此报告尚无所请求语言的翻译，当前显示规范英文报告。
- 技能名称
- docx
- 版本
- v11
- 维护者
- davila7
- 覆盖范围
- 59 已扫描文件 · 24,759 分析行数
- 策略版本
- 不可用
已确认问题的最高严重性
中
有 1 个已确认的安全问题需要处理。
安装上下文
历史证据
本报告可能无法描述当前可安装的 artifact。请打开当前 Skill 详情页查看安装建议。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
Most static findings are false positives from OOXML schemas, XML namespace URLs, markdown command examples, and normal document filesystem operations. Confirmed issues remain for unsafe ZIP extraction of user-supplied Office archives, routine external command instructions, sudo package installation guidance, and one fragile path normalization pattern. Static review was capped at 400/452 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
报告位置
历史报告
使用本报告安装前，请先查看审计历史。
审计证明
无法签发证明
所需的不可变绑定不完整。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
59 已扫描文件 · 24,759 分析行数
有 28 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
绑定不可用
构件
身份信息不完整
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 50 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
在 47 个证据位置观察到
环境变量
可能读取进程环境中的值。
本次审计未记录
外部命令
可能调用 Skill 之外的命令或程序。
在 51 个证据位置观察到
能力复核项 (27)
高
Archive extract all (zip slip risk)
zipfile.ZipFile(input_file).extractall(output_path)
The code extracts user-supplied Office archives with extractall() and does not validate member paths first. A crafted .docx/.pptx/.xlsx ZIP could write outside the intended output directory.
高
Archive extract all (zip slip risk)
zip_ref.extractall(temp_path)
The code extracts user-supplied Office archives with extractall() and does not validate member paths first. A crafted .docx/.pptx/.xlsx ZIP could write outside the intended output directory.
高
Archive extract all (zip slip risk)
zip_ref.extractall(temp_dir)
The code extracts user-supplied Office archives with extractall() and does not validate member paths first. A crafted .docx/.pptx/.xlsx ZIP could write outside the intended output directory.
高
Archive extract all (zip slip risk)
zip_ref.extractall(temp_path)
The code extracts user-supplied Office archives with extractall() and does not validate member paths first. A crafted .docx/.pptx/.xlsx ZIP could write outside the intended output directory.
高
Path traversal sequence
<xsd:import namespace="http://schemas.openxmlformats.org/markup-compatibility/2006" schemaLocation="
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import id="w" namespace="http://schemas.openxmlformats.org/wordprocessingml/2006/main" schemaLo
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import id="w12" namespace="http://schemas.openxmlformats.org/wordprocessingml/2006/main" schema
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import namespace="http://schemas.openxmlformats.org/officeDocument/2006/sharedTypes" schemaLoca
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import id="w12" namespace="http://schemas.openxmlformats.org/wordprocessingml/2006/main" schema
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import id="w" namespace="http://schemas.openxmlformats.org/wordprocessingml/2006/main" schemaLo
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import id="s" namespace="http://schemas.openxmlformats.org/officeDocument/2006/sharedTypes" sch
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import id="w12" namespace="http://schemas.openxmlformats.org/wordprocessingml/2006/main" schema
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import id="w12" namespace="http://schemas.openxmlformats.org/wordprocessingml/2006/main" schema
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
<xsd:import id="w12" namespace="http://schemas.openxmlformats.org/wordprocessingml/2006/main" schema
The static pattern could not be fully resolved from the available context, so it is kept for review under a fail-closed policy.
高
Path traversal sequence
normalized_target = target.replace("../", "")
The code normalizes relationship targets by simply removing '../', which is not a safe path canonicalization pattern. It appears limited to validation bookkeeping, but the pattern is fragile enough to keep for author review.
高
sudo privilege escalation
- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
The skill documentation tells users to install system packages with sudo apt-get. This is not malware, but marketplace skills should not encourage privilege escalation during routine use without strong warnings.
高
sudo privilege escalation
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
The skill documentation tells users to install system packages with sudo apt-get. This is not malware, but marketplace skills should not encourage privilege escalation during routine use without strong warnings.
高
sudo privilege escalation
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
The skill documentation tells users to install system packages with sudo apt-get. This is not malware, but marketplace skills should not encourage privilege escalation during routine use without strong warnings.
高
Python archive libraries
zipfile.ZipFile(input_file).extractall(output_path)
This zipfile use extracts archive contents without member path validation. Office files are ZIP archives, so crafted input can trigger zip-slip style writes.
中
Ruby/shell backtick execution
`python ooxml/scripts/unpack.py <office_file> <output_directory>`
The documentation instructs users or agents to run local external commands. These are legitimate document tools, but still create execution and file-processing risk in a marketplace skill.
中
Ruby/shell backtick execution
2. Unpack the document: `python ooxml/scripts/unpack.py <office_file> <output_directory>`
The documentation instructs users or agents to run local external commands. These are legitimate document tools, but still create execution and file-processing risk in a marketplace skill.
中
Ruby/shell backtick execution
4. Pack the final document: `python ooxml/scripts/pack.py <input_directory> <office_file>`
The documentation instructs users or agents to run local external commands. These are legitimate document tools, but still create execution and file-processing risk in a marketplace skill.
中
Ruby/shell backtick execution
- **Unpack the document**: `python ooxml/scripts/unpack.py <file.docx> <dir>`
The documentation instructs users or agents to run local external commands. These are legitimate document tools, but still create execution and file-processing risk in a marketplace skill.
中
Ruby/shell backtick execution
- **pandoc**: `sudo apt-get install pandoc` (for text extraction)
The documentation instructs users or agents to run local external commands. These are legitimate document tools, but still create execution and file-processing risk in a marketplace skill.
中
Ruby/shell backtick execution
- **docx**: `npm install -g docx` (for creating new documents)
The documentation instructs users or agents to run local external commands. These are legitimate document tools, but still create execution and file-processing risk in a marketplace skill.
中
Ruby/shell backtick execution
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
The documentation instructs users or agents to run local external commands. These are legitimate document tools, but still create execution and file-processing risk in a marketplace skill.
中
Ruby/shell backtick execution
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
The documentation instructs users or agents to run local external commands. These are legitimate document tools, but still create execution and file-processing risk in a marketplace skill.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (1)
RISK-001 中
Unverified cross-skill AI image generation
SKILL.md instructs agents to use the scientific-schematics skill and Nano Banana Pro by default for new documents. This may send document concepts to another AI workflow without explicit user confirmation.
The text explicitly recommends AI-powered schematic generation and shows a command to generate an image from a natural language description. The exact transport is outside this skill, so the risk is contextual rather than directly proven data exfiltration.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001高Unsafe archive extraction with extractall()Validate every ZIP member path before extraction and reject absolute paths, drive prefixes, symlinks, and paths that resolve outside the intended output directory.
- FIX-002中Static review cappedManually review the omitted 52 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-003中Privilege-escalating dependency instructionsReplace sudo apt-get examples with safer installation guidance, explicit user confirmation, and links to trusted package documentation.
- FIX-004中External command execution in workflowsState which commands will run, require user approval for conversions and installs, and keep arguments as fixed arrays without shell interpolation.
- FIX-005中Default cross-skill AI image generationRequire explicit user consent before using scientific-schematics or any external AI image workflow on document content.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 不可用
- 内容哈希
- 不可用
- 目录树哈希
- 不可用
- Skill 路径
- 不可用
- 审计载荷哈希
- 不可用
分析元数据
审计模型: claude
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: not_attestable