Office Oxide MCP Server

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 0.2.0

Overview

The skill is a coherent Office-document MCP integration, but its install instructions fetch an unpinned external executable that will run locally with document access.

Install only if you trust the publisher and distribution channel. Prefer a pinned, reviewed version, use `--locked` where available, verify release artifacts if checksums are provided, and run it only on document folders you intend to expose. Review generated or modified Office/PDF files before sharing, especially forms containing personal or business information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Executable Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-20; duplicated in references/README.md:17-22
Vulnerability Type: Unpinned executable dependency installation
Risk Level: Medium

Complete Code Snippet

From SKILL.md:15-20:

markdown

## Quick Start

```bash
cargo install office-oxide-mcp

Or download the latest release.

text

The equivalent installation guidance appears in `references/README.md:17-22`:

```markdown
## Quick Start

```bash
cargo install office-oxide-mcp

Or download from GitHub Releases.

text

### Technical Analysis

The documented `cargo install office-oxide-mcp` command does not pin the dependency to the Skill's declared version, `0.2.0`. It installs whichever package version the registry currently resolves as the latest compatible release. The alternative recommendation to download the latest GitHub release similarly provides no version pinning, checksum, or signature-verification procedure.

This creates a supply-chain trust gap between the artifact reviewed during this audit and the executable ultimately installed by a user. If the package publisher, registry account, source repository, release workflow, or latest release is compromised, the command could retrieve and compile attacker-controlled code that was not part of the audited Skill package.

The installed program is subsequently configured as an MCP server:

```json
{
  "mcpServers": {
    "office": {
      "command": "office-oxide-mcp",
      "args": ["--transport", "stdio"]
    }
  }
}

Consequently, it runs as a local executable with the privileges of the user hosting the MCP client. Although installation of an executable is necessary for the declared document-processing functionality, selecting an unpinned latest version exceeds the minimum supply-chain trust ...[truncated 2102 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to the version declared by the Skill:

   bash

   cargo install office-oxide-mcp --version 0.2.0 --locked
   

2. Review and test the exact pinned release before recommending it. Update the Skill version and installation command together through a controlled release process.

3. Publish cryptographic SHA-256 checksums for prebuilt release artifacts and document verification before execution:

   bash

   sha256sum -c office-oxide-mcp-SHA256SUMS
   

4. Prefer signed releases or build provenance, such as Sigstore attestations, and require users to verify the signature against a documented trusted identity.

5. Avoid wording such as “latest release.” Link to an immutable versioned release and clearly identify the expected artifact name, platform, checksum, and signer.

6. Run the MCP executable with least privilege. Restrict it to dedicated document directories where feasible, avoid administrator or root execution, and isolate network access if local-only processing does not require outbound connectivity.

7. Document that Office and PDF files may contain sensitive information and require explicit user approval before exposing files or directories to the MCP server.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file describes write-capable behaviors including creating XLSX/DOCX/PPTX files, filling PDF forms, and overlaying text onto PDFs. Under the markdown criteria for missing user warnings, skills that can affect user data or document integrity should disclose those risks, but no warning or caution is provided anywhere in the description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README prominently encourages filling and generating PDFs and Office documents, including forms containing personal data such as name, address, and date of birth, but does not warn users that these operations create or overwrite files with sensitive contents. In an MCP/agent context, this omission can lead to unsafe automation, accidental persistence of regulated data, or writing sensitive outputs to insecure locations without informed user consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.