Superdoc

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:51 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent SuperDoc DOCX helper; its main risks are ordinary document file writes and npm installation hygiene, not hidden or malicious behavior.

Before installing, treat this as a document-editing helper that can read and write local DOCX files. Use copies or backups for important documents, keep generated files in a deliberate output folder, protect client data such as names and email addresses, and prefer pinned project-local npm dependencies over global unpinned installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:105

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:105, SKILL.md:129, and references/superdoc-reference.md:6
Vulnerability Type: Unpinned npm dependencies and global package installation
Risk Level: Medium

Vulnerable Code

SKILL.md:105:

bash

npm install --global superdoc jsdom

SKILL.md:129:

bash

npm install @superdoc-dev/react

references/superdoc-reference.md:6:

markdown

**Installation:** `npm install superdoc` (for projects) or `npm install @superdoc-dev/react` (for React)

Technical Analysis

The installation instructions do not pin the packages to exact, reviewed versions and do not require lockfile or integrity verification. Consequently, npm resolves whichever package releases and transitive dependencies are current when the commands are executed. This makes the installed code mutable after the skill has been audited.

The global installation command presents additional risk because it modifies the user's global Node.js environment. npm packages can define installation lifecycle scripts, which may execute with the permissions of the user running npm. If a named package, its publisher account, or one of its transitive dependencies is compromised in the future, following these instructions could execute attacker-controlled code.

The package names correspond to the documented SuperDoc packages, and the project does not contain evidence of dependency confusion, typosquatting, a malicious source, or an existing malicious payload. The finding concerns unsafe dependency acquisition practices and the resulting supply-chain exposure.

Attack Path

1. A user follows the documented installation command.
2. npm resolves the latest available versions of the named packages and their transitive dependencies.
3. A package publisher account, package release, or transitive dependency has been compromised or contains a malicious lifecycle script.
4. npm downloads th ...[truncated 930 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact reviewed version, such as superdoc@1.17.0, rather than allowing npm to select a mutable latest release.
2. Specify and review an exact compatible version of jsdom and @superdoc-dev/react.
3. Prefer project-local dependencies over global installation:

   bash

   npm install --save-exact superdoc@1.17.0 jsdom@REVIEWED_VERSION
   npm install --save-exact @superdoc-dev/react@REVIEWED_VERSION
   

4. Commit a reviewed package-lock.json and direct users or automation to run npm ci, ensuring reproducible dependency resolution.
5. Verify npm package provenance, publisher identity, registry source, and integrity metadata before installation.
6. Audit direct and transitive dependencies with appropriate software-composition-analysis tooling.
7. Where compatible with the packages' documented installation process, disable lifecycle scripts using npm ci --ignore-scripts and explicitly run only reviewed setup steps.
8. Execute dependency installation in a minimally privileged, isolated development environment rather than under an administrative account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown example generates personalized documents from client data including names and email addresses, which can involve sensitive or personal information. The skill description does not warn users about protecting input data, securing generated files, or validating output destinations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes code examples that save generated documents directly with fs.writeFileSync, which affects user data on the local filesystem. The surrounding skill description explains document creation/editing, but it does not warn users about file writes, overwrites, or choosing safe output paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown demonstrates loading an existing DOCX, modifying text, and writing a new output file, but provides no user-facing warning about handling potentially sensitive document contents or reviewing changes before saving. For a skill that edits user documents, a caution about data integrity and backup/review is expected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.