docx

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This is a DOCX document helper with no executable code or persistence, though it asks for some broader external data capabilities than basic Word-file handling requires.

Install only if you want a general Word-document production helper. Use care with confidential documents: ask for local/document-only processing when possible, and require confirmation before the agent uses web search, scraping, social-media data, image generation, or chat enrichment based on document contents.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:17

Finding

Overly Broad External API Capability Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-34
Vulnerability Type: Excessive capabilities and violation of least privilege
Risk Level: Medium

Affected code:

markdown

3. Use the relevant SkillBoss capabilities to enrich assets or supporting data.
4. Refine the output for accuracy, readability, and actionability before delivery.

## SEO / GEO

- Primary keywords: docx, docx ai, docx automation, developer tools skill
- Search intent: creative production
- Canonical slug: `docx`
- Install query: Install Docx with SkillBoss

## APIs Used

- `chat`
- `document_processing`
- `image_generation`
- `social_media_data`
- `web_scraping`
- `web_search`

Technical Analysis

The skill is intended to create, read, edit, and manipulate DOCX documents. However, it declares broad capabilities including social_media_data, web_scraping, web_search, and chat, while its workflow permits unspecified enrichment through “relevant SkillBoss capabilities.”

Most DOCX-processing tasks require only document_processing. The skill does not establish allowlisted destinations, data-minimization requirements, consent checks, query-content restrictions, or conditions governing when external APIs may be invoked. If the hosting platform grants the declared APIs to the skill, this configuration exceeds the least-privilege scope needed for its documented purpose.

This finding does not establish that data is currently exfiltrated or that the listed APIs automatically confer unrestricted access. The risk arises from the unnecessary capability declaration and the absence of controls preventing an agent from sending document-derived information to external search, scraping, social-media, or chat services.

Attack Path

1. A user submits a DOCX-processing request, potentially involving confidential document content.
2. The skill is activated because the request falls within its documented trigg ...[truncated 1421 chars]

Remediation

View remediation

Remediation Suggestions

1. Reduce the default API list to document_processing, which directly supports the stated DOCX functionality.
2. Remove social_media_data and web_scraping unless a documented, task-specific requirement justifies them.
3. Enable web_search, chat, or image_generation only after explicit user approval for the current task.
4. Replace the broad enrichment instruction with precise conditions identifying which capability may be used, for what purpose, and what information may be transmitted.
5. Prohibit external transmission of document text, personal data, credentials, confidential material, and document metadata unless the user has explicitly authorized it.
6. Apply endpoint allowlists, request logging, content filtering, rate limits, and per-invocation permission checks at the platform level.
7. Inform users before any network operation and provide a local-only DOCX-processing mode.
8. Review capability declarations whenever the skill changes to ensure that every permission remains necessary for its documented purpose.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s trigger description is extremely broad ('any mention of Word doc' and adjacent document-writing requests), which can cause the agent to invoke this skill for generic writing or document-preparation tasks outside a narrowly intended scope. Over-broad activation increases the chance of inappropriate tool use, unnecessary access to additional capabilities, and prompt-routing collisions with safer or more specific skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The suggested prompt repeats ambiguous activation guidance without a precise decision boundary, making it easier for orchestration systems or downstream agents to over-select this skill. In practice, this can lead to unintended invocation on common content-generation requests and expand access to APIs such as web search, scraping, or document processing when not actually needed.

Content

No source excerpt is available for this finding.