Itinerary DOCX Template

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:12 AM UTC
• Version: 1.0.1

Overview

The skill does make itinerary DOCX files, but its default workflow can silently remove tables and contract-like sections from the output document despite saying template terms are preserved.

Review this skill before installing. It should only be used on copies of templates, and generated DOCX files should be compared against the original before sending externally. Use --keep-contract if running the script as-is, and prefer a revised version that preserves contracts and tables by default, makes removals explicit, and pins python-docx.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fill_from_simplified.py:306

Finding

Default Workflow Silently Removes Tables and Contract Content

Content

View full analysis

Vulnerability Details

File Location: scripts/fill_from_simplified.py, lines 306–314, 425–426, and 434–440
Vulnerability Type: Destructive document processing caused by an unsafe default
Risk Level: Medium

Evidence

python

def remove_contract_and_tables(doc):
    for t in list(doc.tables):
        tbl = t._tbl
        tbl.getparent().remove(tbl)
    idx = find_anchor_index(doc.paragraphs, ['接待标准', '行程包含', '旅游合同', '补充协议', '合同'])
    if idx is not None:
        for p in list(doc.paragraphs[idx:]):
            e = p._element
            e.getparent().remove(e)

python

    if itinerary_only:
        remove_contract_and_tables(doc)

    doc.save(str(output))

python

if __name__ == '__main__':
    ap = argparse.ArgumentParser()
    ap.add_argument('--template', required=True)
    ap.add_argument('--content', required=True)
    ap.add_argument('--output', required=True)
    ap.add_argument('--keep-contract', action='store_true')
    args = ap.parse_args()
    fill_template(args.template, args.content, args.output, itinerary_only=(not args.keep_contract))
    print(args.output)

Technical Analysis

The default command-line behavior sets itinerary_only to true unless the caller supplies --keep-contract. This invokes remove_contract_and_tables, which performs two broad destructive operations:

1. It removes every table in the document without checking whether the table contains itinerary information.
2. It finds the first paragraph containing any broad contract-related keyword and removes that paragraph and every subsequent paragraph.

This behavior conflicts with the documented requirement in SKILL.md to preserve template clauses and terms while replacing only itinerary-related paragraphs. A keyword match can therefore cause unrelated notices, pricing data, signatures, legal provisions, or appendices to disappear from the generated document.

Th ...[truncated 1604 chars]

Remediation

View remediation

Remediation Suggestions

1. Preserve all non-itinerary content by default. Make destructive removal an explicit opt-in operation.
2. Replace --keep-contract with a clearly named flag such as --remove-contract-sections, defaulting to false.
3. Do not remove every table. Identify itinerary tables through precise structural markers, bookmarks, content controls, or validated section identifiers.
4. Define both the start and end boundary of any removable section rather than deleting every paragraph after the first keyword match.
5. Require a unique anchor match and abort with a clear error if anchors are missing, duplicated, or ambiguous.
6. Emit a summary of removed elements and require confirmation before destructive processing in interactive workflows.
7. Save to a new output path and never overwrite the source template.
8. Add regression tests using templates that contain unrelated tables, contract clauses, appendices, and repeated keywords.
9. Update SKILL.md so the documented behavior accurately describes every modification made to the source document.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:33

Finding

Unpinned Runtime Installation of a Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 33
Vulnerability Type: Unpinned supply-chain dependency
Risk Level: Low

Evidence

text

- If `python-docx` is missing, install via `python -m pip install python-docx`.

Technical Analysis

The installation instruction retrieves the latest package release available from the configured Python package index. It does not specify a reviewed version, lock transitive dependencies, verify cryptographic hashes, or constrain the package source.

The referenced package name is legitimate, and the audited files contain no evidence that the project intentionally installs a malicious or typosquatted package. Nevertheless, the instruction produces a non-reproducible environment and delegates trust to whichever package index and latest release are available at execution time.

Python package installation may execute package build or installation logic. Consequently, compromise of the package source, package index, dependency chain, or local index configuration could turn this documented setup step into a code-execution path.

Attack Path

1. python-docx is absent from the execution environment.
2. A user or agent follows the instruction in SKILL.md.
3. pip resolves the package and its dependencies from the environment's configured package index.
4. Because no version or hash is specified, a newer, compromised, substituted, or otherwise unreviewed artifact may be selected.
5. Package build or installation logic executes with the privileges of the user running pip.
6. A compromised dependency could then access data and resources available to that user.

This path depends on an upstream, index, configuration, or network trust failure; no such compromise is present in the audited project itself.

Impact Assessment

If dependency resolution is compromised, code can execute with the privileges of the account performing the installation. The acc ...[truncated 295 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin python-docx to a reviewed version in a requirements or lock file.
2. Pin all transitive dependencies where practical.
3. Record and verify artifact hashes, for example through a requirements file used with pip install --require-hashes.
4. Install only from an explicitly trusted package index over TLS.
5. Prefer a prebuilt, reviewed environment rather than installing packages dynamically during Skill execution.
6. Run dependency installation in an isolated virtual environment with minimum necessary privileges.
7. Add automated dependency vulnerability and integrity scanning to the release process.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose says the skill only replaces matched itinerary sections while preserving template styling and terms, but the detected behavior reportedly removes tables, deletes agreement-like sections, and generates substantial new content. This mismatch is dangerous because users may trust the tool with contractual or compliance-sensitive documents and unknowingly receive a materially altered document with important sections removed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill instructs reading a user-provided template DOCX and content file, but declares no explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations can allow broader-than-expected file access or make enforcement ambiguous, increasing the chance of unintended local file reads.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and title state that the skill generates output only in a Chinese template document and is framed specifically around Chinese itinerary text. This is a natural-language locale constraint presented as mandatory behavior, with no opt-in or alternative language choice documented.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function unconditionally removes all tables and then deletes all paragraphs from the first match of terms like '接待标准', '旅游合同', or '合同' to the end of the document. This exceeds the stated skill scope of only replacing itinerary sections and can silently strip contractual, pricing, and disclosure content from a template, producing misleading output documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Across this range, the script performs broad destructive edits to the source document structure and saves a modified output without any in-band warning that tables and contract-like sections may be removed. In a document-generation skill for tourism itineraries, this is more dangerous because users would reasonably expect style-preserving itinerary replacement, not silent deletion of legal/business content from the template.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default code path calls remove_contract_and_tables(doc) whenever itinerary_only is true, and the CLI sets that behavior by default unless --keep-contract is provided. In this skill context, that gives the script an unjustified default capability to strip legal and commercial sections from customer-facing documents, which can enable omission of important terms without the user's awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.