Word文档工具（免费版）

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

This is a simple Chinese-language Word document helper whose file access and command use are mostly aligned with creating and editing DOCX files, though users should be cautious about local file writes and dependency installs.

Install only if you are comfortable with a Word helper that can read and write local documents and run Python setup commands. Use it on user-specified paths, review before allowing deletion or overwrites, and prefer installing only the needed python-docx dependency in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:141

Finding

Unnecessary Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 141
Vulnerability Type: Unpinned and unnecessary third-party dependency
Risk Level: Low

Complete Code Snippet:

bash

# Ensure the Python environment is available
python3 --version
# ...
# Dependency instructions
pip install requests

Technical Analysis

The environment setup instructs the agent to install requests without a version constraint or package hash. The documented DOCX implementation imports Document from docx and does not use requests, so the package is unnecessary for the demonstrated local document-processing functionality.

Installing an unpinned package resolves its version and transitive dependencies from the currently configured package index at execution time. This prevents reproducible dependency verification and unnecessarily increases supply-chain exposure. Exploitation would require compromise or malicious substitution of the selected package, one of its transitive dependencies, or the configured package repository. The reviewed file does not itself specify a malicious repository or confirmed malicious package.

Attack Path

1. An agent follows the environment preparation instructions in SKILL.md.
2. The agent executes pip install requests using the environment's configured package index.
3. pip dynamically resolves the latest eligible package release and its transitive dependencies.
4. If the repository, selected release, or dependency chain has been compromised, attacker-controlled installation or package code may enter the environment.
5. Such code may execute during installation or when the installed package is later imported or invoked.

Impact Assessment

Successful exploitation could execute code with the privileges of the user or agent running pip. The resulting access could include files, environment variables, credentials, and network capabilities available to that account. It doe ...[truncated 387 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove pip install requests because the documented DOCX example does not use the package.
2. Declare only the required python-docx dependency in a dedicated, reviewed dependency manifest.
3. Pin each required dependency and its transitive dependencies to audited versions.
4. Use hash verification, such as pip install --require-hashes -r requirements.txt, to prevent installation of unverified artifacts.
5. Install dependencies from a trusted, explicitly configured package index.
6. Perform installation in an isolated virtual environment or container under a non-privileged account.
7. Apply automated dependency vulnerability and provenance scanning before publishing updated Skill instructions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises document processing but does not clearly warn that it can create and modify local Word files using write and exec capabilities. In this context, omission of that warning is dangerous because users may invoke the skill expecting passive assistance while the agent has authority to alter local files or execute supporting commands.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest repeatedly describes this skill as a free/basic Word document tool focused on creation, reading, editing, formatting, templates, TOC generation, and single-task personal use. Line L092 explicitly says the core capability supports '创建/查询/修改/删除' modes, introducing deletion behavior that is not described elsewhere and conflicts with the stated feature set.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad, generic requests such as creating or reading a Word document, which can cause the skill to activate in many normal conversations without clearly signaling that local file write/exec behavior may occur. In a skill with read/write/exec tools, ambiguous activation increases the chance of unintended document modification or file access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill's user-facing name, description, instructions, examples, and outputs are entirely Chinese, but there is no statement that the skill is intended only for Chinese-speaking users or that other languages are unsupported. This can violate language/locale policy expectations when a skill effectively forces one language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.