Word文档工具V102（免费版）

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

This is a Word document helper whose file writes and Python use fit its purpose, but users should keep control of output paths and dependency installation.

Install only if you are comfortable letting the agent run Python and create or edit DOCX files. Use a virtual environment, pin dependencies where possible, specify exact input and output paths, and ask for confirmation before overwriting or deleting documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:142

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:142
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

pip install requests

Technical Analysis

The Skill directs the Agent to install requests from the environment's default Python package index without specifying an exact version, integrity hash, or trusted repository. The package is also not used by the documented local DOCX example, making this an unnecessary expansion of the dependency and attack surface.

An unpinned installation can resolve to a package version or transitive dependency that was not present when the Skill was reviewed. If a package release, dependency, configured package index, or source-build backend is compromised, attacker-controlled code may execute during package installation or subsequent import.

Attack Path

1. An attacker compromises a future package release, one of its transitive dependencies, or a package index trusted by the execution environment.
2. The Agent follows the environment preparation instructions and runs pip install requests.
3. pip dynamically resolves and downloads the currently available package and dependencies without validating project-approved hashes.
4. A malicious source-build backend may execute during installation, or malicious package code may execute when imported.
5. The payload operates with the privileges and environmental access of the user running the Agent.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. The accessible scope may include files, environment variables, credentials, network resources, and Agent workspace data available to that user. No evidence of an actively malicious package or deliberate exploitation was found in the audited project.

Remediation

View remediation

Remediation Suggestions

1. Remove the requests installation instruction unless an implemented and documented feature requires it.
2. If required, pin it and all transitive dependencies to reviewed versions in a lock file.
3. Require package hashes, such as through pip install --require-hashes -r requirements.txt.
4. Use an organization-controlled package mirror or explicitly trusted package index.
5. Install dependencies in an isolated virtual environment under a non-privileged account.
6. Perform dependency vulnerability and provenance scanning before approving updates.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:227

Finding

Unpinned Required DOCX Processing Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:227
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

text

| python-docx | Python library | Required | pip install python-docx |

Technical Analysis

The dependency documentation instructs users or Agents to install python-docx without an exact version, integrity hash, or controlled source. Consequently, each installation may resolve to a different release and set of transitive dependencies than those reviewed by the Skill author.

The package name itself is consistent with the legitimate python-docx project; there is no evidence of typosquatting in the audited file. The risk arises from unrestricted dependency resolution and the absence of integrity controls. A compromised release, transitive dependency, package index, or source-build process could introduce executable code into the Agent environment.

Attack Path

1. An attacker compromises a future python-docx release, a transitive dependency, or a package repository used by the target environment.
2. A user or Agent follows the documented dependency instructions and runs pip install python-docx.
3. pip retrieves the latest resolvable artifacts without comparison against approved versions or cryptographic hashes.
4. Malicious build logic may execute during installation, or malicious library code may execute when the DOCX workflow imports the package.
5. The payload gains the same effective privileges and resource access as the Agent process.

Impact Assessment

Exploitation could result in arbitrary code execution under the installing user's account, potentially exposing documents, workspace files, environment variables, local credentials, and reachable services. The project does not contain an embedded malicious implementation, and the audit found no evidence that the currently published dependency is malicious.

Remediation

View remediation

Remediation Suggestions

1. Pin python-docx and its transitive dependencies to reviewed versions in a lock file.
2. Record and enforce cryptographic hashes with pip --require-hashes.
3. Retrieve packages only from an approved package index or controlled internal mirror.
4. Install dependencies in a dedicated virtual environment using a non-privileged account.
5. Scan locked dependencies for known vulnerabilities and review provenance before updates.
6. Establish a controlled update process rather than resolving the latest available package during each Skill invocation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation claims support for create/query/modify/delete-style operations and runtime configuration, but it does not warn users about data modification, loss, or irreversible changes. In a skill that includes write and exec tools, omission of change-risk disclosures can lead to unsafe execution against user documents or workspaces.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example trigger phrases are broad, generic document-editing requests such as applying formatting, enabling track changes, or adding comments. In an agent environment with read/exec/write capabilities, such vague triggers can cause the skill to activate during ordinary conversation and perform file modifications without sufficiently explicit user intent or confirmation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states it is driven by natural-language instructions but does not define boundaries, supported intents, or disallowed operations. This increases the chance of overbroad matching and unintended invocation, especially because the skill advertises MD+EXEC operation and can potentially translate casual requests into file-changing actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

该技能的名称、说明、示例和操作文案均固定为中文，且未向用户提供语言/locale 选择，也未说明该技能仅面向特定中文场景。按自然语言策略要求，若技能强制特定语言而无用户选择或明确合理限定，属于语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The example code saves output to a fixed filename and demonstrates write behavior without warning about overwriting files or where output will be stored. While the snippet itself is simple, in agent-assisted contexts it normalizes file writes without guardrails and may cause accidental data loss or confusion about destination paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.