Data Analyzer Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 2.0.0

Overview

The skill is a coherent data-analysis helper, but its report-writing path can overwrite arbitrary writable local files and its activation/manifest disclosures are too broad for that behavior.

Review before installing. Use this only with datasets and output paths you choose explicitly, avoid broad auto-invocation, and do not let untrusted prompts or data choose the report filename. A safer version should restrict report output to a dedicated directory and require confirmation before overwriting files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:143

Finding

Unrestricted Report Path Allows Arbitrary File Overwrite

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 143–145
Vulnerability Type: Arbitrary file overwrite through an unvalidated output path
Risk Level: Medium

Complete Code Snippet:

python

if output:
    with open(output, "w", encoding="utf-8") as f:
        json.dump(report, f, ensure_ascii=False, indent=2)

Technical Analysis

The report() method accepts a caller-supplied output path and opens it in truncating write mode ("w"). The implementation does not constrain the destination to an approved directory, normalize and validate the path, reject symbolic links or traversal sequences, check whether the destination already exists, or request confirmation before replacing it.

Consequently, any caller capable of controlling the output argument can direct the process to replace an arbitrary file writable by the Agent's operating-system account. The replacement content is limited to the generated JSON report, so this is an arbitrary-location overwrite rather than an arbitrary-content write.

Attack Path

1. An attacker influences the report destination supplied to DataAnalyzer.report().
2. The attacker provides a traversal path, absolute path, or path to a symbolic link targeting an existing writable file.
3. open(output, "w") follows the supplied path and immediately truncates the target.
4. json.dump() replaces the target's prior contents with the generated analysis report.
5. A configuration file, project artifact, data file, or writable script may consequently become corrupted or unusable.

Exploitation requires control over the output argument and write permission to the selected target through the Agent process.

Impact Assessment

The vulnerability does not independently grant additional operating-system privileges. Its scope is limited to files writable by the account running the Skill. Within that boundary, exploitation can cause data loss, configuration co ...[truncated 235 chars]

Remediation

View remediation

Remediation Suggestions

• Write reports only beneath a dedicated, application-controlled output directory.
• Resolve the canonical destination and verify that it remains inside the approved directory before opening it.
• Reject absolute paths, parent-directory traversal, and unexpected filename characters.
• Prevent symbolic-link attacks by rejecting symlink destinations and using platform-supported no-follow semantics where available.
• Use exclusive creation mode ("x") when replacement is unnecessary.
• If replacement is supported, require explicit overwrite authorization and validate that the existing destination is an expected regular file.
• Run the Skill with least-privilege filesystem permissions.
• Consider generating the report in a safely created temporary file and atomically moving it to the validated destination.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises local persistence of results and the implementation writes JSON reports to an arbitrary output path, but the documentation does not clearly warn users that files may be created or overwritten. This can lead to unexpected local data exposure, accidental overwrites, or persistence of sensitive analytical results on disk, especially if the skill is auto-invoked from broad trigger phrases.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation phrases include very generic triggers such as '分析数据', 'data analyze', and '统计', which are common in ordinary user requests and can cause the skill to activate unintentionally. In a skill that reads files and can write analysis output locally, accidental activation expands the chance of processing unintended data or creating files without the user clearly intending to invoke this specific capability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill context describes a data-analysis tool that loads CSV/JSON, computes statistics, performs anomaly detection and trend analysis, and persists results locally. In contrast, hub.json describes the skill only as a "Premium version with full implementation, examples, and enterprise support," which is a packaging/marketing statement rather than the skill's functional behavior.

Content

No source excerpt is available for this finding.