Ofd Reader skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:13 PM UTC
• Version: 1.0.0

Overview

This is a straightforward OFD document conversion skill with disclosed local file output and an optional dependency installer, and I found no hidden persistence, exfiltration, or deceptive behavior.

Install only if you are comfortable using a local converter on OFD files. Avoid running the optional dependency installer unless needed, process only trusted OFD documents when possible, and write output to a deliberate workspace path so existing files are not overwritten.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ofd_to_text.py:29

Finding

Unbounded Processing of Untrusted OFD Archives

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/install_dependencies.py:11

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

=0.3.0", ] print("正在安装 OfdReader skill 的依赖...") for package in dependencies: print(f"安装 {package}...") try: subprocess.check_call([sys.executable, "-m", "pip", "install", package]) ``` ### Technical Analysis The installer permits any `ofdrw` version greater than or equal to `0.3.0`. It does not pin an audited release, verify artifact hashes, constrain transitive dependencies, or specify an approved package index. Consequently, installation behavior can change after the Skill has been reviewed. Pip may select a future release or resolve packages from a user-configured or attacker-influenced index. Python package installation may execute build backend or setup logic with the privileges of the user running the installer. The subprocess invocation uses an argument array and a hardcoded package specification, so shell command injection is not present. The risk is specifically the mutable and insufficiently verified dependency supply chain. ### Attack Path 1. A user invokes `scripts/install_dependencies.py`. 2. Pip connects to its configured package index and resolves `ofdrw>=0.3.0` and any transitive dependencies. 3. A compromised future release, compromised index, or malicious package supplied through an unsafe index configuration is selected. 4. Pip downloads and installs the selected artifact. 5. Malicious build or installation logic executes with the privileges of the user who launched the script, or malicious package code becomes available for later execution. This path depends on compromise or attacker influence over package distribution or pip index configuration; the audited repository itself does not contain evidence that `ofdrw` is malici ...[truncated 492 chars]

Remediation

View remediation

`. 3. Pin all transitive dependencies in a reviewed lock file. 4. Require cryptographic hashes with pip's `--require-hashes` option. 5. Configure an explicit, organization-approved HTTPS package index rather than relying on ambient pip configuration. 6. Prefer prebuilt, verified wheels and disable source builds where operationally possible. 7. Run package installation in an isolated virtual environment without administrator privileges. 8. Add an automated dependency review and update process so pinned versions receive controlled security updates. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述包含两项核心能力：1）提取纯文本；2）转换为 Markdown，并保留基本格式如标题、段落、表格。代码确实实现了基础的 OFD 文本提取，但没有任何 Markdown 生成逻辑，也没有对文档结构、段落层级、标题识别或表格解析的处理。它只是扫描部分 XML 文件中的 TextCode/TextContent 文本并拼接输出。因此，描述对该 skill 的能力有实质性夸大，尤其是“转换为 Markdown 格式”和“处理基本版式结构”并未在代码中体现，构成描述与行为不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents shell execution of local Python scripts and writing output files, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where the runtime capabilities required by the skill are broader than what the manifest transparently communicates, increasing the chance of unintended command execution or file writes when the skill is invoked.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install_dependencies.py (reported line 22)May include surrounding context.

python

for package in dependencies:
        print(f"安装 {package}...")
        try:
            subprocess.check_call([sys.executable, "-m", "pip", "install", package])
            print(f"  {package} 安装成功")
        except subprocess.CalledProcessError as e:
            print(f"  警告: {package} 安装失败: {e}")

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script fetches and installs packages from pip at runtime, which introduces a software supply-chain risk unrelated to the core document-reading logic. If package resolution is tampered with, a malicious or compromised dependency could execute code during installation, expanding the skill from local file processing into network-backed code acquisition and execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Manifest 描述该 skill 支持从 OFD 提取文本并转换为 Markdown，且可处理标题、段落、表格等基本格式；但此文件只提取 TextCode/TextContent 并输出纯文本，没有任何 Markdown 结构化转换逻辑。与此同时，main() 还提供将结果写入任意输出路径的能力，这比“读取”更接近通用文件导出行为。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script accepts an arbitrary output path and writes extracted content there without constraining the destination. In an agent/tooling context, this expands a document-reading skill into a local file write primitive, which can be abused to overwrite user files, place data in sensitive locations, or enable follow-on attacks if the caller can influence the path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire reference file is written in Chinese and presents the material solely in that language, with no indication that users can select another language or that the localization is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a concern unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring, function docstring, and all printed user-facing messages are in Chinese, which imposes a specific language on users. The file does not indicate that the skill is region-specific or provide any opt-in or fallback language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This is a code file, so SQP-3 applies to natural-language text in docstrings and messages. The file presents its description and usage entirely in Chinese and does not offer an alternative language or indicate that the tool is intentionally region-specific, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The top-level docstring presents the tool as converting OFD to Markdown while preserving basic structure, implying faithful processing. However, _process_document suppresses all exceptions with pass, which can silently skip document content and produce incomplete output without indicating that preservation/conversion failed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest emphasizes extracting text from OFD and converting it to Markdown, which suggests a reader/converter role. The code also performs filesystem write operations to a user-specified output path, adding a persistence side effect not stated in the manifest description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

文件头和函数 docstring 都将该脚本描述为 OFD 文本提取工具，强调的是读取/提取语义。实际 main() 除了提取外，还会在提供第二个参数时执行文件写入，这与“仅提取”的表述存在意图层面的偏差。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s docstrings and CLI messages are written exclusively in Chinese, including usage and error output. This imposes a specific language on users without any opt-in or indication that the tool is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.