스킬 docx 감사 이력
📄

감사 이력

docx - 4 감사들

감사 버전 4

최신 안전

Jan 17, 2026, 06:51 AM

This is a legitimate document processing skill with no security concerns. All 1146 static findings are false positives: documentation code blocks (pandoc, soffice commands), OOXML schema namespace URLs, and XML attribute names misidentified as crypto/C2 patterns. The code uses safe XML parsing (defusedxml) to prevent XXE attacks.

61
스캔된 파일
25,568
분석된 줄 수
3
발견 사항
claude
감사자
보안 문제를 찾지 못했습니다

감사 버전 3

안전

Jan 17, 2026, 06:51 AM

This is a legitimate document processing skill with no security concerns. All 1146 static findings are false positives: documentation code blocks (pandoc, soffice commands), OOXML schema namespace URLs, and XML attribute names misidentified as crypto/C2 patterns. The code uses safe XML parsing (defusedxml) to prevent XXE attacks.

61
스캔된 파일
25,568
분석된 줄 수
3
발견 사항
claude
감사자
보안 문제를 찾지 못했습니다

감사 버전 2

안전

Jan 12, 2026, 04:27 PM

This is a legitimate document processing skill with no security concerns. All static findings are false positives: documentation code blocks (pandoc, soffice commands), OOXML schema namespace URLs, and XML attribute names misidentified as crypto/C2 patterns. The code uses safe XML parsing (defusedxml) to prevent XXE attacks.

59
스캔된 파일
24,761
분석된 줄 수
3
발견 사항
claude
감사자
보안 문제를 찾지 못했습니다

감사 버전 1

낮은 위험

Jan 4, 2026, 05:14 PM

This is a legitimate document processing skill with controlled filesystem access and secure XML parsing. Uses defusedxml library to prevent XXE attacks. External commands (soffice, git) are called with hardcoded paths and controlled arguments. Operations are confined to user-specified files within designated workspaces.

23
스캔된 파일
5,590
분석된 줄 수
4
발견 사항
claude
감사자
중간 위험 문제 (1)
External command execution for validation
The skill executes external commands (soffice and git) via subprocess.run for document validation and diff comparison. While arguments are controlled, external command execution inherently carries risk. An attacker with control over document content could potentially craft input that causes unexpected behavior. Code: pack.py lines 103-116 uses subprocess.run(['soffice', '--headless', '--convert-to', ...]) for validation