Kingdoc 2.1.0

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:55 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a real KingDoc integration, but it requests powerful document access while its implemented safeguards do not match its safety promises.

Review carefully before installing. Use a dedicated low-privilege KingDoc app, avoid granting access to sensitive team documents, rotate the App Secret if config.json is exposed, and require manual confirmation outside the skill before uploads, sharing, version rollback, batch changes, or permanent deletion.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: setup.sh:39

Finding

OAuth Client Secret Stored in Plaintext Configuration

Content

View full analysis

"$CONFIG_PATH" << EOF { "appName": "kingdoc", "appId": "$APP_ID", "appSecret": "$APP_SECRET", "scope": "user:file:write user:file:read team:file:write team:file:read", "environment": "production" } EOF echo "[OK] Config saved" ``` The Windows installer implements the same behavior: ```powershell # Save config $config = @{ appName = "kingdoc" appId = $appId appSecret = [Runtime.InteropServices.Marshal]::PtrToStringAuto( [Runtime.InteropServices.Marshal]::SecureStringToBSTR($appSecret) ) scope = "user:file:write user:file:read team:file:write team:file:read" environment = "production" } | ConvertTo-Json -Depth 3 $configPath = Join-Path $PSScriptRoot "config.json" Set-Content -Path $configPath -Value $config -Encoding UTF8 Write-Host "[OK] Config saved to config.json" -ForegroundColor Green ``` ### Technical Analysis Both installers persist the KDocs OAuth client secret as plaintext in `config.json`. The Unix installer does not create the file with owner-only permissions. The Windows installer accepts the secret as a `SecureString`, but immediately converts it to an ordinary plaintext string before writing it with inherited filesystem permissions. The configured scopes include read and write access to personal and team documents. Therefore, disclosure of this secret could allow another party to request application access tokens within the application's approved authorization scope. This behavior also conflicts with the project's security posture: while the access token remains primarily in memory, the long-lived client credential used to obtain new tokens is persisted without adequate protection. ### Attack Path 1. A user runs `setup.sh` or `setup.ps1` and suppl ...[truncated 998 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: setup.sh:26

Finding

Installation Executes Unpinned Third-Party Dependencies

Content

View full analysis

/dev/null echo "[OK] Dependencies installed" ``` The Windows installer similarly installs each dependency without a version or hash: ```powershell # Install dependencies Write-Host "[..] Installing dependencies..." -ForegroundColor Gray $deps = @("requests", "mcp", "python-docx", "python-pptx", "pyyaml") foreach ($dep in $deps) { pip install -q $dep } Write-Host "[OK] Dependencies installed" -ForegroundColor Green ``` ### Technical Analysis The setup scripts install the latest package versions resolved by pip at installation time. No version constraints, lock file, package hashes, or explicit trusted index are provided. Consequently, the effective code executed by installation can change after the Skill has been reviewed. If a package account, release, transitive dependency, or configured package index is compromised, malicious package code may execute during installation or later import. This finding does not establish that any currently named package is malicious. The risk arises from mutable, unverified supply-chain resolution. ### Attack Path 1. An attacker compromises a dependency release, a transitive dependency, or a package index used by the victim. 2. A user follows the documented installation procedure. 3. pip resolves the compromised package because the scripts do not pin an audited version or verify a hash. 4. Package build or installation hooks execute in the user's environment, or malicious code executes when imported. 5. The package gains the privileges of the user running setup and can access local data, credentials, and project files. ### Impact Assessment A compromised dependency could execute arbitrary co ...[truncated 399 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: engine/api/tools.py:118

Finding

Destructive and Privileged Tools Omit Advertised Safety Enforcement

Content

View full analysis

Dict: """软删除""" if not validate_file_id(file_id): raise KingDocError("KD011", "非法 file_id 格式") resp = self.client.delete(f"/personal/files/{file_id}") return resp ``` ```python def kdoc_trash_destroy(self, file_id: str) -> Dict: """彻底删除""" resp = self.client.post("/personal/trash/destroy", json={"file_id": file_id}) return resp def kdoc_version_list(self, file_id: str) -> Dict: """版本历史""" resp = self.client.get(f"/appspace/versions?file_id={file_id}") return resp def kdoc_version_restore(self, file_id: str, version: int) -> Dict: """回滚版本""" resp = self.client.post(f"/appspace/versions/{version}/restore", json={"file_id": file_id}) return resp def kdoc_file_permission(self, file_id: str, members: list) -> Dict: """变更权限""" resp = self.client.put(f"/personal/files/{file_id}/permissions", json={"members": members}) return resp def kdoc_batch_create(self, operation: str, file_ids: list, target_folder_id: str = None) -> Dict: """创建批量任务""" body = {"operation": operation, "file_ids": file_ids} if target_folder_id: body["target_folder_id"] = target_folder_id resp = self.client.post("/personal/tasks", json=body) return resp ``` ### Technical Analysis `SKILL.md` and `references/security.md` state that destructive or sensitive operations require explicit user confirmation, permission preflight checks, audit logging, version-conflict protection, soft deletion, and per-session quotas. These controls are not enforced in the tool implementation. In particular: - `kdoc_trash_destroy` exposes irreversible deletion directly. - Permission changes are sent ...[truncated 1608 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: engine/api/tools.py:123

Finding

Unvalidated Identifiers Are Interpolated into Authenticated API Paths

Content

View full analysis

Dict: """版本历史""" resp = self.client.get(f"/appspace/versions?file_id={file_id}") return resp def kdoc_version_restore(self, file_id: str, version: int) -> Dict: """回滚版本""" resp = self.client.post(f"/appspace/versions/{version}/restore", json={"file_id": file_id}) return resp def kdoc_batch_query(self, task_id: str) -> Dict: """查询批量任务""" resp = self.client.get(f"/personal/tasks/{task_id}") return resp ``` Additional affected path construction includes: ```python def kdoc_et_range_write(self, sheet_id: str, range_str: str, values: list) -> Dict: """批量写入区域""" resp = self.client.put(f"/et/ranges/{sheet_id}", json={"range": range_str, "values": values}) return resp ``` ```python def kdoc_form_answers(self, form_id: str, limit: int = 50) -> Dict: """查询答卷""" resp = self.client.get(f"/personal/forms/{form_id}/answers", params={"limit": limit}) return resp ``` ### Technical Analysis Only selected `file_id` uses call `validate_file_id`. Other path components—including `version`, `task_id`, `sheet_id`, and `form_id`—are inserted directly into authenticated URLs. Python type annotations do not enforce runtime types. Crafted values containing slashes, dot segments, query delimiters, or fragments may change the request path or parameter interpretation. The HTTP client attaches the KDocs bearer token to the resulting request. The client uses a fixed KDocs origin, which prevents straightforward token forwarding to an arbitrary external hostname. However, path manipulation can still cause an authenticated request to reach an unintended endpoint on the trusted KDocs origin. ### At ...[truncated 1052 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: engine/auth.py:72

Finding

Authentication Test Discloses an Access Token Prefix

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: engine/local/generators.py:113

Finding

Unescaped Labels Permit Active SVG Markup Injection

Content

View full analysis

str: """Render a simple SVG mindmap""" import math Path(output_path).parent.mkdir(parents=True, exist_ok=True) width, height = 800, 600 svg_parts = [ f'', '' ] cx_root, cy_root = width // 2, height // 2 node_positions = {} for i, node in enumerate(self.nodes): angle = 2 * math.pi * i / max(len(self.nodes), 1) x = cx_root + int(200 * math.cos(angle)) y = cy_root + int(150 * math.sin(angle)) node_positions[node["id"]] = (x, y) svg_parts.append(f'') svg_parts.append(f'{node["label"]}') for edge in self.edges: src = node_positions.get(edge["source"]) tgt = node_positions.get(edge["target"]) if src and tgt: svg_parts.append(f'') svg_parts.append('') with open(output_path, "w", encoding="utf-8") as f: f.write("\n".join(svg_parts)) return output_path ``` The flowchart generator repeats the unsafe interpolation: ```python def render_svg(self, output_path: str) -> str: Path(output_path).parent.mkdir(parents=True, exist_ok=True) width, height = 400, 100 + len(self.steps) * 80 svg_parts = [ f'', '' ] cx = width // 2 ...[truncated 2703 chars]

Remediation

View remediation

`, `&`, quotes, closing tags, links, scripts, and external image references. 7. Where feasible, render diagrams to a non-active raster format before distribution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the actual supplied code is mainly tests or validation logic rather than the claimed production collaboration features, the package is materially misrepresented. Misrepresentation in security-sensitive ecosystems is risky because reviewers may approve it under an inaccurate model of data flows and privileges.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the actual supplied code is mainly tests or validation logic rather than the claimed production collaboration features, the package is materially misrepresented. Misrepresentation in security-sensitive ecosystems is risky because reviewers may approve it under an inaccurate model of data flows and privileges.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the actual supplied code is mainly tests or validation logic rather than the claimed production collaboration features, the package is materially misrepresented. Misrepresentation in security-sensitive ecosystems is risky because reviewers may approve it under an inaccurate model of data flows and privileges.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the actual supplied code is mainly tests or validation logic rather than the claimed production collaboration features, the package is materially misrepresented. Misrepresentation in security-sensitive ecosystems is risky because reviewers may approve it under an inaccurate model of data flows and privileges.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the actual supplied code is mainly tests or validation logic rather than the claimed production collaboration features, the package is materially misrepresented. Misrepresentation in security-sensitive ecosystems is risky because reviewers may approve it under an inaccurate model of data flows and privileges.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the actual supplied code is mainly tests or validation logic rather than the claimed production collaboration features, the package is materially misrepresented. Misrepresentation in security-sensitive ecosystems is risky because reviewers may approve it under an inaccurate model of data flows and privileges.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the actual supplied code is mainly tests or validation logic rather than the claimed production collaboration features, the package is materially misrepresented. Misrepresentation in security-sensitive ecosystems is risky because reviewers may approve it under an inaccurate model of data flows and privileges.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auth.md (reported line 155)May include surrounding context.

4.4 删除文档（软删除）

text

DELETE /personal/files/:file_id

⚠️ 删除后文档进入回收站，可恢复。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auth.md (reported line 163)May include surrounding context.

4.5 彻底删除

text

DELETE /personal/files/:file_id/permanent

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auth.md (reported line 282)May include surrounding context.

POST /et/formula/set # 设置公式 POST /et/sheets # 添加工作表 PUT /et/sheets/:sheet_id # 重命名工作表 DELETE /et/sheets/:sheet_id # 删除工作表

text

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auth.md (reported line 299)May include surrounding context.

POST /dbt/views # 添加视图 POST /dbt/records # 添加记录 PUT /dbt/records/:record_id # 更新记录 DELETE /dbt/records/:record_id# 删除记录 GET /dbt/records/:table_id # 查询记录 POST /dbt/webhooks # 设置 Webhook

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auth.md (reported line 312)May include surrounding context.

POST /personal/forms # 创建收集表 GET /personal/forms/:form_id # 获取收集表 PUT /personal/forms/:form_id # 修改收集表 DELETE /personal/forms/:form_id# 删除收集表 GET /personal/forms/:form_id/answers?offset=0&limit=50 # 查询答卷 POST /personal/forms/:form_id/submit # 提交答卷

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auth.md (reported line 294)May include surrounding context.

2.3 删除字段

text

DELETE /dbt/fields/:field_id

2.4 列出字段

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/dbt_references.md (reported line 60)May include surrounding context.

2.3 删除字段

text

DELETE /dbt/fields/:field_id

2.4 列出字段

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/dbt_references.md (reported line 135)May include surrounding context.

4.4 删除记录

text

DELETE /dbt/records/:record_id

4.5 查询记录

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes automatic file upload to a cloud service ('把这个 PDF 传到云端') without a clear warning that local files and document contents will be transmitted to a remote provider. In a document-management skill, this can lead users to disclose sensitive or regulated data without informed consent, especially because the examples frame upload as a routine assistant action.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises capabilities that imply filesystem, network, and shell use, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege boundaries and makes it harder for hosts or reviewers to constrain what the skill may access, increasing the blast radius if the implementation is compromised or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quick-start phrases are broad enough to match ordinary user speech, which can cause the skill to trigger in contexts where the user did not intend document creation, upload, search, or permission actions. In a skill with file, network, and sharing capabilities, accidental activation increases the chance of unintended data access or side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Webhook configuration can send document event data to third-party endpoints, but the documentation does not clearly warn users about that data egress. Without explicit disclosure, users may unknowingly authorize transmission of document metadata or workflow events outside the trusted platform boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The kdoc_trash_destroy method performs a clearly irreversible action (彻底删除) by calling the destroy endpoint, but the file provides no confirmation prompt, user-visible logging, or cautionary comment/docstring beyond the terse method label. For a destructive operation, this code does not disclose the risk to the user within the implementation shown.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The kdoc_version_restore method restores an older version of a file, which can overwrite current remote content, but there is no confirmation, warning, or explanatory note about that impact. The current docstring only says 回滚版本, which does not adequately disclose the potentially destructive effect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The module docstrings and descriptive text are written entirely in Chinese, with no indication that language selection is optional or that the tool is intentionally limited to a Chinese-speaking audience for a documented reason. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code sends the configured client_id and client_secret to a remote OAuth token endpoint, which is a network operation involving sensitive credentials. While the code has internal docstrings, it lacks a clear user-facing warning, confirmation, or visible disclosure that credentials will be transmitted over the network.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · engine/update_check.py (reported line 14)May include surrounding context.

python

requests = None

# SkillHub API endpoint for checking updates
SKILLHUB_UPDATE_URL = "https://api.skillhub.cn/api/v1/skills/check_update"
SKILLHUB_SKILL_SLUG = "kingdoc"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

该 markdown 文件适用缺少用户警告检查。这里公开了“彻底删除”接口，但 unlike 前一节软删除有回收站提示，此处没有说明该操作不可恢复、会永久移除用户数据，属于可能影响用户数据完整性的高风险行为而缺少警示。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.