docx

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill explicitly instructs using the assistant name "Claude" as the default author for tracked changes/comments and provides automated tooling/macros to accept (remove) tracked changes, which is suspicious steering that could enable misattribution or hiding edits without clear malicious intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The DOCX skill’s runtime flow reads and processes free text embedded inside user-supplied .docx content by unpacking XML (e.g., scripts/office/unpack.py/XML edits) and then validating/repairing it, so outsider-authored text can be ingested without selecting a specific item.