Office Document Specialist Suite

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:06 PM UTC
• Version: 1.0.2

Overview

This skill is a local Word document template and styling utility, with some overstated Office-suite claims and normal dependency-installation cautions.

Install only if you need a basic local Word .docx template/styling helper, not a full Office suite. Review or pin the Python dependencies before use in sensitive environments, and be aware that generated document text defaults to Dutch.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unverified Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2, invoked by setup.sh:7-8
Vulnerability Type: Supply-chain exposure through mutable dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1-2:

text

python-docx>=1.1.2
lxml>=5.3.0

setup.sh:7-8:

bash

python -m pip install --upgrade pip
python -m pip install -r requirements.txt

Technical Analysis

The dependency declarations use lower-bound constraints rather than exact, reviewed versions. Consequently, later executions of setup.sh may install future releases that were not present during this audit. No lock file or cryptographic hashes are supplied to verify the integrity of downloaded distributions.

The setup script also upgrades pip to the latest version available from the configured package index. This introduces another mutable component into the installation process. The packages are obtained from whatever index pip is configured to trust, rather than from an explicitly documented and trusted repository.

This does not establish that the currently named packages are malicious. It creates a supply-chain exposure in which a compromised package release, package index, mirror, or local pip configuration could cause unreviewed code to be installed and potentially executed.

Attack Path

1. A user follows the installation instructions and executes setup.sh.
2. The script activates a virtual environment and upgrades pip using the configured package index.
3. pip resolves python-docx and lxml to any available versions satisfying the open-ended >= constraints.
4. An attacker compromises a qualifying future release, the configured package index or mirror, or the dependency delivery path.
5. pip downloads and installs the attacker-controlled distribution.
6. Malicious build or installation logic may execute with the privileges of the user running setup.sh.
7. Installed malicious runtime code may execute again when ods.py imports `docx ...[truncated 709 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound constraints with exact versions that have been reviewed and tested:

text

python-docx==1.1.2
lxml==5.3.0

2. Generate a hash-locked dependency file and require hash verification during installation. For example:

bash

python -m pip install --require-hashes -r requirements.lock

3. Include hashes for every permitted wheel or source distribution, including transitive dependencies.

4. Remove the unconditional pip upgrade from setup.sh, or pin pip to a reviewed version with integrity verification.

5. Explicitly document and enforce the trusted package index rather than relying silently on user-level or system-level pip configuration.

6. Perform dependency updates through a controlled review process that includes vulnerability scanning, provenance checks, testing, and lock-file regeneration.

7. Run installation and document processing as an unprivileged account with access only to the files required for the task.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code implements a limited Word document formatting/generation utility. It creates a .docx report template, configures styles, headers/footers, margins, orientation, and applies styling to an existing .docx file. This partially matches the 'creating' and 'editing' aspects for Word documents and automated reporting templates, but materially overstates the scope. There is no Excel or PowerPoint support, no analysis functionality, and no document management features. Therefore the declared description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code presents command help and generated document text in Dutch, such as the subcommand help strings and defaults, with no indication that the skill is intentionally limited to Dutch-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only (python-docx>=1.1.2), which makes builds non-reproducible and allows future installations to pull different versions over time. In a document-processing skill, this increases supply-chain risk and makes it difficult to verify whether a deployed version includes a vulnerable or incompatible release.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

python-docx>=1.1.2
lxml>=5.3.0

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

python-docx has known historical advisories, and because the manifest does not pin an exact version, it is impossible to verify from this file alone whether the installed package is affected. In a skill that creates and analyzes Office documents, document-parsing libraries are directly in scope, so uncertainty around patched status is a meaningful supply-chain weakness.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lxml dependency is also unpinned (lxml>=5.3.0), so installations may resolve to different versions depending on time and environment. Because lxml is a security-sensitive parser library often used on untrusted document content, lack of pinning increases exposure to supply-chain issues and complicates assurance that a safe version is installed.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

python-docx>=1.1.2
lxml>=5.3.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

lxml has a larger history of security advisories, and the unpinned requirement prevents verification that the resolved version is patched. Given this skill processes Office documents and likely handles XML-based content, an unsafe lxml version could increase exposure to parser-related issues such as XSS in downstream cleaning workflows or XML handling weaknesses, making the context somewhat more dangerous than a generic utility package.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.