T08 · Insecure Dependencies
Warning
- Location
SKILL.md:127- Finding
Unpinned npm Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
gongwen-docx
Security checks for vulnerabilities and agentic risk
Overview
This skill appears intended for Chinese official-document formatting, but its install and post-processing steps create avoidable supply-chain and document data-loss risks.
Review before installing. Run it only on copies of documents, preferably in an isolated workspace, and avoid following the unpinned npm install step unless you pin and review the dependency. The skill does not show exfiltration or hidden persistence, but its current scripts can corrupt or delete local document files during failures.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fix_fonts.py:11- Finding
Predictable Temporary Directory Is Recursively Deleted
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fix_fonts.py:294- Finding
Source DOCX Is Deleted Before Replacement Is Safely Committed
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. 直接复用 `scripts/generate_gongwen_docx.js`（解析 markdown -> 公文，已固化全部规则）：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. 直接复用 `scripts/generate_gongwen_docx.js`（解析 markdown -> 公文，已固化全部规则）：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. 直接复用 `scripts/generate_gongwen_docx.js`（解析 markdown -> 公文，已固化全部规则）：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to read user-provided Markdown, text, and old docx inputs and references local scripts and files, which implies file-read capability, but it does not declare any explicit tool scope or allowed-tools boundary. Missing scope declarations increase the risk of over-broad file access or accidental use of file-reading in contexts beyond the intended document-conversion workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation criteria are very broad and overlap with ordinary document-editing and formatting requests, so the skill may trigger in many benign writing scenarios where users did not intend this specialized workflow. Over-broad activation can route sensitive documents into a pipeline that reads files, applies local scripts, and transforms content under assumptions the user did not explicitly approve.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This workflow mandates a specific language/locale context throughout the skill content and does not indicate that users may choose another language or opt in to Chinese-only behavior. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script removes the original input .docx and recreates it in place, so any interruption during repackaging (parse error, disk full, permission issue, crash) can permanently destroy the only copy. In this skill context, users are likely processing important official documents, which increases the practical risk of irreversible data loss even though this is not an exploit-oriented bug.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file's natural-language description and CLI usage are written entirely in Chinese and define the skill's purpose as generating documents conforming to Chinese government document standards. There is no indication that users can opt into this locale or choose another language, which can be a language/locale policy violation under the stated rules.
- Content
Static analysis
No suspicious patterns detected.