pdf-ppt-docx-xlsx-tools

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:45 PM UTC
• Version: 1.0.0

Overview

This is a local document-conversion skill that runs expected conversion commands and writes output files, with no evidence of hidden network access, credential use, persistence, or destructive behavior.

Install this for local document conversion, not for general document Q&A. Use a virtual environment, install LibreOffice and Python packages from trusted sources, keep backups of important files, choose explicit output paths, and avoid opening generated HTML from untrusted DOCX files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 尝试 which/where
    for cmd in ["where soffice", "which soffice", "which libreoffice"]:
        try:
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            if result.returncode == 0 and result.stdout.strip():
                return result.stdout.strip().split("\n")[0]
        except Exception:

• Confidence: 91% confidence
• Finding: result = subprocess.run(cmd, shell=True, capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return path
    for cmd in ["where soffice", "which soffice", "which libreoffice"]:
        try:
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            if result.returncode == 0 and result.stdout.strip():
                return result.stdout.strip().split("\n")[0]
        except Exception:

• Confidence: 94% confidence
• Finding: result = subprocess.run(cmd, shell=True, capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return path
    for cmd in ["where soffice", "which soffice", "which libreoffice"]:
        try:
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            if result.returncode == 0 and result.stdout.strip():
                return result.stdout.strip().split("\n")[0]
        except Exception:

• Confidence: 95% confidence
• Finding: result = subprocess.run(cmd, shell=True, capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return path
    for cmd in ["where soffice", "which soffice", "which libreoffice"]:
        try:
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            if result.returncode == 0 and result.stdout.strip():
                return result.stdout.strip().split("\n")[0]
        except Exception:

• Confidence: 94% confidence
• Finding: result = subprocess.run(cmd, shell=True, capture_output=True, text=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly enables shell execution and file-writing behavior through numerous `python -c`, `pip install`, and `soffice` command examples, yet it declares no permissions. That mismatch weakens policy enforcement and informed consent, because a caller may invoke a skill that can write, convert, overwrite, or generate files without the manifest explicitly advertising those capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documentation repeatedly instructs the agent to use `execute_command` with arbitrary shell commands and inline Python, effectively turning a document-conversion skill into a general code-execution surface. In an agent setting, this is dangerous because user-controlled filenames, paths, glob patterns, and expressions can be threaded into commands, increasing the chance of command misuse, destructive file operations, or execution beyond the skill's intended scope.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The script discovers and invokes an external converter binary, which expands the trust boundary to the local environment and any installed LibreOffice executable. In the context of an agent skill that may process untrusted files on varied hosts, this becomes more dangerous because executable discovery is environment-dependent and the external application may itself be exposed to malicious document payloads.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger description is broad enough to match many ordinary requests about documents, PDFs, or Office files, which can cause unintended activation. In context, accidental invocation is meaningful because this skill performs write-heavy and transformation operations, so misrouting a request could create, overwrite, or modify local files without the user specifically intending to use this toolchain.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill includes many operations that generate output files, merge content, split documents, and alter documents with watermarks, but it does not prominently warn about overwrite risks, output sprawl, or modification side effects. This is dangerous in an agent workflow because users may assume analysis-only behavior while the skill actually performs persistent filesystem changes across many files.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.