Word Reader

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:25 PM UTC
• Version: 1.0.0

Overview

The skill appears to read Word documents as advertised, but its installer can make system-level package changes and its outputs may save sensitive document contents without strong warnings.

Review the installer before running it. Prefer installing dependencies in a virtual environment, avoid --break-system-packages, and only use sudo or antiword if you specifically need legacy .doc support. Treat extracted text, metadata, and batch output files as potentially sensitive, especially when processing business or personal documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: install.sh:44
• Finding: Unpinned Python Dependency Installed into the System-Managed Environment## Vulnerability Details **File Location**: `install.sh:44-48` **Vulnerability Type**: Unpinned third-party dependency installation and bypass of system package protections **Risk Level**: Medium **Vulnerable Code**: ```bash if python3 -m pip install python-docx --break-system-packages 2>/dev/null; then echo " ✅ python-docx installation completed" elif python3 -m pip install python-docx 2>/dev/null; then echo " ✅ python-docx installation completed" else ``` ### Technical Analysis The installation script downloads `python-docx` without specifying an audited version or verifying an integrity hash. The effective dependency content may therefore change between installations as package releases change. The preferred installation command also passes `--break-system-packages`. This option bypasses protections intended to prevent pip from modifying a Python environment managed by the operating system. Installing directly into that environment can replace or conflict with packages used by unrelated system applications. Related unpinned installation instructions also appear in `SKILL.md:17-23`, `SKILL.md:209-213`, `README.md:24-26`, and `skill.json:20-23`. ### Attack Path 1. A user executes `install.sh` to install the Skill. 2. The script asks pip to resolve the current `python-docx` package without a version constraint or integrity hash. 3. If the dependency source or a newly published dependency artifact has been compromised, pip downloads the affected artifact. 4. Package installation code runs with the privileges of the user executing the installer. 5. Because the preferred command uses `--break-system-packages`, the package is permitted to modify the system-managed Python environment. 6. Malicious dependency code can subsequently execute when `scripts/read_word.py` imports the `docx` module. This is a supply-chain exposure rather than evidence that the currently named package is m ...[truncated 610 chars]
• Remediation: ## Remediation Suggestions 1. Pin `python-docx` and its transitive dependencies to reviewed versions. 2. Record cryptographic hashes in a requirements lock file and install with hash enforcement: ```bash python3 -m venv .venv .venv/bin/python -m pip install --require-hashes -r requirements.txt ``` 3. Remove `--break-system-packages` and use a dedicated virtual environment so the Skill cannot alter the operating system's managed Python packages. 4. Use a trusted, explicitly configured package index and retain dependency artifacts or a lock file for reproducible installations. 5. Apply the same pinned installation instructions consistently in `SKILL.md`, `README.md`, and `skill.json`. 6. Run dependency vulnerability and provenance checks before publishing each release.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation encourages extraction of Word text, tables, metadata, and batch output without warning that documents may contain sensitive content and embedded metadata such as author names and timestamps. In practice, users may inadvertently expose confidential information in console logs, saved result files, or downstream systems, especially in batch-processing workflows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file documents bulk extraction of Word documents and writing the results to JSON/Markdown files, including document metadata such as author and timestamps. Because these operations can expose sensitive user data at scale, the skill description should explicitly warn users that extracted content and metadata may contain confidential information and will be written to disk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises shell execution and likely file-writing behavior via installation and output features, but it declares no explicit tool scope or permissions. In agent environments, missing scope boundaries can cause the skill to be invoked with broader capabilities than users expect, increasing the chance of unintended command execution or file modification.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

{
              "id": "system",
              "kind": "system",
              "command": "sudo apt-get install antiword -y",
              "label": "Install antiword for .doc support (optional)",
              "platform": "linux-debian"
            }

• Confidence: 95% confidence
• Finding: The embedded install command explicitly uses sudo to install a system package. Even though this appears intended for dependency setup, privileged shell commands are sensitive because they modify the host environment and, if copied into automated workflows, can expand the blast radius of a compromised or misused skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill includes privileged installation instructions using sudo without an explicit warning about system-level changes. In an agent or semi-automated environment, this can normalize elevated command execution and lead users to run root-level package installation without evaluating trust, provenance, or platform impact.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This skill is designed to extract full document text, tables, and metadata from Word files, which commonly contain confidential business or personal data. Omitting a privacy warning increases the risk that users process sensitive documents without understanding exposure, retention, or downstream sharing implications.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

对于 .doc 格式支持：
```bash
# Ubuntu/Debian
sudo apt-get install antiword

# macOS
brew install antiword

• Confidence: 94% confidence
• Finding: The troubleshooting section repeats a sudo-based package installation command without cautionary context. Repetition of privileged commands in user-facing documentation increases the likelihood of unsafe copy-paste execution and reinforces elevated access as normal operating procedure.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: All user-facing comments and output strings in the script are in Chinese, and the file provides no language selection, opt-in, or justification for being locale-specific. This is a natural-language policy issue because it imposes a specific language on users rather than offering a choice.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The demo script conditionally changes permissions on the skill's Python file with `chmod +x`, which is a filesystem modification outside the stated read/extract-only Word parsing purpose. While this targets a local skill file rather than arbitrary user input, it still violates least privilege and can normalize self-modifying installer behavior in a demo script.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The `.doc` path processes untrusted documents by invoking an external system binary (`antiword`), which increases attack surface beyond pure in-process parsing. If `antiword` has memory-safety or parser vulnerabilities, a crafted `.doc` file could trigger code execution or process compromise in the context running the skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            # 检查 antiword 是否可用
            result = subprocess.run(['which', 'antiword'], 
                                  capture_output=True, text=True)
            if result.returncode != 0:
                raise Exception("antiword 未安装。请安装 antiword: Ubuntu/Debian: sudo apt-get install antiword; macOS: brew install antiword")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

raise Exception("antiword 未安装。请安装 antiword: Ubuntu/Debian: sudo apt-get install antiword; macOS: brew install antiword")
            
            # 使用 antiword 转换
            result = subprocess.run(['antiword', str(self.file_path)], 
                                  capture_output=True, text=True, encoding='utf-8')
            
            if result.returncode != 0:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest describes a reader/extractor for Word documents, which implies analyzing existing files and returning their contents. In batch mode, the script persists aggregated results to a user-specified file, adding file-write behavior beyond simple document reading.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: In batch mode, the code opens the output path for writing and serializes all extracted results, which may include full document text and metadata. Although the code prints a success message afterward, it does not disclose beforehand that it will persist potentially sensitive content or overwrite the specified file.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The stated purpose is reading and extracting text from Word documents, but this code writes transformed content to a separate output file when requested. That is a broader behavior than a pure reader and should be reflected in the declared skill scope.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code writes the processed document output directly to the path provided by the user, and the extracted content can include full text, tables, image references, and metadata. There is no prior warning or confirmation that sensitive document contents will be stored locally or that an existing file may be replaced.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"installation": {
    "steps": [
      "pip3 install python-docx",
      "sudo apt-get install antiword  # 可选，支持 .doc 格式",
      "chmod +x scripts/read_word.py"
    ]
  },

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.