Word文档工具V1（免费版）

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward Word document helper, with ordinary file-writing and Python dependency risks users should manage carefully.

Install this only in a normal isolated Python environment, prefer pinned dependencies, and use explicit file paths when asking it to create or edit documents. Confirm before overwriting or deleting existing files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:137

Finding

Unpinned installation of the requests package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 137-141
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Evidence

bash

# Ensure the Python environment is available
python3 --version
# ...
# Dependency instructions
pip install requests

Technical Analysis

The skill instructs the agent to install requests without specifying an exact version, lock file, package hash, or trusted package-index configuration. Consequently, the artifact selected by pip can change between executions even though the reviewed skill remains unchanged.

If the package index, maintainer account, dependency resolution process, or one of the package's transitive dependencies is compromised, a future installation could retrieve attacker-controlled content. A malicious source distribution could execute code through its build process, while malicious installed package code could execute when imported.

There is no evidence that the legitimate requests package is currently malicious. The vulnerability is the non-reproducible and insufficiently verified dependency installation process.

Attack Path

1. An attacker compromises a relevant package publisher, package-index account, release channel, or transitive dependency.
2. The attacker publishes a malicious version that satisfies the unconstrained pip install requests command.
3. An agent follows the skill's environment-preparation instructions using its exec capability.
4. pip resolves and downloads the attacker-controlled release because no approved version or artifact hash is enforced.
5. Malicious code executes during package build or later package use with the permissions of the agent process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the operating-system account running the agent or installation command. This may permit access to documents, environment variables, API cre ...[truncated 199 chars]

Remediation

View remediation

Remediation Suggestions

• Remove requests if it is not required; the documented Word-generation example does not use it.
• Pin every direct and transitive dependency to an reviewed version in a lock file.
• Install with hash verification, for example through a fully hashed requirements file and pip install --require-hashes -r requirements.txt.
• Configure an approved package index or internal artifact mirror rather than relying on unrestricted resolver configuration.
• Install dependencies inside an isolated virtual environment or container under a non-privileged account.
• Add automated dependency vulnerability and provenance scanning.
• Document the exact tested dependency set and update it only through a reviewed process.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:222

Finding

Unpinned installation of the python-docx package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 222-226
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Evidence

markdown

| Dependency | Type | Required | Installation method |
|---:|---:|---:|---:|
| LLM API | API | Required | Provided by the agent's built-in LLM |
| python-docx | Python library | Required | pip install python-docx |

Technical Analysis

The required python-docx dependency is installed without an exact version, lock file, cryptographic artifact hash, or constrained package source. The resulting environment is therefore not reproducible: later executions may install package artifacts that were not present during the skill audit.

A compromised publisher account, package index, release pipeline, or transitive dependency could cause pip to resolve attacker-controlled code. Malicious build logic may execute while installing a source distribution. The skill's example subsequently imports docx, which could also execute malicious module initialization code if a compromised package were installed.

There is no evidence in the audited file that the legitimate python-docx package is currently malicious. The finding concerns the unsafe dependency acquisition and verification process.

Attack Path

1. An attacker gains the ability to publish or substitute a release in the dependency-resolution path for python-docx or one of its transitive dependencies.
2. The attacker supplies a malicious version that remains compatible with the unconstrained installation command.
3. The agent executes pip install python-docx while preparing the skill environment.
4. pip installs the malicious artifact because the skill specifies neither an approved version nor an expected hash.
5. Code executes during package build or when the documented from docx import Document operation imports the installed module.

Impact Assessment

Exploitation could res ...[truncated 403 chars]

Remediation

View remediation

Remediation Suggestions

• Pin python-docx and all transitive dependencies to reviewed versions.
• Generate and commit a deterministic lock file with cryptographic hashes.
• Require hash-verified installation, such as pip install --require-hashes -r requirements.txt.
• Restrict package retrieval to an approved index or controlled internal mirror.
• Prefer reviewed binary wheels where appropriate and prohibit unexpected source builds.
• Run document processing in an isolated, non-privileged environment with access limited to the required input and output directories.
• Scan dependency versions and artifacts for known vulnerabilities before updating the lock file.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes document creation and editing but does not clearly warn that it writes local files and may overwrite existing data. In context, the skill has write and exec access, so missing safety disclosures can lead users or orchestrators to trigger file-modifying behavior without understanding the consequences, increasing the risk of data loss.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases are broad everyday requests such as creating or editing a document, which increases the chance of accidental invocation in unrelated conversations. In an agent environment with write and exec capabilities, unintended activation can cause local file creation or modification without the user clearly consenting to tool execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Lines L225-L229 say 'LLM API' is required while also asserting '无需额外API Key' (no extra API key needed). These statements create an intent/documentation contradiction about whether external API-backed capability or credentials are necessary to use the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest/overview describes a basic Word document creation and editing tool focused on paragraphs, headings, lists, formatting, and page setup. Line L092 expands this to '创建/查询/修改/删除' operations, introducing destructive delete behavior not described elsewhere and contradicting the stated limited core feature set.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.