word-analysis

• Outcome: Pass
• Latest audit: Sep 7, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

This Word-analysis skill is purpose-aligned and discloses that extracted DOCX text is sent to its platform, but users should protect API keys and avoid untrusted endpoint overrides or untrusted DOCX files.

Install only if you are comfortable sending extracted DOCX text to the provider's service. Keep WORD_ANALYSIS_API_KEY secret, do not point AI_SKILLS_API_URL at an untrusted host, and avoid processing regulated or highly confidential documents unless the provider's data handling terms fit your needs. Treat DOCX files from untrusted sources cautiously because crafted files may stress the local extractor.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/HTTP-REQUESTS.md:3
• Finding: Configurable API Endpoint Can Expose Document Contents and Bearer Credentials## Vulnerability Details **File Location**: `references/HTTP-REQUESTS.md:3` **Vulnerability Type**: Unrestricted security-sensitive endpoint configuration **Risk Level**: Medium ### Vulnerable Code ```text POST JSON to `${AI_SKILLS_API_URL:-https://ai-skills.open-idea.net}/api/v1/word-analysis/word.analyze` with `Authorization: Bearer`, `Content-Type: application/json`, and a unique `Idempotency-Key`. Replace the operation for questions, comparisons, and exports; poll asynchronous tasks using the query address returned in the response. Read `X-AI-Skills-Billing-Currency`, `X-AI-Skills-Billing-Charged`, and `X-AI-Skills-Billing-Balance` for billing information. ``` The displayed snippet is an English rendering of the instruction at the cited location. Its endpoint expression and security-sensitive header names are reproduced exactly. ### Technical Analysis The request destination can be replaced through the `AI_SKILLS_API_URL` environment variable. The instructions do not require host allowlisting, certificate pinning beyond ordinary HTTPS validation, redirect restrictions, or verification that credentials remain on the expected origin. Requests carry the `WORD_ANALYSIS_API_KEY` as a bearer credential and include extracted document content. Consequently, anyone capable of influencing this environment variable can redirect both categories of sensitive information to another server. The issue does not independently grant an attacker the ability to set environment variables; exploitation requires control over deployment configuration, the process environment, or another mechanism that affects the skill's runtime configuration. ### Attack Path 1. An attacker or compromised configuration mechanism sets `AI_SKILLS_API_URL` to an attacker-controlled HTTPS origin. 2. A user invokes document analysis, question answering, comparison, or export functionality. 3. The agent follows the documented request procedure and constructs the API U ...[truncated 1004 chars]
• Remediation: ## Remediation Suggestions - Pin requests to `https://ai-skills.open-idea.net` unless custom endpoints are an explicitly supported and security-reviewed requirement. - If endpoint customization is required, parse the URL and enforce an allowlist of exact HTTPS schemes, hostnames, and permitted ports. - Reject URLs containing user information, ambiguous host representations, fragments, or unexpected path prefixes. - Disable redirects for authenticated requests, or validate every redirect target and remove the `Authorization` header whenever the origin changes. - Ensure TLS certificate validation remains enabled and prohibit plaintext HTTP endpoints. - Keep endpoint configuration in trusted administrator-controlled configuration rather than accepting values from document content or ordinary user instructions. - Use narrowly scoped, revocable API keys and rotate a key immediately if requests may have reached an untrusted endpoint. - Obtain user authorization before transmitting sensitive document text, as already required by the skill's behavioral rules.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract_word.py:9
• Finding: DOCX Entry Is Decompressed Before Its Size Is Validated## Vulnerability Details **File Location**: `scripts/extract_word.py:9-13` **Vulnerability Type**: Unbounded decompression and memory exhaustion **Risk Level**: Medium ### Vulnerable Code ```python try: with zipfile.ZipFile(path) as z: if len(z.infolist()) > 500 or "word/document.xml" not in z.namelist(): raise ValueError() raw = z.read("word/document.xml") except Exception: raise SystemExit("The file is not a valid DOCX and may be damaged or encrypted.") if len(raw) > 8 * 1024 * 1024: raise SystemExit("The DOCX body exceeds the parsing limit.") ``` The error-message literals above are translated into English; the executable control flow is unchanged from the cited source. ### Technical Analysis A DOCX file is a ZIP archive. The script limits the archive's compressed filesystem size to 10 MB and limits its entry count, but it calls `z.read("word/document.xml")` before validating the entry's uncompressed size. `ZipFile.read()` decompresses the complete entry and returns it as an in-memory byte string. The subsequent eight-megabyte check occurs too late to prevent resource consumption. A highly compressible `document.xml` entry can have a small compressed representation while expanding to a much larger size. Reading such an entry can cause excessive memory allocation, process termination, swapping, or broader resource pressure before the script reaches `len(raw)`. The archive-entry-count limit does not mitigate this condition because exploitation requires only one oversized compressed entry. The later paragraph and character limits also do not help because XML parsing begins only after full decompression. ### Attack Path 1. An attacker creates a ZIP-compatible DOCX containing the required `word/document.xml` entry. 2. The XML entry contains highly repetitive content, producing an archive smaller than the script's 10 MB input limit while having a very large uncompressed size. 3. The attacker cau ...[truncated 859 chars]
• Remediation: ## Remediation Suggestions - Retrieve the `ZipInfo` object for `word/document.xml` and reject it before reading when `file_size` exceeds the eight-megabyte limit. - Enforce a maximum compression ratio by comparing `file_size` with `compress_size`, while safely handling zero-length compressed entries. - Apply an aggregate uncompressed-size limit to all archive entries that may ever be read. - Open the entry with `ZipFile.open()` and read it incrementally into a bounded buffer, aborting as soon as the limit is exceeded. - Run extraction in an isolated process with explicit memory, CPU-time, and execution-time limits so malformed archives cannot destabilize the agent runtime. - Retain the existing compressed-file-size and entry-count checks as defense-in-depth rather than treating them as sufficient ZIP-bomb protection. - Add regression tests using entries whose compressed size is small but whose declared and actual uncompressed sizes exceed the configured limit.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs clients to send document-analysis requests and bearer-token authorization to a remote endpoint but does not warn that potentially sensitive document contents leave the local environment. In a Word-analysis skill, documents may contain confidential business or personal data, so omission of privacy, retention, and credential-handling guidance can lead to inadvertent disclosure.

Static analysis

No suspicious patterns detected.