办公效率中枢

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.1

Overview

This office automation skill has a legitimate purpose, but it asks for broad file, command, email, database, cloud, and scheduled-task authority without clear enough boundaries.

Review this before installing in any workspace with sensitive documents or production credentials. Use it only with explicit user approval for bulk email, cloud uploads, database access, scheduled jobs, and command execution; prefer a sandbox, pinned dependencies, dry runs, limited file scopes, and clear retention rules for logs and .trash backups.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:330

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:330-334
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable snippet:

text

| `python-docx` | Library | Required for document processing | `pip install python-docx` |
| `openpyxl` | Library | Required for Excel processing | `pip install openpyxl` |
| `python-pptx` | Library | Required for presentation processing | `pip install python-pptx` |
| `pdfplumber` / `PyPDF2` | Library | Required for PDF processing | `pip install pdfplumber` |
| `pandas` | Library | Required for data processing | `pip install pandas` |

Technical Analysis

The Skill instructs the Agent to install multiple third-party Python packages without specifying reviewed versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Each installation therefore resolves mutable package versions from the environment's configured package repository at execution time.

This design exposes the Agent to package-repository compromise, dependency confusion, compromised maintainer releases, and malicious transitive dependencies. Python packages can execute code during installation, and imported packages execute with the permissions of the Agent process.

The listed package names are legitimate and there is no evidence that they are currently malicious. The vulnerability is the absence of controls ensuring that the installed artifacts are the same artifacts that were reviewed.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or a package index trusted by the runtime.
2. The Skill is invoked in an environment where one or more dependencies are unavailable.
3. The Agent follows the documented commands and installs the latest package version from the configured index.
4. Malicious package code executes during installation or when the package is imported for document processing. ...[truncated 747 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version.
2. Generate and commit a lockfile that includes all transitive dependencies.
3. Require cryptographic hashes during installation, such as through a hash-locked requirements file and pip --require-hashes.
4. Configure an explicitly trusted HTTPS package index or an internally controlled package mirror.
5. Install packages in an isolated virtual environment or disposable sandbox without administrator privileges.
6. Run software-composition analysis and vulnerability scanning against direct and transitive dependencies.
7. Separate dependency installation from normal Skill execution so runtime requests cannot silently install new package versions.
8. Restrict the installation environment's access to sensitive documents, environment variables, and production credentials.

other

Note

• Location: SKILL.md:251

Finding

Unnecessary Network and Security-Configuration Reconnaissance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:251
Vulnerability Type: Excessive environment reconnaissance
Risk Level: Low

Source instruction, translated into English:

text

| 1 | Missing input parameters | The user did not provide required parameters | Ask the user to provide the required parameters, then execute ping to test network connectivity, inspect firewall and proxy settings, reconnect, and execute the command again | P0 |

Technical Analysis

The documented recovery procedure treats a missing input parameter as a reason to run ping and inspect firewall and proxy settings. Missing application parameters do not establish that a network failure exists, so these diagnostic operations are unrelated to the triggering condition and exceed the minimum access required to resolve it.

Firewall and proxy inspection can reveal internal network topology, proxy endpoints, security policies, and host configuration. The instruction does not define approved diagnostic commands, permitted targets, output-redaction requirements, platform-specific safeguards, or a requirement to obtain user authorization before inspection.

The project contains no implementation scripts, so it cannot be confirmed which commands would be executed or whether the claimed command allowlisting is enforced.

Attack Path

1. An attacker or untrusted user submits a request with one or more required parameters intentionally omitted.
2. The Skill enters the documented missing-parameter recovery path.
3. The Agent runs network-connectivity diagnostics and attempts to inspect firewall or proxy configuration.
4. Diagnostic output is returned to the conversation or written to operational logs.
5. The requester obtains information about internal network connectivity or security controls that was not necessary for the original task.
6. The disclosed information may be used to improve subsequent targeting of reachable services or i ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the missing-parameter response so it only identifies and requests the required parameters.
2. Perform network diagnostics only after a concrete network operation fails with a connectivity-related error.
3. Require explicit user authorization before inspecting firewall, proxy, routing, or other security-sensitive configuration.
4. Define a narrow allowlist of diagnostic commands and prohibit arbitrary command construction from user-controlled input.
5. Run diagnostics with least privilege in a sandboxed environment.
6. Redact proxy credentials, internal addresses, authentication headers, and sensitive policy details from responses and logs.
7. Separate parameter-validation errors from connectivity, authentication, authorization, and service-availability errors.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document claims data is processed locally by default and not uploaded to the cloud, yet elsewhere promotes cloud storage, webhooks, email, IM, database, and API integrations that transmit data externally. This contradiction can mislead users into assuming data residency and confidentiality guarantees that are not actually maintained, increasing the risk of unintended disclosure of sensitive business or personal data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill's display name and primary descriptive content are presented in Chinese, with no indication that the user may choose another language or locale. For a general-purpose office automation skill, this creates a language/locale constraint that is not documented as optional or region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description says to use the skill whenever efficiency, automation, batch processing, or workflow optimization is needed, which is vague and far broader than a safe routing boundary. In a skill with read/write/exec tools and data-processing capabilities, ambiguous activation guidance increases the chance of unintended use on sensitive office content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that PII must be masked before processing, but multiple later workflows describe ingesting raw HR, finance, customer, database, and email data first and only masking during or after processing. This creates a misleading security guarantee that could cause operators to process sensitive data in unsafe stages, exposing unmasked PII to logs, intermediate files, prompts, reports, or external integrations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language triggers are very broad and map to ordinary office requests such as converting files, merging spreadsheets, sending emails, generating reports, and scheduling meetings. Overbroad activation guidance can cause accidental invocation of a high-capability skill with read/write/exec permissions in contexts where the user did not explicitly intend to authorize automation or data handling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill describes itself in one place as MD+EXEC requiring command and script execution, but later classifies itself as pure Markdown. Conflicting execution semantics are security-relevant because operators and platforms may apply different trust boundaries, sandboxing, and approval requirements depending on whether a skill can execute commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.