sjht-data-annotation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

This is a real data-annotation skill, but its web API and deployment instructions create broad unauthenticated file access and host-configuration risks.

Install only after review. Use it in a contained environment, keep datasets non-sensitive unless you have approved the model provider, avoid the provided Nginx/root deployment flow, do not expose the API publicly, and restrict all reads and writes to a dedicated annotation results directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/annotation-api.py:24
• Finding: Unrestricted Filesystem Enumeration and JSONL File Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/annotation-api.py`, lines 24-40 and 121-153 **Vulnerability Type**: Improper filesystem access control **Risk Level**: High ### Vulnerable Code ```python def do_GET(self): parsed = urlparse(self.path) params = parse_qs(parsed.query) if parsed.path == '/': # List data files and annotation results data_dir = params.get('dir', [DATA_DIR])[0] results_file = params.get('results', [''])[0] files = self._list_files(data_dir) annotations = {} if results_file and os.path.exists(results_file): annotations = self._load_annotations(results_file) self._send_json({ 'files': files, 'annotations': annotations, 'dataDir': data_dir, 'resultsFile': results_file }) ``` ```python def _list_files(self, data_dir): """Recursively list files in a data directory.""" files = [] if not os.path.exists(data_dir): return files # ... for root, dirs, filenames in os.walk(data_dir): dirs.sort() for fname in sorted(filenames): fpath = os.path.join(root, fname) # ... files.append({ 'path': fpath, 'name': fname, 'type': ftype, 'size': os.path.getsize(fpath) }) ``` ### Technical Analysis The `dir` and `results` query parameters are used directly as filesystem paths. Neither path is constrained to the configured `DATA_DIR`. The `dir` parameter is passed to `os.walk()`, permitting recursive enumeration of any directory readable by the API process. The response exposes absolute paths, filenames, types, and sizes. The `results` parameter is passed to `_load_annotations()`, which reads attacker-selected files as JSONL. Although only parseable JSON objects with a `source_file` field are returned meaningfully, this still ...[truncated 984 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not accept arbitrary filesystem paths from API clients. - Represent datasets and result files with opaque server-side identifiers. - Resolve candidate paths and enforce containment under a fixed root: ```python from pathlib import Path root = Path(DATA_DIR).resolve() candidate = (root / requested_relative_path).resolve() if not candidate.is_relative_to(root): raise PermissionError("Path is outside the configured data root") ``` - Reject absolute paths and path traversal components such as `..`. - Apply the same validation independently to both dataset and result paths. - Return relative paths instead of absolute server filesystem paths. - Run the service as a dedicated, unprivileged account with access only to the required annotation directory. - Require authentication and per-dataset authorization before returning listings or annotations. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/annotation-api.py:76
• Finding: Unauthenticated Arbitrary File Creation and Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/annotation-api.py`, lines 76-101 **Vulnerability Type**: Arbitrary file write and destructive overwrite **Risk Level**: Critical ### Vulnerable Code ```python def do_POST(self): content_length = int(self.headers.get('Content-Length', 0)) body = self.rfile.read(content_length) try: data = json.loads(body) except json.JSONDecodeError: self._send_json({'error': 'Invalid JSON'}, 400) return if data.get('action') == 'save': annotations = data.get('annotations', {}) results_file = data.get('file', '') if not results_file: # Save to annotations.jsonl under DATA_DIR by default results_file = os.path.join(DATA_DIR, 'annotations.jsonl') # Ensure the directory exists os.makedirs(os.path.dirname(results_file), exist_ok=True) # Save as JSONL saved = 0 with open(results_file, 'w', encoding='utf-8') as f: for source, ann in annotations.items(): if isinstance(ann, dict): ann['source_file'] = source f.write(json.dumps(ann, ensure_ascii=False) + '\n') saved += 1 self._send_json({'success': True, 'saved': saved, 'file': results_file}) ``` ### Technical Analysis The POST body controls the entire `file` path used by `os.makedirs()` and `open(..., 'w')`. No authentication, authorization, path-containment validation, symlink protection, or allowed-filename policy is present. Opening the target in `w` mode truncates any existing writable file before writing annotation-controlled JSON. An attacker can therefore destroy existing content or create new files anywhere permitted by the service account. The application also does not limit request-body size, annotation count, or output size, enabling disk-exhaustion attacks in addition to targeted overwrite. # ...[truncated 1283 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the client-controlled output path from the API contract. - Store results under a fixed, server-controlled directory and filename. - If multiple result files are required, accept only a strict identifier matching an allowlist pattern. - Resolve and validate the destination against a dedicated result root before every write. - Reject symlinks and avoid following links during file creation. - Write to a temporary file in the same directory, flush and synchronize it, and atomically replace the intended result file. - Preserve backups or implement versioning to prevent destructive loss. - Enforce authentication and authorization for every modifying request. - Limit `Content-Length`, annotation count, and maximum serialized output size. - Run the API under a dedicated account that cannot write system files or application code. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/annotation-api.py:103
• Finding: Externally Exposed Annotation API Has No Authentication and Allows Cross-Origin Requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/annotation-api.py`, lines 103-108 and 183-190; `SKILL.md`, lines 231-243 **Vulnerability Type**: Missing authentication and overly permissive CORS **Risk Level**: High ### Vulnerable Code ```python def do_OPTIONS(self): self.send_response(200) self.send_header('Access-Control-Allow-Origin', '*') self.send_header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS') self.send_header('Access-Control-Allow-Headers', 'Content-Type') self.end_headers() ``` ```python def _send_json(self, data, status=200): self.send_response(status) self.send_header('Content-Type', 'application/json; charset=utf-8') self.send_header('Access-Control-Allow-Origin', '*') body = json.dumps(data, ensure_ascii=False).encode('utf-8') self.send_header('Content-Length', len(body)) self.end_headers() self.wfile.write(body) ``` The documented Nginx configuration publishes the loopback service: ```nginx location ^~ /annotation-api/ { proxy_pass http://127.0.0.1:8888/; } ``` ### Technical Analysis The Python server itself binds to `127.0.0.1`, but the deployment instructions intentionally expose it through Nginx. Consequently, loopback binding is not an effective access-control boundary. No endpoint verifies an API token, authenticated user, session, role, dataset ownership, or request origin. Wildcard CORS permits scripts from arbitrary origins to read API responses and issue supported cross-origin requests when network routing allows them to reach the Nginx host. This weakness directly exposes the filesystem read and write operations implemented by the API. ### Attack Path 1. The administrator follows `SKILL.md` and adds the public `/annotation-api/` Nginx location. 2. An attacker reaches that URL directly or causes an operator to visit a hostile website. 3. The attacker or hostile browser script sends unauthenticated GET requests to enumerate files and annotations. 4. It ...[truncated 634 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require authentication for every API operation. - Implement authorization checks tied to specific datasets and permitted actions. - Restrict the Nginx location to an authenticated internal application, VPN, or explicitly allowed network. - Replace wildcard CORS with an exact allowlist of trusted origins. - Return no CORS header for untrusted origins. - If cookie-based authentication is introduced, require CSRF tokens and secure cookie attributes. - Separate read-only and modifying operations and apply stricter controls to writes. - Add rate limiting, request-size limits, audit logging, and security monitoring at Nginx and application layers. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/annotation-api.py:43
• Finding: Directory Containment Check Can Be Bypassed by Shared Path Prefixes<![CDATA[ ## Vulnerability Details **File Location**: `scripts/annotation-api.py`, lines 43-64 **Vulnerability Type**: Path traversal and improper path-boundary validation **Risk Level**: High ### Vulnerable Code ```python elif parsed.path == '/file': # Return file content file_path = params.get('path', [''])[0] if not file_path or not os.path.exists(file_path): self._send_json({'error': 'File does not exist'}, 404) return # Security check: ensure file is under DATA_DIR real_path = os.path.realpath(file_path) real_data = os.path.realpath(DATA_DIR) if not real_path.startswith(real_data): self._send_json({'error': 'Access denied'}, 403) return content_type = self._guess_type(file_path) with open(file_path, 'rb') as f: content = f.read() self.send_response(200) self.send_header('Content-Type', content_type) self.send_header('Content-Length', len(content)) self.send_header('Cache-Control', 'no-cache') self.end_headers() self.wfile.write(content) ``` ### Technical Analysis The code attempts to enforce containment by checking whether the canonical target path starts with the canonical data-root string. String prefixes do not represent filesystem component boundaries. For example, if `DATA_DIR` is `/srv/data`, the path `/srv/data-secret/file.txt` starts with `/srv/data` and passes the check despite being outside the configured root. Canonicalization with `realpath()` prevents basic `..` traversal and resolves symlinks, but it does not correct the boundary error in `startswith()`. ### Attack Path 1. Assume the configured root is: ```text /srv/data ``` 2. The attacker discovers or predicts a sibling directory such as: ```text /srv/data-private ``` 3. The attacker requests: ```text GET /file?path=/srv/data-private/secret.txt ``` 4. `os.path.realpath()` returns `/srv/data-private/secret.txt`. 5. The string begins with `/srv/d ...[truncated 357 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace string-prefix checks with component-aware containment: ```python from pathlib import Path root = Path(DATA_DIR).resolve() target = Path(file_path).resolve(strict=True) if not target.is_relative_to(root): raise PermissionError("File is outside the configured root") ``` - For older Python versions, use: ```python if os.path.commonpath([real_path, real_data]) != real_data: raise PermissionError ``` - Require relative API paths and join them to `DATA_DIR` server-side. - Verify that the target is a regular file. - Define a symlink policy and reject symbolic links if dataset links are unnecessary. - Add tests for sibling-prefix paths, `..` traversal, encoded traversal, and symlink escapes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: templates/annotation-viewer.html:194
• Finding: DOM-Based Cross-Site Scripting Through Unescaped Filenames and Paths<![CDATA[ ## Vulnerability Details **File Location**: `templates/annotation-viewer.html`, lines 194-207 and 225-245 **Vulnerability Type**: DOM-based cross-site scripting **Risk Level**: High ### Vulnerable Code ```javascript function renderSidebar() { const tree = document.getElementById('dirTree'); tree.innerHTML = ''; const dirs = {}; CONFIG.files.forEach((f, i) => { const parts = f.path.split('/'); const dir = parts.slice(0, -1).join('/') || '/'; if (!dirs[dir]) dirs[dir] = []; dirs[dir].push({ ...f, idx: i }); }); Object.keys(dirs).sort().forEach(dir => { dirs[dir].forEach(f => { const item = document.createElement('div'); item.className = 'dir-item' + (f.idx === currentFileIdx ? ' active' : ''); const icon = f.type === 'image' ? '🖼' : f.type === 'video' ? '🎬' : '📄'; item.innerHTML = `<span class="icon">${icon}</span><span style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap;" title="${f.path}">${f.name || f.path.split('/').pop()}</span>`; item.onclick = () => selectFile(f.idx); tree.appendChild(item); }); }); } ``` ```javascript function renderData(file) { const panel = document.getElementById('dataPanel'); const url = CONFIG.apiBase + '?action=file&path=' + encodeURIComponent(file.path); let content = ''; switch (file.type) { case 'image': content = `<div class="data-panel-header">📷 Data Preview <span class="filename">${file.name || file.path}</span></div><img class="data-image" src="${url}" alt="preview">`; break; case 'video': content = `<div class="data-panel-header">🎬 Video Preview <span class="filename">${file.name || file.path}</span></div><video class="data-video" controls src="${url}"></video>`; break; case 'text': content = `<div class="data-panel-header">📄 Text Content <span class="filename">${file.name || file.path}</span></div><div class="data-text" id="dataText">Loading...</div>`; break; de ...[truncated 1844 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not construct HTML from filesystem-derived strings. - Create elements through DOM APIs and assign untrusted values with `textContent`: ```javascript const name = document.createElement('span'); name.textContent = f.name || f.path.split('/').pop(); name.title = f.path; item.appendChild(name); ``` - Set validated URL properties directly on created media elements rather than interpolating them into HTML. - If HTML generation is unavoidable, use a well-reviewed context-aware sanitizer. - Apply a restrictive Content Security Policy that disallows inline scripts and event handlers. - Add automated tests using filenames containing quotes, angle brackets, and event-handler payloads. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:217
• Finding: Deployment Instructions Require Excessive Root-Level Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 217-261 **Vulnerability Type**: Violation of least privilege and unsafe system administration **Risk Level**: High ### Vulnerable Code ```bash mkdir -p /root/annotation-data/ ln -sf <actual-data-directory> /root/annotation-data/<project-name> chmod 755 /root # Required, otherwise nginx cannot access it ``` ```bash fuser -k 8888/tcp 2>/dev/null nohup python3 <skill-path>/scripts/annotation-api.py --port 8888 --data-dir <data-directory> > <data-directory>/results/api.log 2>&1 & ``` ```bash # A full restart is required instead of reload systemctl restart nginx ``` The instructions also require editing an existing system Nginx site configuration: ```nginx location ^~ /annotation/ { alias /root/annotation-data/; autoindex on; index viewer.html index.html; charset utf-8; add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Methods "GET, POST, OPTIONS"; add_header Access-Control-Allow-Headers "Content-Type"; } location ^~ /annotation-api/ { proxy_pass http://127.0.0.1:8888/; } ``` ### Technical Analysis The declared annotation workflow does not require storing data beneath `/root`, globally changing `/root` permissions, killing arbitrary processes, or running the API with broad host privileges. `chmod 755 /root` changes access to the root user's home directory for all local users and services. Although file-level permissions still apply, this unnecessarily exposes directory traversal and names beneath a sensitive administrative location. `fuser -k 8888/tcp` kills whichever process currently owns the port without confirming that it belongs to this Skill. Editing Nginx and restarting it can also affect unrelated applications hosted on the machine. Most importantly, running the vulnerable API from a root-oriented workflow expands the impact of its arbitrary read and write flaws from an annotation directory to privileged host resources. ...[truncated 937 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store application data under `/srv/annotation`, `/var/lib/annotation`, or another dedicated service directory. - Never change the permissions of `/root` for a web application. - Create a dedicated system account with no login shell and access only to required annotation directories. - Configure a managed service that explicitly sets `User`, `Group`, filesystem restrictions, and privilege-hardening options. - Check whether the configured port is available and fail safely instead of killing an unknown process. - Use a dedicated Nginx configuration fragment with validation through `nginx -t`. - Prefer a reload after successful validation unless a restart is demonstrably required. - Require operator confirmation before modifying host-wide service configuration. - Keep the API private or protect it with authentication and network access controls. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:46
• Finding: Unpinned Runtime Installation of Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 46-56 **Vulnerability Type**: Unpinned and non-reproducible dependency installation **Risk Level**: Low ### Vulnerable Code ```bash pip install python-docx python3 -c " from docx import Document doc = Document('<requirements-document-path>') for p in doc.paragraphs: print(p.text) for table in doc.tables: for row in table.rows: print(' | '.join(cell.text for cell in row.cells)) " # Fallback when python-docx fails: pandoc <requirements-document-path> -t plain # Requires apt install -y pandoc ``` ### Technical Analysis The Skill installs `python-docx` without a pinned version, lockfile, or package hash. The package name itself is not evidence of typosquatting, but the effective code installed during a future run can differ from the version available during this audit. The fallback instruction also suggests system-level installation of `pandoc` without documenting an audited version. Runtime dependency installation makes execution non-reproducible and increases exposure to package-registry or repository compromise. No malicious dependency was identified in the reviewed project; this finding concerns unsafe dependency-management practice. ### Attack Path 1. A user requests processing of a DOCX requirements document. 2. The Skill executes `pip install python-docx`. 3. The package manager downloads the currently selected release and its dependency graph. 4. If the upstream package, account, registry, mirror, or dependency chain has been compromised, attacker-controlled installation code may execute. 5. The installed package subsequently processes user documents under the agent's privileges. ### Impact Assessment A compromised or unexpectedly changed dependency can execute code with the privileges of the account running the Skill. The practical risk depends on registry integrity, environment isolation, selected package version, and host permissions. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin reviewed dependency versions. - Maintain a lockfile and verify package hashes. - Install Python dependencies in an isolated virtual environment rather than globally. - Prefer a prebuilt, versioned execution environment. - Document the expected package source and disable untrusted package indexes. - Pin and audit system packages through the deployment environment's package-management controls. - Scan dependency versions regularly and update them through a reviewed process. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior extends beyond a normal annotation assistant into deployment, process management, and potentially arbitrary file writes via the referenced POST save flow. When a skill's real behavior exceeds its stated purpose, users and orchestrators may authorize it under false assumptions, creating a privilege and trust mismatch that can be abused.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs sending image/text data to external model APIs without an explicit disclosure or consent step. Annotation datasets commonly contain proprietary, personal, or regulated content, so silent third-party transmission can create confidentiality, compliance, and contractual violations.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill instructs modifying global nginx configuration and restarting the web server, which affects the entire host rather than just annotation data. Such system-wide changes can break unrelated services, expose files over HTTP, or be repurposed to alter routing/security boundaries on the machine.

External Script Fetching

High

• Category: Supply Chain

Content

# 必须完全 restart 而不是 reload
systemctl restart nginx
# 验证 HTML、图片、视频、API 都能正常访问
curl -s -o /dev/null -w "%{http_code}" http://localhost/annotation/<项目名>/results/viewer.html  # 期望 200
curl -s -o /dev/null -w "%{http_code}" http://localhost/annotation/<项目名>/<视频文件>.mp4      # 期望 200
curl -s "http://localhost/annotation-api/" | python3 -c "import sys,json;print(len(json.load(sys.stdin).get('files',[])))"  # 文件数>0
```

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The POST save endpoint accepts a client-supplied `file` path and writes to it directly, creating parent directories as needed and truncating the destination with `open(..., 'w')`. This allows a caller to overwrite arbitrary files writable by the service account, which exceeds the stated annotation-saving scope and can corrupt application data, configs, or other local files.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly directs file reads/writes and network access, but it declares no explicit tool scope or permissions boundaries. In an agent environment, this increases the chance the skill is invoked with broader capabilities than users expect, enabling unintended data access or transmission during annotation workflows.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are very broad and overlap with common requests like '数据处理' or 'label', increasing the risk that the skill activates in contexts where users did not intend annotation or data export behavior. In an agent system, over-triggering can lead to unnecessary file access, web deployment steps, or external model calls on sensitive content.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The manifest covers data annotation and web-based viewing/editing, but the instructions direct installing packages with `pip` and `apt`, invoking `pandoc`, `ffmpeg`, `fuser`, and running background services with `nohup`. While some document/media processing is related, system package management and service orchestration are not clearly within the declared annotation-tool scope.

Ssd 3

Medium

• Confidence: 80% confidence
• Finding: The instruction to restate requirement documents, schemas, and label lists back to the user/agent can unnecessarily replicate sensitive business rules or embedded confidential data. In multi-agent or logged environments, echoing such content increases exposure without being essential to safe processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 使用阿里百炼 qwen3.5-plus 分析图片
curl -s https://coding.dashscope.aliyuncs.com/v1/chat/completions \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 98% confidence
• Finding: This is a direct external transmission path to a third-party API, carrying image content and prompt text that may include sensitive annotation material. In the context of a data annotation skill, this is especially dangerous because datasets often contain confidential customer data, personal information, or unreleased media.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The deployment flow kills processes, restarts nginx, changes permissions, and launches a background service without an explicit warning or approval checkpoint. These actions modify system state and service availability, so performing them as part of a routine annotation skill creates avoidable operational and security risk.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
mkdir -p /root/annotation-data/
ln -sf <实际数据目录> /root/annotation-data/<项目名>
chmod 755 /root  # 关键！否则 nginx 无法访问
```

#### 启动 API 服务

• Confidence: 91% confidence
• Finding: Changing /root permissions to 755 weakens a core host security boundary by making the root home traversable to other users/processes, solely to facilitate web serving. This broadens exposure of root-owned paths and signals an unsafe pattern of relaxing system protections instead of using properly permissioned deployment directories.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
fuser -k 8888/tcp 2>/dev/null
nohup python3 <skill路径>/scripts/annotation-api.py --port 8888 --data-dir <数据目录> > <数据目录>/results/api.log 2>&1 &
```

#### 验证

• Confidence: 86% confidence
• Finding: Launching the API with nohup in the background creates persistent state beyond the current session and can leave a data-writing service running indefinitely without lifecycle management. If the service is insecure or misconfigured, it expands the attack surface and may continue exposing or modifying annotation data after the task ends.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents all instructions and examples exclusively in Chinese, which can violate a language/locale policy when users are not given an opt-in or alternative language. The file does not indicate that the skill is intentionally region-specific or that Chinese is a documented requirement.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code only enforces `DATA_DIR` containment for `/file`, but `/` accepts arbitrary `dir` and `results` parameters and uses them to recursively list files and load annotation data from any readable path. That exposes filesystem structure and contents beyond the intended dataset area, undermining the claimed restriction and enabling local information disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The save operation opens the target file in write mode unconditionally, so any existing file at the chosen path is silently replaced. Combined with the unvalidated client-controlled path, this creates a destructive arbitrary file overwrite primitive rather than a normal annotation export feature.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description defines usage in expansive, ambiguous terms like data processing, dataset generation, and annotation viewing/editing without clear boundaries. This increases the chance the agent routes unrelated requests into a capability that may inspect or transform user content, creating authorization, privacy, and least-privilege concerns.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger is purely keyword-based and very broad, so ordinary conversations about datasets, labels, or data processing could invoke the skill unintentionally. Because this skill can process user data and launch annotation workflows or a web interface, accidental activation can lead to unnecessary data handling, privacy exposure, or confusing tool execution beyond user intent.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The document declares `lang="zh-CN"`, and the visible UI text throughout the page is exclusively in Simplified Chinese. This imposes a specific language/locale on all users without any opt-in, selection mechanism, or documented region-specific justification.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The changelog contains a natural-language instruction, "所有日期格式为 YYYY-MM-DD。", and the surrounding headings/content are in Chinese, which indicates a locale/language constraint. Under the stated policy, forcing a specific language or locale without opt-in or justification is a reportable natural-language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The module docstring and runtime messages are written only in Chinese, which imposes a language choice on users without opt-in or alternatives. The policy explicitly calls out language or locale constraints as violations when they are forced rather than optional or justified.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The manifest's user-facing natural-language description and trigger guidance are entirely in Chinese, which may impose a language expectation without explicit user opt-in or a documented region-specific constraint. Under the stated policy, language-specific behavior should either be optional for users or clearly justified.

Static analysis

No suspicious patterns detected.