skills/haomingz/kimi-skills/docx/Gen Agent Trust Hub

docx

Warn

Audited by Gen Agent Trust Hub on Nov 2, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The bash entry point script (scripts/docx) downloads a .NET environment setup script from a well-known technology service domain (dot.net) to ensure the necessary runtime is available for the skill's C# components.
  • [DYNAMIC_EXECUTION]: For the creation of new documents, the skill generates C# source code in assets/templates/Program.cs which is then compiled and executed at runtime using build tools.
  • [DYNAMIC_EXECUTION]: The skill includes and executes pre-compiled binary files located in the validator directory (including an ELF executable and multiple DLLs) to verify document integrity against OpenXML standards.
  • [COMMAND_EXECUTION]: The skill executes external command-line utilities such as pandoc (via Python's subprocess.run) and libreoffice to perform document format conversions and structural analysis.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Markdown and Word documents provided by the user. While it uses structural identifiers and localized editing windows to manage content, the ingestion of untrusted data from document editing or conversion tasks presents a surface for potential indirect instruction influence during agent processing.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 2, 2026, 12:33 AM