Security audit

金蝶云星空 ERP Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Kingdee ERP helper, but it teaches high-impact ERP approvals/record changes and broad data exports without enough confirmation, scoping, or data-handling safeguards.

Review this skill before installing in a production ERP environment. Use query-only MCP credentials by default, require explicit confirmation before any save/submit/audit/unaudit action, verify exact form IDs and document numbers, avoid bulk approvals unless separately approved, and treat exported ERP/customer data as sensitive with approved paths, restricted permissions, and cleanup.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:65
Finding: Predictable Plaintext Temporary Files for Sensitive ERP Exports
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:180
Finding: High-Impact ERP Mutations Lack Explicit Authorization and Confirmation Safeguards
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly documents state-changing ERP actions such as save, submit, audit, and batch audit without requiring user confirmation, authorization checks, or a warning that these operations can alter business records. In an ERP context, these actions can approve documents, progress workflows, and potentially trigger downstream financial, inventory, or fulfillment effects, so omission of confirmation guidance materially increases the risk of unintended or unauthorized changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire document, including headings, error descriptions, and remediation steps, is written only in Chinese. Because no opt-in, alternative language, or justification for a Chinese-only locale is provided, this appears to impose a specific language on users and matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This guide explicitly provides examples for querying customer birthdays and suggests adding contact-related custom fields, which can expose personally identifiable information without any privacy, authorization, or minimum-necessary-use warning. In an ERP skill context, this lowers friction for broad access to sensitive customer data and may enable unauthorized bulk profiling or disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction to discover and append custom contact, phone, and address fields helps operators locate potentially sensitive personal data but provides no warning or control guidance. Because custom fields often contain the most privacy-sensitive customer information, this omission can facilitate overcollection and inappropriate access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The phone/contact/address lookup guidance normalizes retrieval of direct personal contact details without reminding users that these fields may be privacy-sensitive. In a customer-query skill for a production ERP, this increases the risk of misuse because it operationalizes how to find and extract personal data at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guide recommends storing ERP-specific configuration, custom field names, internal customer exclusion rules, warehouse names, and ID-to-name mappings in a root-level CLAUDE.md that may be broadly visible to the agent and potentially committed to source control. While not an exploit by itself, this centralizes sensitive business metadata that can aid reconnaissance, unauthorized querying, or accidental disclosure of internal operational structure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file explicitly warns that directly summing line-level FAllAmount can double-count order totals, but the provided pseudocode then sums FAllAmount across all rows in each FBillNo group. If FAllAmount is repeated per line rather than partitioned by line, this logic inflates daily sales figures and can misstate operational reporting. In an ERP reporting skill, that can mislead business decisions, audits, and downstream automated summaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s user-facing instructions, examples, and warnings are all presented in Chinese, which effectively forces a specific language for users. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow explicitly recommends exporting bulk sales data to a local path under /tmp and processing it later, but provides no warning, consent step, retention guidance, or cleanup requirement. Because the data includes customer names, sales amounts, and potentially sensitive ERP business records, writing it to local storage can create unintended persistence, broader local access exposure, or leakage through shared environments and logs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title and all operational guidance in this file are written exclusively in Chinese, effectively forcing a specific language for use of the skill reference. Under the policy, locale-specific behavior should either provide user opt-in/choice or clearly document why the restriction is necessary; that justification is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill recommends exporting potentially large ERP query results directly to local files without warning that this constitutes data export and may persist sensitive business data outside the ERP system. Because the skill covers customers, suppliers, inventory, orders, and operational reports, writing to /tmp or CSV/Excel can expose regulated or confidential data through local retention, later reuse, or accidental sharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: 全文以中文撰写并将字段说明、操作步骤和配置模板都固定为中文表达，但未说明这是面向特定中文用户群的限定文档，也未提供其他语言选项或用户选择。根据语言/locale 政策，强制单一语言而无用户 opt-in 可能构成自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains user-facing guidance only in Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentionally documented as a policy exception. Under the natural-language policy rules, forcing a specific language without user opt-in is a locale-policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file explicitly advises outputting large result sets as an Excel file, which affects user data by creating a local artifact. The document does not include any warning about file creation, storage location, or handling potentially sensitive report contents.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.