Security audit

Office Automation

Security checks for vulnerabilities and agentic risk

Overview

This office automation skill appears purpose-aligned, but it can make broad local file changes with weak safeguards and unclear bounds.

Review this skill before installing. Use it only on backed-up copies of documents, avoid untrusted rename patterns, and do not run bulk replacements or renames on important folders without first testing on sample files. Treat the advertised email feature as unsupported in the inspected code unless a separate implementation is provided.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: office_automation.py:115
Finding: Path Traversal in Batch Rename Pattern Allows Files to Be Moved Outside the Input Directory
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: office_automation.py:42
Finding: Unpinned Runtime Dependencies Create Supply-Chain and Reproducibility Risk
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: openpyxl== \ --hash=sha256: pypdf== \ --hash=sha256: python-docx== \ --hash=sha256: ``` Hashes and versions must be generated from reviewed artifacts rather than copied from an unverified source. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill advertises capabilities that would modify files, but the manifest does not declare any tool scope or permissions boundary. That makes the operational surface ambiguous and can lead users or the platform to run file-writing behavior without explicit least-privilege constraints, increasing the risk of unintended file modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes bulk renaming and batch document processing without warning that files may be overwritten or irreversibly changed. In this context, users may run operations across many files at once, so mistakes in patterns or replacements can cause widespread data loss or corruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill includes automated bulk email sending but does not warn that messages may be sent automatically to real recipients or that recipient data may be processed. This can cause accidental mass mailing, privacy violations, spam/compliance issues, and unintended disclosure if users run it with incorrect data or configuration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The Word batch replacement function saves changes directly back to the original .docx files, permanently modifying user documents in place. In an automation skill, this creates a real integrity risk because a mistaken search/replace string, formatting side effect, or library parsing issue can irreversibly alter many files at once without backup, dry-run, or explicit confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Natural-language strings throughout the script, including the top-level description and command-line help, are presented only in Chinese. This can violate language/locale policy when a skill forces a specific language without user opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.