deai-office
Fail
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
extract_zipfunction insanitize.pyemployszipfile.ZipFile.extractall(), which is vulnerable to the 'Zip Slip' path traversal attack. A maliciously crafted Office file (which is a ZIP archive) can contain entries with relative path sequences like../../to escape the temporary directory and overwrite sensitive files elsewhere on the filesystem.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of untrusted data from user-supplied Office documents.\n - Ingestion points: The
sanitize.pyscript reads multiple XML files (document.xml,app.xml,core.xml, etc.) from within the extracted archive to perform fingerprint scanning and metadata updates.\n - Boundary markers: No markers or instructions are utilized to differentiate untrusted XML content from the script's logic.\n
- Capability inventory: The script possesses extensive file system read/write capabilities and executes with the privileges of the user environment.\n
- Sanitization: The script relies on basic regular expressions for manipulation and lacks structural validation or sanitization of the input XML before processing.
Recommendations
- AI detected serious security threats
Audit Metadata