保险顾问助手Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

This insurance-advisor skill has a coherent purpose, but it handles health and financial KYC data and recommends cloud report export without adequate privacy and sharing controls.

Review this skill carefully before installing. It is not deceptive or destructive, but users should only use it with clear customer consent, avoid uploading full health and financial records to Feishu or email unless the destination and sharing settings are verified, and prefer minimizing or redacting sensitive fields in generated reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_report.py:24

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_report.py:24-26
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

python

except ImportError:
    print("Error: reportlab not installed. Run: pip install reportlab")
    sys.exit(1)

Technical Analysis

When ReportLab is unavailable, the script instructs the user to install it directly from the default Python package index without specifying a reviewed version, verifying package hashes, requiring a trusted index, or using a lock file.

The command therefore resolves mutable third-party content at installation time. Although the project does not automatically execute the installation command, following its explicit recovery instructions can run package installation or build logic supplied by the resolved package version.

Attack Path

1. A user invokes the report generator in an environment where ReportLab is not installed.
2. The script terminates and instructs the user to run pip install reportlab.
3. Pip resolves the current package from its configured indexes without a version or hash constraint.
4. If an upstream release, configured index, dependency, or distribution artifact has been compromised, its installation or runtime code executes.
5. The malicious code operates with the privileges of the user running pip or the report generator.

Impact Assessment

Successful supply-chain exploitation could execute arbitrary code with the invoking user's privileges. This could expose customer KYC files, generated reports, environment credentials, and other files accessible to that account. The project itself contains no evidence that ReportLab is currently malicious, so exploitation depends on compromise or unsafe configuration of the external package supply chain.

Remediation

View remediation

Remediation Suggestions

• Declare ReportLab in a reviewed dependency manifest rather than providing an unconstrained installation command.
• Pin an exact reviewed version.
• Require package hashes through a hash-locked requirements file.
• Install dependencies from a trusted, explicitly configured package index.
• Use an isolated virtual environment or container with least privilege.
• Add automated vulnerability and integrity scanning for direct and transitive dependencies.
• Replace the message with a reproducible command such as installation from a project-maintained lock file.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:236

Finding

Sensitive Insurance KYC Data May Be Transmitted to an External Cloud Document Without Explicit Privacy Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:236-271
Vulnerability Type: Insufficient protection for externally transmitted health and financial data
Risk Level: Medium

text

feishu_doc action=create title="保险方案建议书" content="完整markdown内容"

feishu_doc action=write doc_token=<文档token> content="完整markdown内容"

feishu_doc action=append doc_token=<文档token> content="补充内容"

The complete workflow also directs the Skill to collect real names, medical history, family medical history, examination abnormalities, income, debt, existing insurance, and customer communication records.

Technical Analysis

The documented workflow recommends placing the complete insurance proposal into Feishu, an external cloud document service. The report can contain identity information, health information, family information, and financial information.

The workflow asks whether the user wants a report generated, but it does not require separate informed consent for transferring sensitive data to an external provider. It also does not define field minimization, pseudonymization, document access restrictions, sharing controls, retention periods, deletion procedures, or verification of the destination workspace and recipients.

Consent to generate a report is not necessarily equivalent to informed consent to upload complete health and financial records to a third-party cloud service.

Attack Path

1. The Skill collects a customer's identity, medical, family, income, debt, and insurance information.
2. The customer or advisor agrees to generate a report without receiving an explicit cloud-transfer disclosure.
3. The complete report content is supplied to the Feishu document API.
4. The resulting document inherits workspace, account, link-sharing, or collaborator permissions.
5. An unintended collaborator, broadly shared workspace member, compromised account, or incorrectly configured sharing link gains access to the ...[truncated 655 chars]

Remediation

View remediation

Remediation Suggestions

• Default to local report generation unless the user explicitly requests cloud publication.
• Before transmission, clearly identify Feishu as an external processor and obtain specific consent to upload the listed categories of personal data.
• Minimize exported fields and omit real names, detailed medical history, and financial details unless strictly necessary.
• Offer pseudonymized reports and a preview showing exactly what will be uploaded.
• Verify the destination tenant, document owner, collaborators, and link-sharing settings before writing content.
• Apply least-privilege document permissions and disable public or organization-wide sharing by default.
• Define retention and deletion periods and provide a documented deletion mechanism.
• Encrypt sensitive local inputs and outputs and avoid recording complete KYC content in operational logs.
• Require authorization before each additional write or append operation involving sensitive information.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_report.py:279

Finding

Untrusted Report Text Is Passed Directly to the ReportLab Paragraph Markup Parser

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_report.py:279-281
Vulnerability Type: Unvalidated markup processing
Risk Level: Low

python

for notice in notices:
    story.append(Paragraph(notice, styles['BodyText']))
    story.append(Spacer(1, 0.2*cm))

The same pattern is also used for customer names and recommendation strategy text at lines 111 and 255.

Technical Analysis

ReportLab's Paragraph class interprets a supported XML-like markup language rather than treating every input value as literal text. Values originating in the input JSON are passed directly to this parser without XML escaping, schema validation, type enforcement, markup allowlisting, or input-length limits.

An attacker who controls a notice, customer name, or recommendation field can supply malformed or excessively complex markup. Depending on the ReportLab version and payload, this can produce parser exceptions, malformed report output, or excessive processing and memory use. No evidence establishes arbitrary native code execution through this path.

Attack Path

1. An attacker or untrusted integration creates an input JSON report definition.
2. A controlled field contains malformed, deeply nested, oversized, or otherwise parser-intensive ReportLab markup.
3. The report generator loads the JSON without schema or size validation.
4. The controlled value is passed directly to Paragraph.
5. The markup parser raises an exception, consumes excessive resources, or produces manipulated report formatting.
6. Report generation fails or creates unreliable output.

Impact Assessment

The primary impact is local denial of service against the report-generation process and loss of report integrity. The attacker may prevent a report from being produced or manipulate the presentation of attacker-controlled sections. The issue does not directly grant additional system privileges, and its practical scope is limited to ...[truncated 88 chars]

Remediation

View remediation

Remediation Suggestions

• Validate input JSON against a strict schema before generating a report.
• Require expected scalar types and reject objects or arrays where strings are expected.
• XML-escape all untrusted values before passing them to Paragraph.
• If formatting is required, permit only a narrowly defined markup allowlist.
• Enforce reasonable per-field and total-document size limits.
• Limit nesting and the number of report elements.
• Catch ReportLab parsing exceptions and return a controlled error without exposing sensitive input.
• Add tests using malformed tags, oversized strings, nested markup, and unexpected JSON types.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is designed to collect highly sensitive personal, financial, and health data during KYC and underwriting-style questioning, but it does not require an upfront privacy notice, consent flow, retention policy, or restriction on unnecessary collection. In this context, that creates a real privacy and compliance risk because users may disclose protected or regulated data without understanding how it will be stored, processed, or shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to generate reports and share them through Feishu documents and possibly email, which introduces transmission of sensitive customer KYC, health, and financial information to external systems without any explicit warning, consent checkpoint specific to third-party sharing, or safeguards around destination validation. Because the skill handles insurance planning data, unauthorized or unclear external transfer could expose regulated personal and health information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The SOP instructs advisers to collect large amounts of highly sensitive personal, health, and financial data, but it does not include any privacy notice, consent requirement, retention limit, access-control guidance, or secure handling instructions. In an insurance context this is especially risky because health and financial data are regulated, valuable, and harmful if over-collected, mishandled, or reused without authorization.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains user-facing docstrings, generated report headings, notices, status messages, and usage text entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code file contains user-facing natural-language descriptions and recommendation reasons exclusively in Chinese, including the module description and output rationale strings. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This JSON asset is entirely encoded with Chinese-language insurer names, product names, categories, and target groups, with no indication that the skill is region-specific or that alternative locales are supported. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All natural-language instructions and templates in the file are presented only in Chinese, which can amount to a language-policy constraint if users are not explicitly opting into that locale. The file does not state that the skill is China-specific or otherwise limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.