docx-writer

• Outcome: Review
• Latest audit: Sep 30, 2026 · 7:26 PM UTC
• Version: 1.2.1

Overview

The skill is a coherent Word document generator, but it needs review because it can compile user-provided LaTeX with local tools without a clear sandbox or strict input limits.

Install only if you trust the documents and formulas you will process. Avoid running it on untrusted LaTeX or third-party content unless you can isolate execution in a container or restricted workspace, and review its Chinese-specific formatting defaults before relying on it for non-Chinese documents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence

Finding

代码的总体方向与声明相近：确实是在根据结构化内容生成 Word 文档，并支持图片、表格、公式、分页等学术/排版相关元素，因此不是完全无关的技能。但声明包含若干更具体的实现与能力主张，和代码片段可验证的内容不一致。首先，描述明确声称使用 bayoo-docx 和 template.docx，而代码实际导入并调用的是 docx_engine.Template/Builder，模板也是由输入参数或内容文件中的 template 字段决定，并非固定 template.docx。其次，描述中特别强调可输出 Word 原生可编辑公式 OMML 或 XeLaTeX 渲染图；然而此片段仅把 latex 文本与相关参数转交给 Builder，无法从片段本身确认这些具体输出形式。脚注也是类似情况：代码支持向 Builder 传 fn_map，但“原生脚注支持”仍属于外部引擎能力，当前片段未直接体现。综合看，主用途基本一致，但描述对底层实现和若干具体能力的表述超出了代码片段可证实范围，属于描述与行为部分不符。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documentation is written entirely in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes capabilities that involve shell execution, reading environment variables, and file read/write behavior, but it declares no explicit tool scope or permissions boundary. In an agent setting, this increases the chance the skill is invoked with broader-than-necessary authority, enabling unintended command execution or access to local data during document generation workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This is a markdown file, so vague-trigger review applies. The description says to use the skill whenever a user wants to generate or format Word documents, theses, lab reports, news releases, posts, or speeches, which is a very broad natural-language trigger without explicit exclusions or tighter scope boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language description and the rest of the document prescribe Chinese typographic, citation, and academic formatting conventions as the default behavior. Because the skill does not present this as an opt-in locale-specific mode or offer alternatives, it can violate language/locale policy by forcing a specific locale.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

| 类型 | 路径 | 生命周期 |
|------|------|----------|
| SKILL 本体 | `skills/docx-writer/SKILL.md` | 长期 |
| 标准基底 | `skills/docx-writer/template.docx` | **不修改** |
| 模板配置 | `skills/docx-writer/templates/*.yaml` | 长期（可新增） |
| 持久脚本 | `skills/docx-writer/scripts/` | 长期 |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

These entries describe a forced formatting rule that requires Chinese quotation marks and Chinese-font handling as a mandatory standard. In this markdown log, there is no indication that the behavior is optional, user-selectable, or limited to a clearly justified region-specific workflow, which can conflict with language/locale choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains natural-language guidance, comments, and example usage in Chinese only, which effectively forces a specific language for operators reading the skill. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified; neither is present here.

Content

No source excerpt is available for this finding.

Tainted flow: 'tmp' from os.environ.get (line 366, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/docx_engine.py (reported line 367)May include surrounding context.

python

im = Image.open(io.BytesIO(data)).convert('RGB')
        except Exception:
            tmp = os.path.join(os.environ.get('TEMP', '.'), 'dw_%d.jpg' % id(data))
            with open(tmp, 'wb') as f:
                f.write(data)
            return tmp
        buf = io.BytesIO()

Tainted flow: 'tmp' from os.environ.get (line 366, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/docx_engine.py (reported line 375)May include surrounding context.

python

im = Image.open(io.BytesIO(data)).convert('RGB')
        except Exception:
            tmp = os.path.join(os.environ.get('TEMP', '.'), 'dw_%d.jpg' % id(data))
            with open(tmp, 'wb') as f:
                f.write(data)
            return tmp
        buf = io.BytesIO()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/latex_formula.py (reported line 94)May include surrounding context.

python

with open(md, "w", encoding="utf-8") as f:
            f.write(tex + "\n")
        out = os.path.join(work, "o.docx")
        p = subprocess.run([pd, "-f", "markdown", "-t", "docx", "-o", out, md],
                           timeout=timeout, stdout=subprocess.PIPE,
                           stderr=subprocess.STDOUT)
        if p.returncode != 0:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This code passes untrusted LaTeX content directly to xelatex, which is a powerful compiler capable of reading local files and, depending on TeX configuration, invoking external commands or abusing TeX primitives for file exfiltration and denial of service. In this skill context, users are expected to supply arbitrary formulas, so the attack surface is materially increased: a malicious formula can target the host environment during document generation.

Content

Scanner excerpt · scripts/latex_formula.py (reported line 176)May include surrounding context.

python

cmd = [xe, "-interaction=nonstopmode", "-halt-on-error",
                   "-output-directory=" + work, texfile]
            for _ in range(2):  # preview 依靠 .aux 计算紧裁框，需第二遍
                p = subprocess.run(cmd, cwd=work, timeout=timeout,
                                   stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
                if p.returncode != 0:
                    log = p.stdout.decode("utf-8", "replace")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description labels this as a standard academic template in Chinese, indicating a locale-specific default. This is reinforced throughout the file by Chinese font settings, but the file does not state that the template is region-specific or offer any user opt-in or language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file’s natural-language metadata and style settings prescribe a specific Chinese news format and Chinese font defaults (e.g. '清华新闻网体例', 黑体, 楷体, 宋体) without indicating that this locale/style is optional or limited to a region-specific use case. This can be a language/locale policy concern because it implicitly enforces a specific locale presentation rather than offering user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file states it is a template for WeChat public-account posts and is based on a specific Chinese publishing standard, then defines Chinese fonts and formatting throughout. This imposes a locale/language-specific output convention, and the file does not present it as an optional or user-selectable locale choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This manifest-like YAML file describes the template simply as 'script' and shows usage as Template.load('script'), which is a highly generic term that overlaps with common development and writing contexts. There are no constraints, negative examples, or scope limitations clarifying when this template should be selected versus other templates.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.