page-doc-generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:51 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it reads a user-specified mini-program or uni-app project, builds page documentation from Vue files and screenshots, and optionally converts it to Word using pandoc.

Install only if you are comfortable with the generated document containing screenshots, Vue source snippets, and local project paths. Review the Markdown or DOCX before sharing it outside your team, especially if source files may contain secrets or proprietary code.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description suggests a higher-level documentation generator that takes screenshots and source code from a mini-program/uni-app project and produces a Word document. The supplied code does not analyze source code, collect screenshots, generate document content, or perform project-specific documentation tasks. Its actual function is much narrower: it takes a Markdown file path and invokes pandoc to convert that Markdown into a .docx file, resolving embedded local images from the Markdown's directory. While converting Markdown to Word could be a supporting step in a larger documentation workflow, this chunk by itself does not implement the declared primary purpose, so this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code’s overall purpose is closely related to the description: it documents project pages using screenshots and source code. However, the key output format is materially different. The script writes a Markdown file named '_页面文档.md' and contains no Word/document generation logic such as .docx creation or Word export. It also specifically targets Vue page files in a uni-app/miniprogram-style pages directory, which is consistent enough with the declared domain, but the mismatch in output format is significant because 'Generate Word documentation' is the core stated capability. No suspicious undeclared behaviors like networking, exfiltration, or unrelated system access are present.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill describes capabilities that require reading project files, writing output documents, and invoking a shell command via pandoc, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because an agent may execute broader-than-necessary filesystem or shell actions without clear restrictions, increasing the chance of unintended file access, overwrites, or command execution in response to user-controlled paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough to activate on generic documentation requests, which can cause the skill to run in contexts the user did not intend. Because the skill involves filesystem access and shell-based conversion, over-broad triggering increases the risk of unnecessary project scanning, exposure of source code content, or writing output files in response to ambiguous prompts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This script's actual behavior is limited to taking an existing Markdown file and converting it into a Word document. That is narrower and materially different from the manifest's described capability of generating documentation from screenshots and source code, which implies analysis/assembly of project assets rather than plain format conversion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames the skill as a documentation generator from screenshots and source code, but this file introduces a general-purpose external process execution capability by probing for and invoking pandoc. Spawning local executables is a broader capability than the manifest suggests and is not explicitly declared as part of the skill's scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/convert_to_docx.py (reported line 29)May include surrounding context.

python

for loc in locations:
        try:
            result = subprocess.run(
                [loc, "--version"],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/convert_to_docx.py (reported line 41)May include surrounding context.

python

continue
    
    try:
        subprocess.run(["pandoc", "--version"], capture_output=True, timeout=5)
        return "pandoc"
    except:
        pass

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/convert_to_docx.py (reported line 80)May include surrounding context.

python

]
    
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes generating Word documentation from screenshots and source code, but the implementation builds Markdown content and writes a .md file (项目名_页面文档.md) rather than producing a Word document. This is a direct behavior mismatch at the core output of the skill, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script hard-codes Chinese strings for the document title, section headings, table labels, and footer in generated output. This is a natural-language locale policy issue because users are not given an opt-in or configuration choice for the output language.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/generate_page_doc.py (reported line 217)May include surrounding context.

python

"---",
        f'title: "{project_name} - 页面文档"',
        f'author: "Generated by page-doc-generator"',
        f'date: "{__import__("datetime").date.today().isoformat()}"',
        "---",
        "",
        f"# {project_name} - 页面文档",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script automatically embeds full Vue source code and local filesystem paths into a generated Markdown file, which can disclose proprietary code, secrets accidentally present in source, and sensitive environment details if the document is shared or uploaded elsewhere. In this skill context, documentation generation makes this more dangerous because exfiltration can occur under the appearance of a normal reporting task.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The top-level docstring presents the script as generating page documentation in a way consistent with the skill's Word-document purpose, but the concrete implementation later is explicitly generate_markdown and writes a Markdown file. The documentation therefore creates a misleading impression about what artifact is produced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.