Skills docx Audit History

📦

Audit History

docx - 4 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v4 Latest	Jul 21, 2026, 08:38 AM	No confirmed findings	4	No capability change
v3	Jul 8, 2026, 12:49 PM	No confirmed findings	20	Contains scripts
v2	Jul 1, 2026, 03:35 AM	3 confirmed	0	Contains scriptsExternal commandsFilesystem accessNetwork access
v1	Feb 24, 2026, 09:18 AM	No confirmed findings	0	Baseline

Audit version 4 Latest

Jul 21, 2026, 08:38 AM

Four archive-extraction calls accept Office ZIP archives without validating member paths, creating a high-confidence Zip Slip risk. The remaining 396 static matches are false positives from OOXML schemas, local document-processing code, or Markdown examples; no outbound network behavior or prompt injection was evidenced. Static review was capped at 400/450 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Files scanned

24,694

Lines analyzed

Review items

False positives ignored

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

ooxml/scripts/unpack.py:17

Archive extract all (zip slip risk)

zipfile.ZipFile(input_file).extractall(output_path)

The code calls ZipFile.extractall on an archive supplied through a file path without validating member paths. A crafted Office archive can write outside the intended extraction directory.

High

ooxml/scripts/validation/base.py:891 ooxml/scripts/validation/redlining.py:70

Archive extract all (zip slip risk) · 2 occurrences

zip_ref.extractall(temp_path)

The code calls ZipFile.extractall on an archive supplied through a file path without validating member paths. A crafted Office archive can write outside the intended extraction directory.

High

ooxml/scripts/validation/docx.py:201

Archive extract all (zip slip risk)

zip_ref.extractall(temp_dir)

The code calls ZipFile.extractall on an archive supplied through a file path without validating member paths. A crafted Office archive can write outside the intended extraction directory.

Risk Factors

🌐 Network access (50)

📁 Filesystem access (50)

⚙️ External commands (49)

ooxml/scripts/pack.py:103 ooxml/scripts/validation/redlining.py:153 ooxml/scripts/validation/redlining.py:185 SKILL.md:36-40 SKILL.md:40-46 SKILL.md:46-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51-52 SKILL.md:52 SKILL.md:59-68 SKILL.md:68-69 SKILL.md:69-71 SKILL.md:71-82 SKILL.md:82-85 SKILL.md:85-91 SKILL.md:91-96 SKILL.md:96-98 SKILL.md:98-116 SKILL.md:116-117 SKILL.md:117-132 SKILL.md:132 SKILL.md:134 SKILL.md:136-139 SKILL.md:139-141 SKILL.md:141-145 SKILL.md:145-147 SKILL.md:147-149 SKILL.md:149-152 SKILL.md:152-161 SKILL.md:161-163 SKILL.md:163-166 SKILL.md:166-168 SKILL.md:168-169 SKILL.md:169 SKILL.md:172-173 SKILL.md:173 SKILL.md:174 SKILL.md:175 SKILL.md:176-179 SKILL.md:179-181 SKILL.md:181-193 SKILL.md:193-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:193 SKILL.md:195 SKILL.md:196

Audited by: claude

Audit version 3

Jul 8, 2026, 12:49 PM

Most static findings are false positives from OOXML namespace URLs, schema imports, Markdown examples, and Word template XML. Confirmed risks remain in archive extraction, privileged install instructions, global package installation, and local command execution for document conversion or validation.

Files scanned

24,694

Lines analyzed

Review items

False positives ignored

Capability review items (20)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

ooxml/scripts/pack.py:103

Python subprocess.run

result = subprocess.run(

pack.py invokes LibreOffice through subprocess.run on a document produced by the workflow. shell=False limits injection, but it still runs an external parser on user-controlled files.

High

ooxml/scripts/unpack.py:17

Archive extract all (zip slip risk)

zipfile.ZipFile(input_file).extractall(output_path)

The code calls ZipFile.extractall on Office archives without validating member paths. A crafted archive could write files outside the intended extraction directory.

High

ooxml/scripts/validation/base.py:891 ooxml/scripts/validation/redlining.py:70

Archive extract all (zip slip risk) · 2 occurrences

zip_ref.extractall(temp_path)

The code calls ZipFile.extractall on Office archives without validating member paths. A crafted archive could write files outside the intended extraction directory.

High

ooxml/scripts/validation/docx.py:201

Archive extract all (zip slip risk)

zip_ref.extractall(temp_dir)

The code calls ZipFile.extractall on Office archives without validating member paths. A crafted archive could write files outside the intended extraction directory.

High

SKILL.md:193-194

Ruby/shell backtick execution

- **pandoc**: `sudo apt-get install pandoc` (for text extraction)

This inline command is a sudo package installation instruction. It asks for privileged system changes rather than a normal document-only action.

High

SKILL.md:195-196

Ruby/shell backtick execution

- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)

This inline command is a sudo package installation instruction. It asks for privileged system changes rather than a normal document-only action.

High

SKILL.md:196-197

Ruby/shell backtick execution

- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)

This inline command is a sudo package installation instruction. It asks for privileged system changes rather than a normal document-only action.

High

SKILL.md:193

sudo privilege escalation

- **pandoc**: `sudo apt-get install pandoc` (for text extraction)

The skill instructs users to run sudo apt-get install commands. That requires elevated privileges and expands the system trust boundary.

High

SKILL.md:195

sudo privilege escalation

- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)

The skill instructs users to run sudo apt-get install commands. That requires elevated privileges and expands the system trust boundary.

High

SKILL.md:196

sudo privilege escalation

- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)

The skill instructs users to run sudo apt-get install commands. That requires elevated privileges and expands the system trust boundary.

Medium

ooxml/scripts/unpack.py:17

Python archive libraries

zipfile.ZipFile(input_file).extractall(output_path)

This archive operation is part of a path that extracts user-supplied Office files. It should validate member paths before extraction.

Medium

ooxml/scripts/validation/base.py:890 ooxml/scripts/validation/docx.py:200

Python archive libraries · 2 occurrences

with zipfile.ZipFile(self.original_file, "r") as zip_ref:

This archive operation is part of a path that extracts user-supplied Office files. It should validate member paths before extraction.

Medium

ooxml/scripts/validation/redlining.py:69

Python archive libraries

with zipfile.ZipFile(self.original_docx, "r") as zip_ref:

This archive operation is part of a path that extracts user-supplied Office files. It should validate member paths before extraction.

Medium

SKILL.md:46-49

Ruby/shell backtick execution

`python ooxml/scripts/unpack.py <office_file> <output_directory>`

This line instructs the agent to run local document-processing scripts on user-selected Office files. That is expected functionality but still executes code and touches the filesystem.

Medium

SKILL.md:69-71

Ruby/shell backtick execution

2. Unpack the document: `python ooxml/scripts/unpack.py <office_file> <output_directory>`

This line instructs the agent to run local document-processing scripts on user-selected Office files. That is expected functionality but still executes code and touches the filesystem.

Medium

SKILL.md:71-82

Ruby/shell backtick execution

4. Pack the final document: `python ooxml/scripts/pack.py <input_directory> <office_file>`

This line instructs the agent to run local document-processing scripts on user-selected Office files. That is expected functionality but still executes code and touches the filesystem.

Medium

SKILL.md:117-132

Ruby/shell backtick execution

- **Unpack the document**: `python ooxml/scripts/unpack.py <file.docx> <dir>`

This line instructs the agent to run local document-processing scripts on user-selected Office files. That is expected functionality but still executes code and touches the filesystem.

Medium

SKILL.md:194-195

Ruby/shell backtick execution

- **docx**: `npm install -g docx` (for creating new documents)

This line instructs a global npm package installation. It modifies the execution environment and should require explicit user consent.

Risk Factors

🌐 Network access (224)

📁 Filesystem access (59)

⚙️ External commands (49)

Audited by: codex

Audit version 2

Jul 1, 2026, 03:35 AM

Static analysis reported many high-severity patterns, but most network, cryptographic, C2, and obfuscation hits are OOXML schema terms, XML namespaces, examples, or bundled templates. The confirmed concerns are legitimate but risky document-processing behavior: local command execution, archive extraction, filesystem writes, and XML mutation of user-supplied Office files.

Files scanned

24,694

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Medium

ooxml/scripts/unpack.py:15-17 ooxml/scripts/validation/base.py:886-891 ooxml/scripts/validation/docx.py:196-201 ooxml/scripts/validation/redlining.py:63-70

Archive Extraction of User-Supplied Office Files

The skill unpacks DOCX and other Office files with zip extraction into user-selected or temporary directories. This is expected for OOXML processing, but untrusted archives can create filesystem and resource-exhaustion risk if not isolated.

The extraction calls are direct and process Office files supplied to the workflow. Risk is moderated because extraction is part of normal OOXML handling and often uses temporary directories.

Medium

SKILL.md:160-167 SKILL.md:193-196 ooxml/scripts/pack.py:103-116 ooxml/scripts/validation/redlining.py:153-166

Local External Command Execution Workflow

The skill relies on local commands for conversion, validation, diffing, and dependency installation. The Python subprocess calls use fixed argument arrays, but the skill also recommends sudo package installation commands.

The commands are visible and central to the workflow. I did not find shell=True or user-controlled command names in the reviewed subprocess calls.

Medium

scripts/utilities.py:206-224 scripts/utilities.py:227-249 scripts/utilities.py:312-337 ooxml.md:462-467

Direct OOXML Fragment Insertion

The document helper parses caller-provided XML fragments and inserts them into Office XML documents. This enables powerful editing, but malformed or unsafe relationships can corrupt documents or embed unexpected external references.

The insertion behavior is explicit and intended. The risk depends on how generated XML fragments are constrained during use.

Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

ooxml/scripts/validation/base.py:70-103 ooxml/schemas/microsoft/wml-2012.xsd:1-3 scripts/document.py:92-113

Hardcoded URL Findings Are Mostly OOXML Namespaces

The hardcoded URLs reviewed are schema and namespace identifiers used by OOXML validators and templates. I did not find evidence that these lines perform network requests.

The cited values are static XML namespaces or schema locations, not outbound HTTP calls. No request library usage was identified at these lines.

Low

scripts/utilities.py:290-300 scripts/document.py:116-128 ooxml/schemas/ISO-IEC29500-4_2016/wml.xsd:769-778

Weak Cryptography Findings Are OOXML Terminology

Many weak-crypto hits are words such as id, hash, or schema names inside document standards and helper comments. I did not find evidence of custom password hashing or cryptographic verification logic.

The reviewed code generates OOXML relationship and revision identifiers, not security tokens. Schema matches are document vocabulary, not application cryptography.

Low

scripts/templates/comments.xml:2 scripts/templates/commentsExtended.xml:2 ooxml/schemas/ecma/fouth-edition/opc-contentTypes.xsd:1

Obfuscation Heuristics Match Long XML Templates

The long-line and bracket-chain warnings correspond to minified XML templates and schema files. I did not find prompt injection text or hidden instructions in the reviewed skill instructions.

The flagged files are templates and schemas with dense XML formatting. The SKILL.md instructions are operational documentation, not an attempt to override this audit.

Risk Factors

⚡ Contains scripts (3)

ooxml/scripts/unpack.py:1-29 ooxml/scripts/pack.py:1-159 scripts/document.py:1-39

⚙️ External commands (4)

SKILL.md:193-196 ooxml/scripts/pack.py:103-116 ooxml/scripts/validation/redlining.py:153-166 ooxml/scripts/validation/redlining.py:185-197

📁 Filesystem access (4)

ooxml/scripts/unpack.py:15-24 ooxml/scripts/validation/base.py:886-891 ooxml/scripts/validation/docx.py:196-205 scripts/document.py:640-646

🌐 Network access (3)

ooxml/scripts/validation/base.py:70-103 ooxml/schemas/microsoft/wml-2012.xsd:1-3 scripts/document.py:92-113

Detected Patterns

zipfile.extractall on Office ArchivesSubprocess Calls to Local ToolsElevated Dependency Installation Guidance

Audited by: codex

Audit version 1

Feb 24, 2026, 09:18 AM

This is a legitimate document manipulation skill for creating and editing Microsoft Word (.docx) files. Static scanner flagged external commands (pandoc, Python scripts), network URLs (XML namespace references in schema files), and filesystem operations (document read/write) - all are expected functionality for this skill. The cryptographic algorithm references in XSD schemas are standard XML schema definitions, not actual implementations. No malicious intent detected.

Files scanned

24,694

Lines analyzed

Review items

False positives ignored

No confirmed security findings were recorded for this completed audit.

Audited by: claude

← Back to Skill