Security audit

document-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly straightforward document-processing helper, but it quietly requires writing a task log to record.md after each use, which can persist information about sensitive documents without clear user-facing disclosure.

Install only if you are comfortable with the assistant processing local documents and writing a record.md task log afterward. For sensitive documents, ask the agent not to update record.md or edit the skill to require explicit permission before logging.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest frames the skill as document information extraction, but the body also instructs the agent to write/convert documents and update a separate `record.md` file. This mismatch can mislead users and orchestration systems about the skill's actual side effects, increasing the chance of unexpected file modification or broader invocation than intended.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The instruction to update `record.md` is unrelated to the stated purpose of extracting and summarizing document content, making it an unjustified side effect. Hidden file writes are dangerous because they can be used to persist data, alter workspace state, or create audit/log artifacts without clear user authorization.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are broad enough to activate on common requests such as 'analyze,' 'summarize,' or asking about information in a document. Overbroad activation can cause this skill to run in contexts where the user did not intend document parsing or file handling, increasing the risk of unintended access to attachments or execution of side-effecting instructions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill does not warn users in its description or manifest that completing a task may update `record.md`, despite that behavior appearing later in the instructions. Undisclosed side effects undermine informed consent and can enable silent persistence or modification of project files that users did not ask to change.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description says it should trigger whenever a user asks to analyze documents, extract content, or summarize reports, which is broad enough to overlap with many ordinary assistant requests. Overly broad triggers can cause the skill to activate unexpectedly, expanding access to potentially sensitive user documents or causing the system to route tasks through this skill when a narrower tool would be safer.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The description is written to force Chinese-language behavior ('文档处理技能...') without any indication that this is conditional on user preference or locale. Forcing a language can mis-handle user requests, obscure consent and expectations, and create unsafe routing behavior when the assistant serves multilingual users or mixes language-specific instructions with security-relevant processing.

Static analysis

No suspicious patterns detected.