Versioned security assessment

Report ID: SA-E7B8DA96

7/6/2026, 5:45:44 PM

docx security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
docx
Version
v6
Maintainer
K-Dense-AI
Source
github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/document-skills/docx
Coverage
60 Files scanned · 24,993 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are OOXML namespace, schema, XML ID, or documentation false positives. I confirmed unsafe archive extraction of user-supplied Office files, active sudo and global install instructions, and a low-severity environment search command. The bundled evaluation.json also contains audit-style safe-publish claims that should be removed from marketplace content.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

60 Files scanned · 24,993 Lines analyzed

20 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 224 evidence locations

Filesystem access

May read or write local files.

Observed in 56 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 53 evidence locations

Capability review items (19)
High
ooxml/scripts/unpack.py:17
Python archive libraries
zipfile.ZipFile(input_file).extractall(output_path)
The code extracts a user-supplied Office ZIP archive with extractall and no member path validation. A crafted DOCX/PPTX/XLSX can use absolute or parent-directory entries to write outside the target directory.
High
ooxml/scripts/unpack.py:17
Archive extract all (zip slip risk)
zipfile.ZipFile(input_file).extractall(output_path)
The code extracts a user-supplied Office ZIP archive with extractall and no member path validation. A crafted DOCX/PPTX/XLSX can use absolute or parent-directory entries to write outside the target directory.
High
ooxml/scripts/validation/base.py:890
Python archive libraries
with zipfile.ZipFile(self.original_file, "r") as zip_ref:
This ZipFile handle is used immediately for unchecked extractall in the same block. The surrounding flow processes user-provided Office archives, so it participates in the zip-slip risk.
High
ooxml/scripts/validation/base.py:891
Archive extract all (zip slip risk)
zip_ref.extractall(temp_path)
The code extracts a user-supplied Office ZIP archive with extractall and no member path validation. A crafted DOCX/PPTX/XLSX can use absolute or parent-directory entries to write outside the target directory.
High
ooxml/scripts/validation/docx.py:200
Python archive libraries
with zipfile.ZipFile(self.original_file, "r") as zip_ref:
This ZipFile handle is used immediately for unchecked extractall in the same block. The surrounding flow processes user-provided Office archives, so it participates in the zip-slip risk.
High
ooxml/scripts/validation/docx.py:201
Archive extract all (zip slip risk)
zip_ref.extractall(temp_dir)
The code extracts a user-supplied Office ZIP archive with extractall and no member path validation. A crafted DOCX/PPTX/XLSX can use absolute or parent-directory entries to write outside the target directory.
High
ooxml/scripts/validation/redlining.py:69
Python archive libraries
with zipfile.ZipFile(self.original_docx, "r") as zip_ref:
This ZipFile handle is used immediately for unchecked extractall in the same block. The surrounding flow processes user-provided Office archives, so it participates in the zip-slip risk.
High
ooxml/scripts/validation/redlining.py:70
Archive extract all (zip slip risk)
zip_ref.extractall(temp_path)
The code extracts a user-supplied Office ZIP archive with extractall and no member path validation. A crafted DOCX/PPTX/XLSX can use absolute or parent-directory entries to write outside the target directory.
High
SKILL.md:80-83
Ruby/shell backtick execution
`python ooxml/scripts/unpack.py <office_file> <output_directory>`
The active workflow instructs running unpack.py on Office files. That script uses unchecked archive extraction, so following this command on a malicious document can trigger zip-slip writes.
High
SKILL.md:103-105
Ruby/shell backtick execution
2. Unpack the document: `python ooxml/scripts/unpack.py <office_file> <output_directory>`
The active workflow instructs running unpack.py on Office files. That script uses unchecked archive extraction, so following this command on a malicious document can trigger zip-slip writes.
High
SKILL.md:151-166
Ruby/shell backtick execution
- **Unpack the document**: `python ooxml/scripts/unpack.py <file.docx> <dir>`
The active workflow instructs running unpack.py on Office files. That script uses unchecked archive extraction, so following this command on a malicious document can trigger zip-slip writes.
High
SKILL.md:227-228
Ruby/shell backtick execution
- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
The inline command in active skill documentation uses sudo apt-get install. That can modify the host system with elevated privileges if followed by an agent or user.
High
SKILL.md:229-230
Ruby/shell backtick execution
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
The inline command in active skill documentation uses sudo apt-get install. That can modify the host system with elevated privileges if followed by an agent or user.
High
SKILL.md:230-231
Ruby/shell backtick execution
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
The inline command in active skill documentation uses sudo apt-get install. That can modify the host system with elevated privileges if followed by an agent or user.
High
SKILL.md:227
sudo privilege escalation
- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
The active skill documentation instructs running sudo apt-get install commands. Marketplace skills should not direct agents or users to elevate privileges without an explicit installation boundary.
High
SKILL.md:229
sudo privilege escalation
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
The active skill documentation instructs running sudo apt-get install commands. Marketplace skills should not direct agents or users to elevate privileges without an explicit installation boundary.
High
SKILL.md:230
sudo privilege escalation
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
The active skill documentation instructs running sudo apt-get install commands. Marketplace skills should not direct agents or users to elevate privileges without an explicit installation boundary.
Medium
SKILL.md:228-229
Ruby/shell backtick execution
- **docx**: `npm install -g docx` (for creating new documents)
The active documentation asks for a global npm package installation. npm installs can run package lifecycle scripts and should require confirmation, version pinning, and an isolated environment.
Low
ooxml.md:280
Standard device file access
find /mnt/skills -name "document.py" -path "*/docx/scripts/*" 2>/dev/null | head -1
The documentation command searches /mnt/skills and redirects errors to /dev/null. This is low-severity environment probing outside the document workflow and should not be required by default.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 High
evaluation.json:15-18evaluation.json:19-79
Prompt Injection Attempt Detected
evaluation.json embeds an audit-style claim that the skill has no security concerns, marks safe_to_publish true, and says all static findings are false positives. This can bias automated marketplace review and should not ship as skill content.
The file uses audit field names and directly asserts safe publishability plus false-positive verdicts. It is not executed, but it is untrusted content likely to influence reviewers or agents.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Unsafe archive extraction
    Replace every zipfile.extractall call with safe extraction that rejects absolute paths, parent-directory traversal, symlinks, and oversized archives before writing files.
  2. FIX-002
    High
    Privileged and global dependency installation instructions
    Remove sudo and global npm installation from normal skill workflows. Document dependencies as preconditions or require explicit user confirmation in an isolated environment.
  3. FIX-003
    High
    Embedded audit verdict content
    Remove evaluation.json from the published skill package and avoid bundling self-assessments, risk levels, or safe-to-publish claims with runtime skill content.
  4. FIX-004
    Low
    Environment probing helper command
    Avoid commands that search /mnt/skills by default. Use documented relative paths or explicit user-provided skill locations instead.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
High
evaluation.json:36
C2 keywords
"reasoning": "The scanner flags 'arabic1Minus' at dml-main.xsd:2725 as a C2 keyword. This is an OOXM
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
evaluation.json:30
Weak cryptographic algorithm
"reasoning": "The scanner flags strings like 'des', 'desc', 'sha' in XSD enumeration values. These a
Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable