Word Template Filler

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches Word document automation, but it includes an overbroad debugging command that can force-close all open Word documents.

Install only in an isolated Python environment, consider pinning pywin32, and do not allow the agent to run the WINWORD.EXE taskkill command unless you have saved all Word documents and explicitly want every Word process closed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- **pywin32** (`pip install pywin32`)

Technical Analysis

The installation instruction retrieves pywin32 without specifying a reviewed version or verifying the package artifact with a cryptographic hash. Consequently, the installed code depends on whichever release the configured Python package index resolves at installation time.

An unpinned dependency is not inherently malicious, but it weakens build reproducibility and supply-chain controls. If the package distribution, maintainer account, package index, or local index configuration is compromised, a modified release could execute code during installation or when the skill imports and uses the package.

Attack Path

1. An attacker compromises the dependency's distribution channel, a package-index account, or a package source configured on the target.
2. The attacker publishes or serves a malicious pywin32 release that satisfies the unrestricted installation request.
3. A user follows the documented pip install pywin32 instruction.
4. pip downloads and installs the attacker-controlled artifact.
5. Malicious installation or runtime code executes under the privileges of the user or automation environment.

This path requires compromise or manipulation of the dependency supply chain; the project does not itself provide a malicious package source.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the account performing the installation or running the Word automation. That could expose files accessible to that account, alter generated documents, or compromise the automation environment. The instruction does not request elevation, so it does not directly grant administrative privileges.

Remediation

View remediation

Remediation Suggestions

• Pin pywin32 to a specific, reviewed version.
• Store dependencies in a lock file or requirements file with cryptographic hashes.
• Install packages only from an explicitly trusted package index.
• Review and test dependency updates before changing the pinned version.
• Use an isolated virtual environment with only the permissions required for document processing.
• Prefer a command such as python -m pip install --require-hashes -r requirements.txt, backed by a hash-locked requirements file.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:187

Finding

Forceful Termination of All Microsoft Word Processes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 187
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- Kill `WINWORD.EXE` between runs: `taskkill /f /im WINWORD.EXE`

Technical Analysis

The debugging guidance uses /f to force termination and /im WINWORD.EXE to select processes by executable image name. It therefore targets every accessible Microsoft Word process rather than only the COM instance created by the automation.

Forceful termination bypasses Word's normal document-closing workflow and may prevent users from saving open documents. It can also interrupt unrelated Word automation running under the same security context. The static command does not contain command injection, but its process-selection scope and forced behavior create an avoidable availability and data-integrity risk.

Attack Path

1. A user has one or more Word sessions open with unsaved documents, or another workflow is using Word automation.
2. The agent or operator follows the documented debugging instruction.
3. taskkill selects all accessible processes named WINWORD.EXE.
4. The /f option terminates those processes without a normal application shutdown.
5. Unsaved edits may be lost, document files may require recovery, and unrelated automation jobs may fail.

No privilege escalation is demonstrated. The command can terminate only processes that the invoking account is authorized to terminate unless it is run from an already elevated context.

Impact Assessment

The primary impact is local denial of service and potential loss or corruption of unsaved Word document state. The scope includes all accessible Word sessions on the affected Windows system, not merely the process launched by this skill. It does not provide persistence, remote execution, or additional privileges.

Remediation

View remediation

Remediation Suggestions

• Track the specific Word COM application instance created by the automation.
• Close opened documents explicitly and call word.Quit() during normal cleanup.
• Put cleanup logic in a finally block so it runs after errors.
• Release COM references deterministically after closing the application.
• If a hung process must be terminated, identify and target only the process ID associated with the automation instance.
• Require explicit user confirmation before forcibly terminating a process.
• Warn users to save open documents before any emergency process termination.
• Do not use image-name-wide termination as routine between-run cleanup.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The markdown examples and guidance hard-code Chinese punctuation and headings such as 。？, ！？, 序号/名称/功能, and C2.转向架, implying the skill is tailored to Chinese-language templates. Because the file presents the skill as general-purpose document automation without clearly stating a Chinese-only scope or offering locale choice, this can violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.