and phrasing standard for 国央企 official documents, and the rest of the file consistently prescribes mandatory wording such as “必须准确” and “一律”. This imposes a specific language/register policy on outputs without any opt-in, alternative language option, or explicit justification that the skill is limited to a region-specific compliance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This Python file's natural-language docstring, help text, and user-facing messages are entirely in Chinese, which imposes a specific language on all users. The policy allows locale constraints only when user opt-in is offered or the restriction is clearly documented and justified as region-specific; that justification is not explicitly stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file-level documentation and CLI interface are entirely in Chinese and describe the tool specifically for Chinese-language government report writing, with no indication that users can choose another language or locale. This is a natural-language locale constraint embedded in the skill that may violate organizational language-choice policy when not explicitly offered as opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.