Office Document Specialist Suite

• Outcome: Pass
• Latest audit: May 28, 2026, 2:40 AM
• Version:
  1.0.2

Overview

This is a local Word document helper with overstated Office-suite claims and dependency hygiene issues, but no evidence of hidden, destructive, or data-stealing behavior.

Install only if you need local Word .docx template generation and styling. Do not expect Excel or PowerPoint functionality from this version, and consider pinning/reviewing dependencies before processing sensitive or untrusted documents.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill metadata and README-style description advertise broad Office document capabilities that are not actually implemented, creating a trust boundary problem for agents and users that may rely on those claims when granting permissions or choosing tools. Even without direct code execution risk in this file, overstated capabilities can mislead orchestration logic, cause inappropriate deployment decisions, and hide the absence of expected safeguards or functionality.

Known Vulnerable Dependency: lxml — 10 advisory(ies): CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +7 more

High

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: lxml

VirusTotal

66/66 vendors flagged this skill as clean.