word-reader

Warn

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The install.sh script and the metadata in SKILL.md instruct the user or system to use sudo for administrative tasks such as apt update and installing system-level packages like python3-pip and antiword.
  • [COMMAND_EXECUTION]: The core logic in scripts/read_word.py utilizes the subprocess module to execute external system binaries (antiword and which) to handle legacy .doc file formats.
  • [PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by extracting and presenting raw text from untrusted Word documents to the AI agent context.
  • Ingestion points: Document parsing in scripts/read_word.py via python-docx and antiword.
  • Boundary markers: None. Extracted text and table data are output directly without being wrapped in delimiters or accompanied by instructions to ignore embedded commands.
  • Capability inventory: The skill can execute local Python scripts, perform file system operations, and potentially chain with other agent tools if instructions in the documents are followed.
  • Sanitization: Content is extracted and returned in its original form without filtering or safety validation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 23, 2026, 02:04 PM