T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query_data.py:70- Finding
User-Controlled Regular Expression Enables Denial of Service
- Content
View full analysis
- Remediation
View remediation
Security audit
ask-data
Security checks for vulnerabilities and agentic risk
Overview
This skill reads user-selected Excel files to answer data questions, with disclosed local-file access and no evidence of hidden persistence, network exfiltration, or file modification.
Install only if you are comfortable letting the skill read the Excel files you explicitly provide. Avoid very large or untrusted workbooks, and do not use it on files containing sensitive rows if showing sample data back to the agent would be inappropriate.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query_data.py:157- Finding
Unbounded Excel Worksheet Loading Enables Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述的是一个面向用户问句的数据分析/查询能力，例如回答“昨天DAU多少”或“最近7天新增用户趋势”，这需要解析自然语言、将其转成查询、对Excel数据进行计算，并可能输出图表。实际代码没有任何问句处理、查询转换、指标计算、趋势分析或图表生成逻辑。它只是读取本地Excel文件，检查扩展名，遍历sheet，并返回列信息与少量样本数据。虽然这可能是数据问答系统的底层辅助步骤，但就该代码块本身而言，其主要行为与声明的核心用途存在明显差异，因此应判定为不匹配。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill activates for data-related questions such as “查询数据,” which is a very generic phrase and can overlap with ordinary conversation. The trigger guidance does not provide clear boundaries or negative examples to distinguish when this skill should activate versus when another general assistant behavior should apply.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill states “理解中文自然语言查询,” which constrains operation to Chinese-language queries without offering the user a language choice or documenting a justified locale restriction. This is a natural-language policy concern because it imposes a language requirement by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file is entirely written as Chinese-only user query examples and follow-up handling patterns, with no indication that other languages are supported or that Chinese is an optional locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains natural-language instructions and usage text exclusively in Chinese, including the module docstring and query format description. Under the language/locale policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The command-line error output shown to users is only in Chinese and does not offer a language choice. This creates a language-policy issue because the skill enforces a locale in user-facing interaction without opt-in or clear regional justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script returns column samples and the first five records from every sheet directly to stdout as JSON, which can expose sensitive workbook contents such as PII, credentials, financial data, or internal business information. In this skill’s context, the tool is designed for natural-language querying over local Excel files, so automatic extraction and display of sample data increases the chance of unnecessary data disclosure beyond what the user explicitly asked for.
- Content