T08 · Insecure Dependencies
Note
- Location
scripts/apply_format.py:363- Finding
Unpinned Third-Party Dependency Installation Guidance
- Content
View full analysis
- Remediation
View remediation
Security audit
文档格式刷
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed local document-formatting helper that reads user-selected documents and writes formatted outputs, with no evidence of hidden persistence, network access, credential use, or destructive behavior.
Install this only if you want a Chinese-oriented document formatting/conversion helper. Run it on documents you choose, review output paths before use, and install python-docx in a virtual environment from a trusted package source, preferably with pinned dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code substantially aligns with the general idea of a formatting brush for Word documents: it applies fonts, sizes, alignment, first-line indent, spacing, margins, heading-level-specific formatting, and includes a built-in GB/T 9704-2012-style configuration. However, the declared description materially overstates the supported input types and workflow. The implementation is limited to .docx targets and JSON-based format profiles, not arbitrary document formats such as Markdown or plain text, and it does not directly compare against or extract from another template document within this code chunk. Those are meaningful capability mismatches, so the description does not accurately represent the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a full formatting tool that adjusts one document to match another template across multiple file formats and formatting dimensions. However, the supplied code is an extractor: it parses a template .docx using python-docx, gathers page, style, paragraph, and run formatting information, and writes/returns a JSON profile. There is no code to open or modify a target document, no formatting application logic, no support for Markdown or plain text, and no implementation of heading classification or official document formatting templates. This is a material purpose mismatch, not merely an incomplete snippet, because the primary behavior present is metadata extraction rather than format transformation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises file-reading and file-writing behavior through local scripts, but the manifest does not declare any explicit tool scope or allowed-tools boundaries. That creates an authorization gap where an agent may invoke broader filesystem capabilities than users expect, especially because the document repeatedly instructs execution of local Python scripts on user-supplied files.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description lists triggers such as "格式刷", "参照某文件的格式", and especially ends with "等", which makes the activation scope open-ended and ambiguous. Without clear boundaries or exclusion examples, the skill could be invoked for general document-editing requests that only loosely relate to format copying.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description is entirely oriented around Chinese document formatting conventions, including built-in GB/T 9704-2012 official document formatting, but does not state that this is optional or region-specific. Because the skill presents these conventions as default behavior rather than a documented locale-specific mode or user opt-in, it risks violating language/locale policy expectations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documentation instructs the agent to run local Python scripts via shell-style commands, effectively requiring command execution rather than a narrowly scoped formatting interface. This expands the attack surface because filenames, paths, and execution context may be influenced by user input, and a formatting skill does not inherently need unrestricted shell access to perform its job.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and usage examples are written around Chinese document categories and an official Chinese government format, which indicates the skill is tailored to a specific language/locale. The file does not offer a user language/locale choice or clearly scope itself as a region-specific tool in a way that would avoid a language-policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language heuristics only recognize Chinese heading markers such as '一、' and '（一）' and a Chinese official document number pattern. This enforces a specific language/locale behavior without presenting it as an explicit, justified regional constraint or offering alternatives.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python file contains natural-language docstrings, help text, and console messages entirely in Chinese, and the CLI description/examples assume Chinese-language interaction. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the restriction is explicitly justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring and parsing/writing logic are explicitly tailored to Chinese document conventions, and the CLI default configuration enforces Chinese fonts and official-document formatting. Because the file does not offer a language/locale opt-in or clearly state that it is intentionally region-specific, this conflicts with the policy against forcing a specific language/locale by default.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Listing an absolute user-specific path (
C:\Users\14032\.codebuddy\skills\doc-format-brush\scripts\) introduces filesystem awareness unrelated to the semantic purpose of matching document formats. For a formatting skill, hard-coding or revealing local environment paths is an unnecessary capability detail.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. At L113, the text says "中文文档必须设置该属性", which prescribes a Chinese-specific requirement without any opt-in, alternative locale handling, or justification that this reference is explicitly limited to Chinese-language workflows.
- Content
Static analysis
No suspicious patterns detected.