T05 · Unauthorized Access and Privilege Escalation
Note
- Location
dx-industry-research/SKILL.md:6- Finding
Unnecessary Shell Access in the Industry Research Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
数据要素×国企数字化转型 SkillKit（7技能）
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent data-transformation consulting skill suite with local scanning and report-generation tools that are mostly disclosed and purpose-aligned, though users should scope scans carefully.
Install only if you want a China-focused data-transformation delivery workflow. When using the baseline scanner, point it at explicit approved directories only, review CSV header previews before sharing reports, and keep generated inventories/private consulting outputs in a controlled workspace.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
dx-competitor-scout/SKILL.md:6- Finding
Unnecessary Shell Access in the Competitor Research Skill
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
dx-architecture-opt/SKILL.md:6- Finding
Unnecessary Shell Access in the Architecture Planning Skill
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
dx-data-quality/SKILL.md:6- Finding
Unnecessary Shell Access in the Data Quality Skill
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (35)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明的核心用途是“入口技能/路由器”，负责把用户请求分发到一组 dx-* 子技能；而代码实际是一个离线门禁检查工具，面向交付目录中的文档做质量与合规校验。两者主目的明显不同：一个是技能编排与路由，另一个是文件内容审计与验收。虽然该脚本可能属于同一交付套件的辅助组件，但就这段代码本身而言，未体现任何路由逻辑、子技能调用或用户意图分发，反而实现了未声明的文件读取与文本规则检测能力，因此构成描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个面向多个数字化转型主题的总入口技能，其核心职责应是识别用户意图并路由到相应 dx-* 子技能。但提供的代码并没有任何路由、意图识别或子技能分发逻辑，而是实现了一个具体的业务处理组件：DCMM 8 域成熟度打分器。该代码的主要功能、输入输出形式和行为都与“入口路由技能”明显不同，因此属于实质性描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description says this is an entrance skill whose responsibility is to route requests to dx-* subskills. The actual code does not implement routing logic, trigger handling, or orchestration across a 7-skill suite. Instead, it performs a concrete operational task: recursively scanning directories for data-like files, reading CSV/TSV header lines, collecting metadata such as size and modification time, and optionally writing results to a CSV file. This is materially different from an entry/router skill and introduces undeclared capabilities involving filesystem access and asset inventory generation. While the code may support one sub-area mentioned in the description (data asset inventory), it does not match the declared primary purpose of being a routing entry skill.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The primary description and invocation guidance are written as Chinese-only operating instructions, while the skill does not state that language choice is optional or user-driven. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly justified and documented.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger language is broad and overlaps with common business requests, increasing the likelihood of unintended activation. In a skill with broad tooling permissions, accidental routing into this entrypoint can expose unnecessary file and shell capabilities and may cause workflow confusion or unsafe delegation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The primary description and all operational examples are presented in Chinese and target Chinese SOE transformation scenarios, but the file does not state that language is user-selectable or that Chinese-only operation is a required regional constraint. This can violate a language/locale policy when users are not given opt-in or choice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest grants Read, Write, Edit, Bash, Glob, and Grep to a skill described as an entry-point router. For a routing function, shell access and file-modification privileges are broader than necessary and expand the blast radius if the skill is triggered unexpectedly, misused, or prompt-injected through downstream content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The conversational example phrases are ambiguous and could match many ordinary requests, making safe dispatch difficult. Ambiguous activation matters more here because this is an entry skill for a toolkit with multiple subskills and elevated tooling, so misrouting can widen access and produce incorrect or overbroad actions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation says the agent must not modify skill documentation, yet the manifest permits Write and Edit. This policy-capability mismatch creates an avoidable avenue for accidental or unauthorized modification of skill assets, especially if the agent is manipulated by malicious inputs or ambiguous tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The statement '本套件统一语言。所有交付物必须挂回这七道工序，对外口径四处一致。' imposes a fixed language/phrasing requirement on all outputs. This is a natural-language policy concern because it removes user or context-specific language choice and does not present any opt-in or justified locale constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains its primary docstring usage instructions and operational messages entirely in Chinese, which effectively forces a specific language for users of the skill. The policy explicitly flags language or locale constraints when they are imposed without user opt-in or an offered choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language interface is entirely Chinese, including the descriptive docstring, domain names, and maturity labels, and there is no indication that users can select another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy for natural-language constraints, forcing a specific language without opt-in is a locale policy issue.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python "文件": p.name, "类型": p.suffix.lower().lstrip("."), "大小MB": round(st.st_size / 1024 / 1024, 3), "修改时间": __import__("datetime").datetime.fromtimestamp(st.st_mtime).strftime("%Y-%m-%d %H:%M"), "表头预览": sniff_header(p), # 以下字段需人工/问卷补全（脚本无法推断语义） "业务域": "",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script exports a detailed inventory of data assets, including relative paths, filenames, modification times, and CSV/TSV header previews, into an output CSV without any warning, redaction, or consent checkpoint. In a data-discovery skill focused on enterprise data assets, those metadata fields can reveal sensitive business context, schema names, and potentially regulated data categories, making accidental disclosure more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata description contains broad, everyday trigger phrases such as asking what data can be used for or wanting a board-level deck, which can match many general business requests outside the intended narrow workflow. In an agentic environment, this increases the chance of unintended routing into a skill that has Write, Edit, and Bash permissions, causing unnecessary file changes or execution in contexts where the user did not explicitly request this delivery flow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The '何时使用' section lists ambiguous invocation examples like '数据能干什么', '规划数据产品', and '给领导做个汇报' without clear boundaries on industry, maturity stage, or required upstream context. Because the skill is positioned as an entry or routing component and can produce and modify deliverables, overly broad examples make accidental invocation more likely and can steer unrelated requests into a high-capability workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The primary description is written entirely in Chinese and frames usage around Chinese trigger phrases, while the document does not state that the skill supports multiple languages or requires user opt-in for Chinese output. This can violate language/locale policy when users have not chosen that locale.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough that the skill may be invoked for loosely related requests such as general architecture or integration advice, causing unintended routing. In an agent system with Write/Edit/Bash permissions, mistaken invocation can lead to inappropriate file generation or workflow progression based on the wrong specialized skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrases in the metadata are broad enough to match many generic research or benchmarking requests, which can cause the orchestrator to invoke this skill outside its intended niche. In a multi-skill system, overbroad routing can lead to inappropriate tool use such as unnecessary web access or file writes, and can displace a more suitable, narrower skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The 'when to use' section gives broad example requests but does not define when the skill should not be used, making routing ambiguous. Because this skill has WebSearch, WebFetch, Bash, and write-capable tools, ambiguous invocation increases the chance of unnecessary external collection and artifact generation for requests that may only need a lighter or safer skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill metadata uses broad activation phrases such as general requests about data inventory, system surveys, and maturity assessment without clearly constraining prerequisites or requiring explicit user confirmation before scanning systems and producing artifacts. In an orchestrated agent environment, this can cause unintended invocation on loosely related requests and lead to unexpected enumeration of files, databases, or systems and creation of inventory outputs containing sensitive metadata.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is authorized to use Read, Write, Edit, Bash, Glob, and Grep and explicitly instructs script-based scanning of databases/files and creation of inventory artifacts, but the description does not warn users that operational scanning and file-writing will occur. In this context, missing disclosure is dangerous because baseline inventory work often touches sensitive enterprise metadata, offline Excel files, and system topology, so a user may unknowingly trigger collection or persistence of sensitive information.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The usage section repeats expansive trigger language like 'first step for any digital foundation/data governance project' and broad uncertainty-driven prompts about what data exists. This increases routing ambiguity and can cause the skill to activate in contexts where the user is only asking for advice, resulting in unnecessary system enumeration or artifact generation beyond user expectations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation description includes very broad phrases such as "数据不准" and "两个部门数字不一样," which can arise in many casual or loosely related discussions beyond a deliberate request for this specific skill. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not trigger the skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The usage examples mix concrete governance tasks with broader business situations like "在把数据集开放给更广受众之前" and "上级要做数据资产入表," which are not precise activation conditions. Without explicit boundaries, the skill could be selected for general planning or reporting contexts rather than true data-quality/governance work.
- Content