Security audit

Own Style Writer

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its document conversion path can install unpinned third-party code and upload or fetch through service-supplied URLs without enough containment.

Install only if you are comfortable with a skill that reads user-selected writing directories, may upload documents to MinerU when you allow it, and may install Python dependencies for local conversion. Prefer disabling uploads for sensitive documents, use a locked or sandboxed Python environment, restrict supported extensions if you do not need ZIP or Office parsing, and review generated manifests before using the corpus for writing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/bootstrap_markitdown.py:229
Finding: Automatic Installation of Unpinned Third-Party Dependencies
Content: View full analysis
=20251230", "pdfplumber>=0.11.9", "olefile", "pydub", "SpeechRecognition", "youtube-transcript-api~=1.0.0", "azure-ai-documentintelligence", "azure-ai-contentunderstanding>=1.2.0b1", "azure-identity", ] pptx = ["python-pptx"] docx = ["mammoth~=1.11.0", "lxml"] xlsx = ["pandas", "openpyxl"] xls = ["pandas", "xlrd"] pdf = ["pdfminer.six>=20251230", "pdfplumber>=0.11.9"] outlook = ["olefile"] ``` ### Technical Analysis When the reusable MarkItDown environment is missing or lacks a requested format extra, the Skill automatically invokes `pip install`. Most direct dependencies ...[truncated 1989 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mineru_client.py:350
Finding: Unrestricted MinerU-Directed URL Fetching and Unbounded Response Processing
Content: View full analysis
Path | None: payload = _flatten_response(data) markdown = payload.get("markdown") or payload.get("md") or payload.get("content") if isinstance(markdown, str) and markdown.strip(): _write_text(output, markdown) return output markdown_url = ( payload.get("markdown_url") or payload.get("markdownUrl") or payload.get("md_url") or payload.get("mdUrl") or payload.get("url") ) if isinstance(markdown_url, str) and markdown_url.startswith(("http://", "https://")): text = _download_text(markdown_url) _write_text(output, text) return output return None ``` Polling URLs are also accepted without host or resolved-address restrictions: ```python def _extract_poll_url(data: dict[str, Any], *, base_url: str) -> str | None: payload = _flatten_response(data) for key in ("poll_url", "pollUrl", "result_url", "resultUrl"): value = payload.get(key) if isinstance(value, str) and value: return urllib.parse.urljoin(base_url, value) task_id = payload.get("task_id") or payload.get("taskId") or payload.get("id") if task_id: quoted = urllib.parse.quote(str(task_id)) return f"{base_url.rstrip('/')}/api/v1/agent/parse/result/{quoted}" return None ``` Precise-mode upload URLs returned by the service receive complete local document contents without local destination validation: ```python def _upload_file(upload_url: str, source: Path) -> None: request = urllib.request.Request(upload_url, data=source.read_bytes(), met ...[truncated 5352 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (94)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: ZIP archive extraction and recursive conversion increase filesystem and parser exposure beyond the stated writing workflow. Archive handling can amplify risk because nested content types and large expansion are harder to review and control.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.