Security audit

文档格式校正

Security checks for vulnerabilities and agentic risk

Overview

This is a local document-formatting skill with no evidence of exfiltration or persistence, but users should know it can change whitespace and blank-paragraph structure despite strong content-preservation wording.

Install only if you are comfortable with a formatter that may change whitespace, blank lines, indentation, and document spacing. For legal, evidentiary, academic, or publication files, keep the original file, write to a separate output path, and review a diff or visual comparison before relying on the result.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Note

Location: scripts/fix_format.py:5
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/fix_markdown.py:20
Finding: Markdown Hard-Line-Break Semantics Are Silently Removed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/fix_format.py:145
Finding: Separated DOCX Blank Paragraphs Are Incorrectly Deleted
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 代码主功能与“文档格式校正”总体方向一致，但与声明存在实质性偏差。首先，脚本并非纯粹只改格式：remove_trailing_spaces 会直接改写 run.text，remove_empty_paragraphs 会删除连续空白段落中的部分段落，这已超出“绝不改动任何文字内容”的承诺。其次，能力范围被高估：实现完全基于 python-docx，只能打开和保存 DOCX，未见 Markdown 或纯文本处理逻辑。再次，声明中提到依据用户提供的标准示例文档、截图、格式规范要求进行精准修正，但实际实现仅能套用 gb-t9704、thesis-cn、general 三个硬编码预设，没有解析截图、对比模板或动态按用户示例学习格式的能力。因此应判定为描述与实际行为不完全一致，属于 mismatch。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个范围较广、可依据外部格式标准进行精准排版修正的文档格式校正智能体，并且强调不改动任何文字内容。实际代码仅实现了针对 Markdown/纯文本的少量固定规则处理，没有解析 DOCX，也没有接收或利用标准示例文档、截图、模板等外部规范输入。更重要的是，代码会删除连续空行、补充标题前空行、调整列表缩进和补文件末尾换行，这些都会改变原始文本内容/空白结构，因此与“全程不新增、删减、篡改、替换原文任何文字内容”的严格承诺存在实质偏差。虽然整体方向仍属于格式整理，但能力范围和行为边界都比声明更窄且不完全一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script explicitly promises not to modify text content, but it rewrites run.text in remove_trailing_spaces() and deletes some blank paragraphs. In a document-formatting skill, that mismatch is security-relevant because users may trust it with sensitive or legally significant documents expecting content preservation, and the tool can silently alter document meaning or evidentiary fidelity.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description is written as a Chinese-only role definition ('专业文档格式校正智能体') and the skill content consistently assumes Chinese document conventions and presets such as 'thesis-cn' and Chinese government document formatting. There is no statement that the user may choose another language or that the Chinese locale restriction is optional, which creates a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The function directly mutates run.text while claiming it does not modify visible text. Trailing spaces, tabs, and newline-adjacent whitespace can be semantically meaningful in code snippets, templates, signatures, poetry, tables, or preformatted content, so silent rewriting can corrupt user data despite the skill's preservation guarantee.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code file contains natural-language documentation entirely in Chinese and later prints only Chinese usage and status messages. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The function documentation says it removes completely blank paragraphs, but the code actually collects blank paragraphs and deletes only those after the first in a consecutive sequence. This contradicts the stated behavior by preserving one blank paragraph rather than removing all blank paragraphs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.