Word Studio

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:06 AM UTC
• Version: 1.0.3

Overview

This skill generates Word documents locally and has some ordinary installation and file-output cautions, but I found no hidden persistence, credential access, exfiltration, or destructive behavior.

Install in a normal isolated environment, prefer .docx output, and review where generated files will be written. Treat the templates as document-generation helpers, not legal, academic, financial, or government compliance advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Remediation

View remediation

Pillow== ``` 2. Generate and verify cryptographic hashes for every direct and transitive dependency, then install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lockfile or fully resolved requirements file so transitive dependencies are also pinned. 4. Configure installation to use an approved package index or internally controlled mirror. 5. Review dependency updates before changing pinned versions and enable automated vulnerability monitoring. 6. Install dependencies inside an isolated virtual environment or container under a non-privileged account. 7. Avoid running package installation as `root` or with administrative privileges. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description omits important side effects: it writes files to the local workspace and may delete temporary files during .doc conversion. In an automated agent environment, undisclosed filesystem modifications reduce informed consent and can surprise users or orchestrators, increasing the risk of unintended data handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to catch ordinary writing-assistance requests, causing the skill to activate in situations where the user may only want text help rather than local file generation. In an agent setting, this can lead to unintended file creation and execution of Python-based generation steps without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a professional Word document generator, but this code path spawns an external process via subprocess.run to call soffice. Executing system binaries is not an obvious requirement of a Word authoring skill and materially expands capability beyond in-process document creation.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script is documented as a working template for generating documents, yet the execution path invokes create_document(config), which is not defined anywhere in the file. This contradicts the implied intent of the example as runnable generation code and misrepresents what the code actually does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation states 图片不存在 → 跳过图片，添加占位符, implying a visible placeholder will be inserted when an image is missing. In the actual implementation, the image branch only checks os.path.exists(img_path) and does nothing if the file is absent, so the documented behavior contradicts the code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document specifies Chinese fonts, Chinese字号 conventions, and Chinese government-document formatting as normative standards, which can function as a locale-specific requirement. Because the file does not indicate that these standards are optional, region-specific, or user-selected, it may violate the policy against forcing a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file presents many template names primarily in Chinese, with bilingual section headers, but does not explain whether the skill supports multiple languages by user choice or expects Chinese usage by default. Under the policy rule for language/locale constraints, this can be read as a locale assumption that is not explicitly opt-in or justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.