Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent local advertising-data analyzer, but it writes business/financial data into unescaped HTML reports that can run injected browser content if the input files are malicious or contaminated.
Review this skill before installing if it will process untrusted spreadsheets or reports. Generated HTML reports should be treated as active browser content; avoid opening reports made from third-party or untrusted data until the report generator escapes all dynamic values or uses a restrictive content security policy. Also consider pinning dependencies and choosing a controlled output directory for sensitive business data.
{super_df.head().to_string() if not super_df.empty else '无数据'}
淘宝直播数据（前5行）
text
{taobao_df.head().to_string() if not taobao_df.empty else '无数据'}
财务报表数据（前5行）
text
{financial_df.head().to_string() if not financial_df.empty else '无数据'}
```
### Technical Analysis
The report generator interpolates dynamic values directly into an HTML document without HTML escaping. The affected values include:
- The `date_range` value supplied through an environment variable or command-line argument.
- DataFrame column names and cell values loaded from input data files.
- The first five rows of each advertising or financial dataset.
An HTML `text
` element preserves formatting but does not treat its contents as inert text. An attacker-controlled value containing markup such as:
```html
text
```
can terminate the existing `text
` element and introduce executable HTML or JavaScript into the generated report.
Because the payload is saved in the report, this is a stored injection issue: execution occurs when a user opens the generated HTML file in a browser. The application does not add a Content Security Policy that would prevent inline script execution.
### Attack Path
1. An attacker creates or modifies a CSV file whose filename contains one of the recognized keywords, such as the keyword for a live-stream or financial report.
2. The attacker places a malicious HT
...[truncated 1553 chars]
Remediation
View remediation
Advertising Data Analysis Report - {safe_date_range}
text
{safe_super_preview}
```
3. Prefer structured DataFrame rendering with escaping enabled:
```python
super_preview = (
super_df.head().to_html(index=False, escape=True)
if not super_df.empty
else "
No data
"
)
```
Apply the same protection to the Taobao and financial previews, metric names, recommendation text, date ranges, and any other dynamic values added to the report.
4. Validate `date_range` against the documented format before using it:
```python
import re
if not re.fullmatch(r"\d{4}-\d{2}-\d{2}:\d{4}-\d{2}-\d{2}", date_range):
raise ValueError("Invalid date range format")
```
5. Add a restrictive Content Security Policy to reduce the impact of any future escaping mistake:
```html
```
6. Add regression tests using payloads in the date range, column names, and cell values. Verify that generated reports contain encoded forms such as `<script>` and do not contain executable attacker-supplied elements.
]]>
The module docstring and user-facing console messages indicate the skill is intended to operate in Chinese only. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
This file contains natural-language documentation and runtime messages exclusively in Chinese, beginning with the module docstring and continuing throughout the code. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
This code file contains natural-language descriptions and user-facing output entirely in Chinese, including the module docstring and CLI/help text. Under the policy rule for language/locale, forcing a single language without user opt-in can be a violation when no language choice or justification is provided.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The module docstring and generated report content are entirely in Chinese, and report filenames/titles are hard-coded in Chinese without any indication that the user can choose another language. Under the policy, forcing a specific language without opt-in is a locale/language policy concern unless the restriction is explicitly justified.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The file’s natural-language description and all user-facing strings are exclusively in Chinese, indicating the skill is designed to operate in a fixed language/locale. Under the policy, forcing a specific language without user opt-in or justification is a reportable natural-language policy issue.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The file's natural-language descriptions and user-facing messages are entirely in Chinese, including the module docstring and function docstring, with no indication that language choice is configurable or optional. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
This Python file contains user-facing descriptions and usage instructions entirely in Chinese, including the module docstring and all printed guidance. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
A natural-language policy violation can occur when a skill effectively forces a specific language without offering user choice or documenting a justified locale constraint. This document presents all instructions, labels, and examples only in Chinese, with no indication that the skill supports other languages or that Chinese is a documented, required locale.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
88% confidence
Finding
The skill explicitly states that it will save an HTML report to the desktop, but it does not clearly warn the user that local files will be written or provide an explicit output path confirmation step. While this is not inherently malicious, undocumented local file writes can surprise users, expose sensitive report contents on shared machines, or overwrite expected workspace boundaries.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
96% confidence
Finding
This Python file contains natural-language descriptions exclusively in Chinese, including the module description and function docstrings, with no indication that the skill is region-specific or that users may choose another language. The policy for this category flags language or locale constraints when they are imposed without opt-in or clear justification.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
88% confidence
Finding
This Python file contains natural-language descriptions and field labels exclusively in Chinese, but does not document that the skill is China/Chinese-specific or provide any user language/locale choice. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
89% confidence
Finding
The code generates and saves an HTML report to disk, but the only disclosure is an internal docstring; there is no confirmation prompt, logging, or user-facing notice at the write point. Because the report includes data samples and metrics, users are not explicitly warned in code that analysis data will be persisted locally.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
90% confidence
Finding
The function creates one or more CSV files from computed metrics and writes them to the filesystem, but provides no confirmation prompt, logging, or explicit user notice at export time. This is a file-write operation affecting user data artifacts, so some visible disclosure is expected under the rule.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
85% confidence
Finding
The natural-language comments in the file are entirely in Chinese, including the skill description reference, which suggests a fixed language/locale without any visible opt-in or justification. Under the policy, forcing a specific language without user choice can be a locale-policy issue even in non-executable files.
Content
No source excerpt is available for this finding.
Unpinned Dependencies
Low
Category
Supply Chain
Confidence
90% confidence
Finding
Using a minimum-version specifier for pandas allows future installs to resolve to different versions over time, which harms reproducibility and can silently introduce vulnerable or breaking releases. In a supply-chain context, unpinned dependencies make it harder to verify exactly what code will be installed and audited.
Content
Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
Category
Supply Chain
Confidence
80% confidence
Finding
Because pandas is not pinned, it is impossible to determine from this manifest alone whether deployment will use a version affected by known advisories. The risk is contextual rather than proof of an actively vulnerable version, but the lack of version certainty prevents meaningful assurance.
Content
No source excerpt is available for this finding.
Unpinned Dependencies
Low
Category
Supply Chain
Confidence
90% confidence
Finding
Using numpy>=1.21.0 leaves dependency resolution open-ended, so builds may pull in unexpected versions with different security properties. This weakens supply-chain control and makes incident response and auditing significantly harder.
Content
Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
Category
Supply Chain
Confidence
83% confidence
Finding
Numpy has multiple historical advisories, and the manifest does not establish which exact version will be installed. That uncertainty makes the package set unverifiable and could allow an affected release into the environment depending on resolver behavior.
Content
No source excerpt is available for this finding.
Unpinned Dependencies
Low
Category
Supply Chain
Confidence
88% confidence
Finding
An unpinned chardet dependency permits non-deterministic installs and reduces assurance that the deployed package version has been reviewed. Even if chardet is lower risk than some libraries, the pattern still increases supply-chain exposure.
Content
Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.
Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
Category
Supply Chain
Confidence
84% confidence
Finding
openpyxl processes Excel content, and historical XML-related issues make version certainty especially important when handling untrusted spreadsheets. Since the manifest does not pin the exact release, the deployment could unknowingly include a vulnerable version.
Content
No source excerpt is available for this finding.
Unpinned Dependencies
Low
Category
Supply Chain
Confidence
88% confidence
Finding
python-dateutil specified with only a lower bound can resolve to any newer release, preventing reliable verification of the installed software set. This creates avoidable supply-chain uncertainty and may introduce vulnerable or incompatible versions.
Content
Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.
Unverifiable Dependency: tqdm has 4 known advisory(ies) (CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2016-10075 (TDQM Arbitrary Code Execution); CVE-2016-10075 (The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to e) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
Category
Supply Chain
Confidence
82% confidence
Finding
tqdm has had past advisories, and the absence of an exact version prevents confirmation that only safe releases will be installed. Even if exploitability depends on specific usage patterns, the manifest currently provides insufficient supply-chain assurance.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Low
Category
Not specified by scanner
Confidence
81% confidence
Finding
The module docstring describes the skill as a simplified data analysis tool, and the function docstring at L14 similarly says only 'simplified analysis'. However, the code also performs a side effect by writing a report to ~/Desktop at L67-L82. This is not just omitted detail in comments when the stated intent emphasizes only analysis-focused behavior.
