T09 · Insecure Skill Coding Practices
Error
- Location
scripts/excel_import.py:818- Finding
Untrusted spreadsheet values can be written as executable formulas
- Content
View full analysis
- Remediation
View remediation
Security audit
Excel Data Import
Security checks for vulnerabilities and agentic risk
Overview
This spreadsheet import skill mostly matches its purpose, but it needs Review because it can mishandle sensitive spreadsheet data and some safety controls are weaker than documented.
Install only in a controlled workspace and use copies of spreadsheets. Treat generated workbooks, backups, logs, and reports as potentially sensitive. Do not rely on dry-run being side-effect free, do not rely on the documented encrypt/custom validation behavior unless fixed, and avoid importing untrusted spreadsheets until formula-like values are neutralized or rejected.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/data_mapper.py:241- Finding
Unknown validation rules silently succeed
- Content
View full analysis
max_len: msg = params.get("message", f"Length cannot exceed {max_len}") return False, msg return True, None return True, None ``` The final `return True, None` is reached for every unrecognized validation type. ### Technical Analysis The validation dispatcher fails open. A misspelled, unsupported, or purportedly custom validation name is interpreted as successful validation rather than as a configuration error. This behavior is especially risky because `SKILL.md` advertises custom validators, while the implementation contains no controlled custom-validator registry. A user can therefore believe that a business or security rule is active even though the rule is silently skipped. Configuration validation in `scripts/config_parser.py` only checks that mappings contain `source` and `target`; it does not verify that the `validate` value is supported. ### Attack Path 1. A configuration uses an unsupported or misspelled validator, such as a purported custom business-rule validator. 2. The configuration passes `validate_config()`. 3. During record processing, `_write_record()` calls `validate_field()`. 4. No recognized validation branch matches the configured name. 5. `validate_field()` returns `(True, None)`. 6. The record is written even th ...[truncated 725 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/data_mapper.py:44- Finding
Documented encryption transform silently preserves sensitive plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/excel_import.py:68- Finding
Dry-run mode performs configuration-controlled filesystem writes
- Content
View full analysis
None: output_path = Path(self.config["target"]["output_path"]).parent output_path.mkdir(parents=True, exist_ok=True) if self.config["error_handling"].get("backup", False): backup_path = Path( self.config["error_handling"].get("backup_path", "backup/") ) backup_path.mkdir(parents=True, exist_ok=True) log_path = Path( self.config["error_handling"].get("error_log_path", "logs/") ).parent log_path.mkdir(parents=True, exist_ok=True) ``` Backup and workbook loading also occur without a dry-run guard: ```python if ( self.config["error_handling"].get("backup", False) and not self.no_backup ): self._backup_target_file() self._load_workbooks() ``` A missing target is created and saved by `_load_workbooks()`: ```python if not target_path.exists(): self._create_target_template(target_path) self.target_wb.save(target_path) ``` ### Technical Analysis The command-line interface describes dry-run mode as a preview that performs no file writes. However, the importer creates output, backup, and log directories during object initialization. It may also copy the target into a backup location and create a new target workbook. All affected paths originate in YAML configuration and may be absolute or traverse outside the configuration directory. Although the actions run with the invoking user's existing privileges and do not eleva ...[truncated 1196 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:21- Finding
Runtime dependencies are installed without version or integrity pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (51)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md For full parameter docs, see [data-mapping-guide.md](references/data-mapping-guide.md).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md For full parameter docs, see [data-mapping-guide.md](references/data-mapping-guide.md).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **Troubleshooting**: [troubleshooting.md](references/troubleshooting.md) — common issues
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 92% confidence
- Finding
The guide recommends rm -rf /tmp/excel_import_temp_* as a cleanup step. Even though it targets a temp path, wildcard recursive deletion is error-prone and can remove unintended files if naming conventions, symlinks, or operator assumptions are wrong; in a spreadsheet import workflow this can destroy temporary evidence needed for troubleshooting or recovery.
- Content
md df -h # 清理临时文件 rm -rf /tmp/excel_import_temp_* # 清理旧备份 find backup/ -name "*.xlsx" -mtime +30 -delete
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 92% confidence
- Finding
The guide recommends rm -rf /tmp/excel_import_temp_* as a cleanup step. Even though it targets a temp path, wildcard recursive deletion is error-prone and can remove unintended files if naming conventions, symlinks, or operator assumptions are wrong; in a spreadsheet import workflow this can destroy temporary evidence needed for troubleshooting or recovery.
- Content
md df -h # 清理临时文件 rm -rf /tmp/excel_import_temp_* # 清理旧备份 find backup/ -name "*.xlsx" -mtime +30 -delete
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs reading source files and writing output spreadsheets, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can lead to overbroad file access assumptions, making it easier for the skill to read or overwrite unintended files if invoked with attacker-controlled paths or ambiguous execution context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest description includes Chinese-only invocation guidance for when to use the skill, but the file does not state that the skill is region-specific or offer users a language/locale choice. This can violate organizational language/locale policy when a skill implicitly privileges one language without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill description and instructional content are written in Chinese, and there is no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. This creates a natural-language policy concern because it effectively imposes a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example instructs users to drop rows, fill missing values, coerce parsing failures to NaN, and remove outliers without any warning that these steps irreversibly alter or delete source data semantics. In a data-import skill, users may apply the snippet to production spreadsheets and silently lose records or overwrite meaningful values, which can cause integrity issues and incorrect downstream business decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file contains executable-style examples that scan a large directory of Excel files and write results to scan_results.json. The surrounding description presents the workflow as a solution, but does not warn users that running it will create output files and process potentially sensitive business data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Later sections include examples that write errors_.xlsx, processed/.csv, checkpoint.json, import.log, and quality_report.png. Because this is a markdown skill/example file, the expected warning should tell users that executing these steps will persist transformed business data and diagnostic artifacts to disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation explicitly states that when multiple source files contain the same key, later-processed files overwrite earlier data, but it does not prominently warn about unintended data loss or integrity issues. In a bulk spreadsheet import skill, silent overwrite behavior can cause users to corrupt or replace records at scale, especially when processing directories automatically.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing guidance entirely in Chinese and explicitly documents that the feature is primarily optimized for Chinese column names. That creates a language/locale constraint without opt-in or an alternative language path, which matches the policy category for forced language/locale behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document title and all instructional content are written in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The best-practices document presents 'skip_validation: true' as a performance optimization option, which can encourage disabling integrity checks during import. In this skill context, validation is a primary safeguard against malformed, inconsistent, or maliciously crafted spreadsheet data, so recommending it without stronger constraints increases risk of bad data ingestion and downstream corruption.
- Content
yaml options: preserve_formatting: false # 不保持格式，提升速度 skip_validation: true # 跳过验证（谨慎使用）2. 批量文件处理
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The error log example includes raw sensitive values such as an ID number field and corresponding value, which normalizes logging plaintext personal data. In an Excel import workflow that processes HR-style records and identity data, this increases the chance of privacy leakage through log files, backups, and downstream log aggregation systems.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
文件权限:
bash # 配置文件: 只读 chmod 444 import_config.yaml # 备份目录: 仅所有者可写 chmod 700 backup/
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md chmod 444 import_config.yaml # 备份目录: 仅所有者可写 chmod 700 backup/ # 错误日志: 仅所有者可读写 chmod 600 logs/import_errors.log
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
chmod 700 backup/
错误日志: 仅所有者可读写
chmod 600 logs/import_errors.log
text ### 3. 数据备份策略
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guide uses examples with highly sensitive personal data such as ID numbers and phone numbers, but does not warn users about privacy, minimization, masking, or compliance obligations. In a data-import skill, this can normalize unsafe handling of PII and lead users to process real sensitive data in configs, test files, and logs without safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The debugging and preview examples print raw mapped values directly to console output, including fields like name, ID card number, and phone number. In this skill’s context, those examples are likely to be copied into real workflows, causing sensitive data exposure through terminals, logs, CI output, shared screenshots, or support bundles.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document states that target files will be modified and backup copies created automatically, but it does not explicitly warn users about these side effects or the storage implications of backup/rollback behavior. In a file-import skill that operates on spreadsheets, this can lead to unintended data duplication, unexpected persistence of sensitive data in backup folders, and user surprise about destructive or state-changing actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The validation report example includes a national ID field and raw sample value, while the logging/reporting guidance does not warn about exposure of personally sensitive data in logs or exported JSON reports. In this skill's context, import errors are likely to involve real spreadsheet records, so logging field values can create secondary privacy leakage through log files, reports, and backups.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The quickstart uses realistic-looking Chinese national ID numbers and demonstrates exporting and backing up personal data to output files without any warning about handling sensitive PII, masking examples, or safe storage practices. In a data-import skill specifically designed to process spreadsheets at scale, this can normalize unsafe handling of real personal data and increase the chance that users copy the pattern into production with unprotected identifiers and duplicated backups.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
调试命令:
bash # 检查文件是否存在 ls -l /home/user/project/data/data.xlsx # 检查当前工作目录 pwd