{"data":{"skill":{"slug":"k-dense-ai-docx","name":"docx","icon":"📦","repo":"https://github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/document-skills/docx","status":"approved","author":"K-Dense-AI","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"2c690657-0d9a-42f8-bb1d-ee70ab9efc9b","skill_id":"33ee9b5e-bd7b-44c8-a6b1-797e97424628","version":5,"content_hash":"b914d5d5c37165eae70b14f87462c8f5","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"The skill has legitimate DOCX and OOXML document-processing intent, and many static alerts are false positives from markdown code blocks, XML namespaces, and OOXML vocabulary. However, several bundled scripts extract user-supplied Office archives with extractall() and no member path validation, which is a confirmed Zip Slip risk. Publication should wait until archive extraction is hardened and privileged install guidance is removed or clearly isolated.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"ooxml/scripts/unpack.py","line_end":17,"line_start":1},{"file":"ooxml/scripts/pack.py","line_end":17,"line_start":1},{"file":"scripts/document.py","line_end":41,"line_start":36}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":62,"line_start":57},{"file":"SKILL.md","line_end":210,"line_start":200},{"file":"ooxml/scripts/pack.py","line_end":116,"line_start":103},{"file":"ooxml/scripts/validation/redlining.py","line_end":166,"line_start":153}]},{"factor":"filesystem","evidence":[{"file":"ooxml/scripts/unpack.py","line_end":24,"line_start":15},{"file":"ooxml/scripts/validation/base.py","line_end":891,"line_start":889},{"file":"scripts/document.py","line_end":646,"line_start":640},{"file":"scripts/document.py","line_end":884,"line_start":882}]},{"factor":"network","evidence":[{"file":"LICENSE.txt","line_end":9,"line_start":8},{"file":"docx-js.md","line_end":241,"line_start":236},{"file":"ooxml.md","line_end":168,"line_start":164}]}],"critical_findings":[],"high_findings":[{"title":"Unsafe archive extraction of Office documents","locations":[{"file":"ooxml/scripts/unpack.py","line_end":17,"line_start":17},{"file":"ooxml/scripts/validation/base.py","line_end":891,"line_start":889},{"file":"ooxml/scripts/validation/docx.py","line_end":201,"line_start":200},{"file":"ooxml/scripts/validation/redlining.py","line_end":70,"line_start":69}],"confidence":0.94,"description":"TRUE_POSITIVE: The unpacking and validation helpers call ZipFile.extractall() on Office files without validating member paths. A crafted DOCX/PPTX/XLSX archive could write files outside the intended temporary or output directory.","confidence_reasoning":"The code directly uses extractall() on user-provided Office archives. I found no path normalization or member rejection before extraction at these call sites."}],"medium_findings":[{"title":"External command execution in document workflows","locations":[{"file":"SKILL.md","line_end":62,"line_start":57},{"file":"SKILL.md","line_end":210,"line_start":200},{"file":"ooxml/scripts/pack.py","line_end":116,"line_start":103},{"file":"ooxml/scripts/validation/redlining.py","line_end":166,"line_start":153},{"file":"ooxml/scripts/validation/redlining.py","line_end":190,"line_start":185}],"confidence":0.82,"description":"TRUE_POSITIVE with constrained scope: The skill instructs agents to run pandoc, soffice, pdftoppm, and bundled scripts, and pack.py invokes soffice through subprocess.run(). The subprocess calls use argument arrays rather than shell=True, so command injection evidence is not present, but untrusted documents are processed by external binaries.","confidence_reasoning":"The external command paths are explicit and semantically part of the workflow. The risk is reduced because subprocess arguments are not passed through a shell."},{"title":"Privileged dependency installation guidance","locations":[{"file":"SKILL.md","line_end":231,"line_start":223}],"confidence":0.78,"description":"TRUE_POSITIVE as marketplace risk: The documentation tells users or agents to install system packages with sudo apt-get. This is normal setup guidance, but marketplace skills should avoid routine privileged commands in executable workflows.","confidence_reasoning":"The privileged commands are visible in dependency instructions. They are not hidden or malicious, but they can expand execution privileges if followed automatically."},{"title":"Broad filesystem modification by document helper library","locations":[{"file":"scripts/document.py","line_end":646,"line_start":640},{"file":"scripts/document.py","line_end":884,"line_start":874},{"file":"ooxml/scripts/pack.py","line_end":79,"line_start":64}],"confidence":0.74,"description":"TRUE_POSITIVE with legitimate purpose: The Document helper copies input directories to temporary workspaces, writes XML files, and copies results back to the destination. This is expected for DOCX editing but should be limited to user-approved paths.","confidence_reasoning":"The filesystem operations are clear and central to the skill. I did not find evidence of stealthy persistence or unauthorized target paths in the reviewed context."}],"low_findings":[{"title":"Hardcoded URLs are mostly namespaces or examples","locations":[{"file":"LICENSE.txt","line_end":9,"line_start":8},{"file":"ooxml.md","line_end":168,"line_start":164},{"file":"docx-js.md","line_end":241,"line_start":236}],"confidence":0.89,"description":"FALSE_POSITIVE: The network alerts mostly point to license URLs, OOXML namespace URIs, relationship type URIs, and a sample hyperlink. I did not find evidence that the skill sends data to those URLs.","confidence_reasoning":"The cited URLs appear in documentation, licenses, or XML relationship examples. No HTTP client or exfiltration flow was found in those locations."},{"title":"OOXML terms triggered weak crypto and C2 keyword alerts","locations":[{"file":"ooxml.md","line_end":20,"line_start":16},{"file":"scripts/document.py","line_end":128,"line_start":116},{"file":"scripts/utilities.py","line_end":300,"line_start":290}],"confidence":0.86,"description":"FALSE_POSITIVE: Static matches such as RSID, id attributes, schema names, and XML vocabulary appear to be document-format terminology rather than cryptographic implementation or command-and-control behavior.","confidence_reasoning":"The reviewed examples are OOXML metadata and identifier handling. No malicious C2 control flow or weak cryptographic security decision was found in these snippets."},{"title":"Long XML template lines resemble obfuscation","locations":[{"file":"scripts/templates/comments.xml","line_end":2,"line_start":2},{"file":"scripts/templates/commentsExtended.xml","line_end":2,"line_start":2},{"file":"scripts/templates/commentsExtensible.xml","line_end":2,"line_start":2},{"file":"scripts/templates/commentsIds.xml","line_end":2,"line_start":2}],"confidence":0.84,"description":"FALSE_POSITIVE: The long template files are Word comment XML templates with many namespace declarations. This format explains the line length without requiring obfuscated executable code.","confidence_reasoning":"The static signal is explained by dense XML templates. I did not find JavaScript obfuscation or runtime decoding behavior in the cited template files."}],"dangerous_patterns":[{"title":"zipfile.extractall without path validation","locations":[{"file":"ooxml/scripts/unpack.py","line_end":17,"line_start":17},{"file":"ooxml/scripts/validation/base.py","line_end":891,"line_start":889},{"file":"ooxml/scripts/validation/docx.py","line_end":201,"line_start":200},{"file":"ooxml/scripts/validation/redlining.py","line_end":70,"line_start":69}],"confidence":0.94,"description":"The skill extracts archive members directly into output directories. Replace this with safe extraction that rejects absolute paths and paths resolving outside the destination.","confidence_reasoning":"This is a direct dangerous API pattern on archive input. The reviewed call sites do not perform member path checks first."},{"title":"Agent-facing sudo install commands","locations":[{"file":"SKILL.md","line_end":230,"line_start":227}],"confidence":0.78,"description":"The skill includes sudo apt-get dependency commands in instructions. This should be separated from normal skill execution and require explicit user approval.","confidence_reasoning":"The commands are documented plainly. The concern is operational privilege expansion, not hidden malicious behavior."}],"files_scanned":60,"total_lines":24993,"audit_model":"codex","audited_at":"2026-06-30T05:56:24.685+00:00","created_at":"2026-06-30T06:56:15.265755+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}