724-office-ai-agent
Fail
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill features a built-in
exectool that allows for the execution of arbitrary Python code within the application process.\n- [REMOTE_CODE_EXECUTION]: Thecreate_toolfunction enables the agent to dynamically generate, save, and hot-load new Python modules at runtime. This behavior incorporates untrusted input from conversations into executable code.\n- [EXTERNAL_DOWNLOADS]: The installation process requires cloning a repository from an unverified external source (github.com/wangziqi06/724-office.git).\n- [COMMAND_EXECUTION]: The configuration supports connecting to Model Context Protocol (MCP) servers using system commands likenpx, which can be leveraged for arbitrary command execution.\n- [DATA_EXFILTRATION]: Given the arbitrary code execution capabilities, sensitive environment variables likeOPENAI_API_KEYandWXWORK_CORP_SECRETare at risk of being accessed and transmitted to external endpoints.\n- [PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection. * Ingestion points: Untrusted data from user messages, files, and retrieved memory (SKILL.md). * Boundary markers: None identified in the operational guidelines. * Capability inventory: Arbitrary Python execution (exec) and file system modification (create_tool). * Sanitization: No sanitization or validation of user-provided code logic is implemented.
Recommendations
- AI detected serious security threats
Audit Metadata