Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Script location:** `document_diff.py` in the same directory as this `SKILL.md`
Security audit
Document Diff
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims: it compares two user-provided documents by sending them to SoMark for parsing, then saves local diff outputs.
Install only if you are comfortable sending the compared documents to SoMark and storing parsed Markdown plus diff reports locally in plaintext. Avoid using it on confidential, regulated, or highly sensitive documents unless that external processing and local persistence are approved.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill invokes capabilities that imply environment access, reading/writing local files, and network use, but it does not declare any explicit tool scope or allowed-tools boundary. That weakens least-privilege controls and makes it easier for an agent runtime to over-grant access, especially because the workflow sends document contents to an external service and writes parsed outputs locally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs users to parse documents with a third-party service but does not clearly warn that the document contents will be uploaded off-box to an external provider. This is dangerous because users may submit confidential contracts, policies, or regulated documents without informed consent, causing privacy, compliance, or contractual exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prescribed presentation template is entirely in Chinese and is framed as the required output structure, but the document does not offer the user a language choice or state that Chinese is optional. This creates a language/locale policy issue because it forces a specific language regardless of user preference.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md If the user has not configured an API key, follow the same setup steps as the somark-document-parser skill. **Step 1:** Ask whether it is already configured — do not ask the user to paste the key in chat. **Step 2:** Direct them to https://somark.tech/login to create a key in the format `sk-******`.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill uploads entire user-supplied documents to the external SoMark API for parsing, but the code provides no explicit runtime warning, consent prompt, or clear indication in output that sensitive document contents leave the local environment. In a document-diff skill, inputs are often contracts, reports, IDs, or presentations, so silent third-party transmission creates a real confidentiality and compliance risk even if the API use is functionally intended.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
User-facing messages, help text, and errors throughout the script are written only in Chinese, which forces a specific language without any apparent user opt-in or locale selection. This is a natural-language policy concern because the tool does not provide an alternative language path or document a justified locale restriction.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill writes extracted markdown, diff reports, and a summary to disk by default, which can persist sensitive document contents and change history in plaintext files. This is especially relevant because document diffs often reveal confidential edits, removed clauses, and prior versions that users may not expect to remain stored locally.
- Content
Static analysis
No suspicious patterns detected.