数据要素×国企数字化转型 SkillKit（7技能）

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:36 PM UTC
• Version: 2.1.0

Overview

This is a coherent data-transformation consulting skill suite with local scanning and report-generation tools that are mostly disclosed and purpose-aligned, though users should scope scans carefully.

Install only if you want a China-focused data-transformation delivery workflow. When using the baseline scanner, point it at explicit approved directories only, review CSV header previews before sharing reports, and keep generated inventories/private consulting outputs in a controlled workspace.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: dx-industry-research/SKILL.md:6
• Finding: Unnecessary Shell Access in the Industry Research Skill<![CDATA[ ## Vulnerability Details **File Location**: `dx-industry-research/SKILL.md`, lines 6–13 **Vulnerability Type**: Excessive tool permission **Risk Level**: Low ### Vulnerable Code ```yaml allowed-tools: - Read - Write - Edit - WebSearch - WebFetch - Bash - Glob - Grep ``` ### Technical Analysis The skill grants unrestricted `Bash` access even though its documented workflow consists of public-source policy research, market research, source verification, and report creation. No documented step requires arbitrary shell command execution. This violates least-privilege principles by exposing a general-purpose local command-execution channel to a workflow that processes untrusted external web content. The repository does not contain an instruction that actively exploits this permission, so this is a capability-exposure issue rather than evidence of embedded malicious behavior. ### Attack Path 1. The industry research skill is activated. 2. The agent retrieves an untrusted or compromised public webpage using `WebSearch` or `WebFetch`. 3. The retrieved content contains prompt-injection instructions that attempt to induce local command execution. 4. Because `Bash` is included in `allowed-tools`, an insufficiently isolated runtime could permit the agent to execute those commands. 5. The resulting access is limited by the operating-system identity, sandbox, and filesystem permissions assigned to the agent process. ### Impact Assessment Successful exploitation could allow commands to run with the privileges of the agent process. Depending on runtime isolation, this could expose readable local files, permit modification of writable files, or execute locally available programs. It does not directly provide privilege elevation beyond the hosting process, and no persistence or credential-access mechanism was found in the project. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `Bash` from this skill's `allowed-tools` list. - Retain only `Read`, `Write`, `Edit`, `WebSearch`, `WebFetch`, `Glob`, and `Grep` where required. - Treat all fetched webpages as untrusted data and prevent retrieved content from authorizing tool calls. - If a future research operation genuinely requires command execution, expose a narrowly scoped wrapper that only accepts predefined operations and validated arguments. - Require explicit user approval for any exceptional local command execution. - Run web-enabled skills in a sandbox with restricted filesystem access and no access to credentials or unrelated project directories. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: dx-competitor-scout/SKILL.md:6
• Finding: Unnecessary Shell Access in the Competitor Research Skill<![CDATA[ ## Vulnerability Details **File Location**: `dx-competitor-scout/SKILL.md`, lines 6–13 **Vulnerability Type**: Excessive tool permission **Risk Level**: Low ### Vulnerable Code ```yaml allowed-tools: - Read - Write - Edit - WebSearch - WebFetch - Bash - Glob - Grep ``` ### Technical Analysis The competitor research workflow gathers public information from annual reports, official websites, recruitment postings, news, and procurement announcements. Its documented operations do not require arbitrary shell execution. Providing `Bash` expands the skill's authority beyond its legitimate needs. This is particularly relevant because competitor research consumes externally controlled content, which can contain adversarial instructions. No malicious command or automated shell invocation was found in the repository; the risk arises from the unnecessary permission being available if the agent is manipulated. ### Attack Path 1. The competitor research skill is loaded. 2. The agent fetches content from a public website, report, announcement, or other external source. 3. Malicious content attempts to redirect the agent from analysis to local command execution. 4. The declared `Bash` permission provides a potential execution channel if the host does not strictly separate retrieved data from trusted instructions. 5. Commands execute under the agent process's existing operating-system permissions. ### Impact Assessment Potential impact includes reading files accessible to the agent, modifying writable project artifacts, invoking local programs, or disrupting the current workspace. The exact scope depends on the host sandbox and process privileges. The reviewed project contains no mechanism for privilege elevation, persistence, remote payload execution, or secret extraction. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `Bash` from the competitor research skill. - Limit the skill to public web retrieval, document reading, document writing, and narrowly scoped search operations. - Enforce instruction/data separation for annual reports, webpages, recruitment postings, and other externally supplied content. - Apply URL allowlisting or domain restrictions where practical for official-source research. - If document conversion becomes necessary, provide a dedicated conversion tool rather than unrestricted shell access. - Require explicit user confirmation and sandboxing for any exceptional command execution. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: dx-architecture-opt/SKILL.md:6
• Finding: Unnecessary Shell Access in the Architecture Planning Skill<![CDATA[ ## Vulnerability Details **File Location**: `dx-architecture-opt/SKILL.md`, lines 6–11 **Vulnerability Type**: Excessive tool permission **Risk Level**: Low ### Vulnerable Code ```yaml allowed-tools: - Read - Write - Edit - Bash - Glob - Grep ``` ### Technical Analysis This skill documents an architecture-planning process that reads upstream inventories and produces diagnostics, blueprints, roadmaps, and governance checklists. It does not document any shell command that requires unrestricted `Bash`. The declared permission therefore creates a broader local execution capability than the stated planning task requires. The skill's “HALT” terminology is only a production governance checklist and does not invoke host shutdown or process-control commands. No destructive behavior was found; the issue is solely the unnecessarily broad execution authority. ### Attack Path 1. The architecture skill receives upstream project documents or user-controlled architecture material. 2. Malicious or misleading instructions embedded in those materials attempt to induce command execution. 3. The agent interprets the content as actionable rather than as untrusted input. 4. The available `Bash` tool is invoked to run a local command. 5. The command operates with the privileges and filesystem access of the agent process. ### Impact Assessment Potential impact is limited to the authority already available to the host agent process. It may include reading accessible local files, altering writable deliverables, or executing installed programs. The repository contains no command that performs such exploitation, and no privilege-escalation, persistence, or remote execution mechanism was identified. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `Bash` from `allowed-tools`. - Use `Read`, `Write`, `Edit`, `Glob`, and `Grep` for the documented planning workflow. - Treat upstream inventories and architecture documents as untrusted input that cannot authorize tool expansion. - If diagram generation or validation later requires execution, expose a dedicated tool with fixed commands, constrained input paths, argument validation, and no shell interpretation. - Restrict output writes to a user-approved delivery directory. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: dx-data-quality/SKILL.md:6
• Finding: Unnecessary Shell Access in the Data Quality Skill<![CDATA[ ## Vulnerability Details **File Location**: `dx-data-quality/SKILL.md`, lines 6–11 **Vulnerability Type**: Excessive tool permission **Risk Level**: Low ### Vulnerable Code ```yaml allowed-tools: - Read - Write - Edit - Bash - Glob - Grep ``` ### Technical Analysis The data quality skill creates metric dictionaries, ownership records, standards, master-data plans, quality-rule definitions, and access-control documentation. Although it requires quality rules to contain runnable SQL, its specification does not provide a shell-based execution workflow or define a safe database execution boundary. Granting unrestricted `Bash` is therefore broader than necessary. In a deployment where business metadata, SQL, table names, or upstream documents are untrusted, an agent could potentially be induced to execute shell commands instead of treating the supplied content strictly as data. No command injection implementation or malicious command is present in the reviewed repository. ### Attack Path 1. The skill receives user-controlled schemas, SQL fragments, quality rules, or upstream data-governance documents. 2. The supplied content contains adversarial instructions or shell metacharacters presented as operational guidance. 3. The agent incorrectly treats that content as authorization to invoke tools. 4. The unrestricted `Bash` capability executes a local command. 5. The command runs within the host agent's existing security context. ### Impact Assessment Possible impact includes unauthorized inspection of locally readable files, modification of writable project data, execution of local programs, or disruption of generated deliverables. Access remains bounded by the agent process and its sandbox. No evidence was found of root escalation, persistence, credential theft, external exfiltration, or malicious embedded scripts. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove unrestricted `Bash` access from this skill. - Introduce a dedicated SQL validation or data-quality execution tool if actual rule execution is required. - Restrict that tool to approved database connections, read-only credentials, parameterized queries, explicit table allowlists, row and time limits, and disabled shell escapes. - Never concatenate untrusted schema names, table names, or rule text into shell commands. - Require user approval before connecting to production data sources. - Keep generated reports and rule files within a user-approved output directory. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明的核心用途是“入口技能/路由器”，负责把用户请求分发到一组 dx-* 子技能；而代码实际是一个离线门禁检查工具，面向交付目录中的文档做质量与合规校验。两者主目的明显不同：一个是技能编排与路由，另一个是文件内容审计与验收。虽然该脚本可能属于同一交付套件的辅助组件，但就这段代码本身而言，未体现任何路由逻辑、子技能调用或用户意图分发，反而实现了未声明的文件读取与文本规则检测能力，因此构成描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个面向多个数字化转型主题的总入口技能，其核心职责应是识别用户意图并路由到相应 dx-* 子技能。但提供的代码并没有任何路由、意图识别或子技能分发逻辑，而是实现了一个具体的业务处理组件：DCMM 8 域成熟度打分器。该代码的主要功能、输入输出形式和行为都与“入口路由技能”明显不同，因此属于实质性描述与行为不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description says this is an entrance skill whose responsibility is to route requests to dx-* subskills. The actual code does not implement routing logic, trigger handling, or orchestration across a 7-skill suite. Instead, it performs a concrete operational task: recursively scanning directories for data-like files, reading CSV/TSV header lines, collecting metadata such as size and modification time, and optionally writing results to a CSV file. This is materially different from an entry/router skill and introduces undeclared capabilities involving filesystem access and asset inventory generation. While the code may support one sub-area mentioned in the description (data asset inventory), it does not match the declared primary purpose of being a routing entry skill.

Natural-Language Policy Violations

High

• Confidence: 95% confidence
• Finding: The primary description and invocation guidance are written as Chinese-only operating instructions, while the skill does not state that language choice is optional or user-driven. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly justified and documented.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger language is broad and overlaps with common business requests, increasing the likelihood of unintended activation. In a skill with broad tooling permissions, accidental routing into this entrypoint can expose unnecessary file and shell capabilities and may cause workflow confusion or unsafe delegation.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The primary description and all operational examples are presented in Chinese and target Chinese SOE transformation scenarios, but the file does not state that language is user-selectable or that Chinese-only operation is a required regional constraint. This can violate a language/locale policy when users are not given opt-in or choice.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The manifest grants Read, Write, Edit, Bash, Glob, and Grep to a skill described as an entry-point router. For a routing function, shell access and file-modification privileges are broader than necessary and expand the blast radius if the skill is triggered unexpectedly, misused, or prompt-injected through downstream content.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The conversational example phrases are ambiguous and could match many ordinary requests, making safe dispatch difficult. Ambiguous activation matters more here because this is an entry skill for a toolkit with multiple subskills and elevated tooling, so misrouting can widen access and produce incorrect or overbroad actions.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation says the agent must not modify skill documentation, yet the manifest permits Write and Edit. This policy-capability mismatch creates an avoidable avenue for accidental or unauthorized modification of skill assets, especially if the agent is manipulated by malicious inputs or ambiguous tasks.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The statement '本套件统一语言。所有交付物必须挂回这七道工序，对外口径四处一致。' imposes a fixed language/phrasing requirement on all outputs. This is a natural-language policy concern because it removes user or context-specific language choice and does not present any opt-in or justified locale constraint.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This Python file contains its primary docstring usage instructions and operational messages entirely in Chinese, which effectively forces a specific language for users of the skill. The policy explicitly flags language or locale constraints when they are imposed without user opt-in or an offered choice.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s natural-language interface is entirely Chinese, including the descriptive docstring, domain names, and maturity labels, and there is no indication that users can select another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy for natural-language constraints, forcing a specific language without opt-in is a locale policy issue.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

"文件": p.name,
            "类型": p.suffix.lower().lstrip("."),
            "大小MB": round(st.st_size / 1024 / 1024, 3),
            "修改时间": __import__("datetime").datetime.fromtimestamp(st.st_mtime).strftime("%Y-%m-%d %H:%M"),
            "表头预览": sniff_header(p),
            # 以下字段需人工/问卷补全（脚本无法推断语义）
            "业务域": "",

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script exports a detailed inventory of data assets, including relative paths, filenames, modification times, and CSV/TSV header previews, into an output CSV without any warning, redaction, or consent checkpoint. In a data-discovery skill focused on enterprise data assets, those metadata fields can reveal sensitive business context, schema names, and potentially regulated data categories, making accidental disclosure more likely.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill metadata description contains broad, everyday trigger phrases such as asking what data can be used for or wanting a board-level deck, which can match many general business requests outside the intended narrow workflow. In an agentic environment, this increases the chance of unintended routing into a skill that has Write, Edit, and Bash permissions, causing unnecessary file changes or execution in contexts where the user did not explicitly request this delivery flow.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The '何时使用' section lists ambiguous invocation examples like '数据能干什么', '规划数据产品', and '给领导做个汇报' without clear boundaries on industry, maturity stage, or required upstream context. Because the skill is positioned as an entry or routing component and can produce and modify deliverables, overly broad examples make accidental invocation more likely and can steer unrelated requests into a high-capability workflow.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The primary description is written entirely in Chinese and frames usage around Chinese trigger phrases, while the document does not state that the skill supports multiple languages or requires user opt-in for Chinese output. This can violate language/locale policy when users have not chosen that locale.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough that the skill may be invoked for loosely related requests such as general architecture or integration advice, causing unintended routing. In an agent system with Write/Edit/Bash permissions, mistaken invocation can lead to inappropriate file generation or workflow progression based on the wrong specialized skill.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases in the metadata are broad enough to match many generic research or benchmarking requests, which can cause the orchestrator to invoke this skill outside its intended niche. In a multi-skill system, overbroad routing can lead to inappropriate tool use such as unnecessary web access or file writes, and can displace a more suitable, narrower skill.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The 'when to use' section gives broad example requests but does not define when the skill should not be used, making routing ambiguous. Because this skill has WebSearch, WebFetch, Bash, and write-capable tools, ambiguous invocation increases the chance of unnecessary external collection and artifact generation for requests that may only need a lighter or safer skill.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill metadata uses broad activation phrases such as general requests about data inventory, system surveys, and maturity assessment without clearly constraining prerequisites or requiring explicit user confirmation before scanning systems and producing artifacts. In an orchestrated agent environment, this can cause unintended invocation on loosely related requests and lead to unexpected enumeration of files, databases, or systems and creation of inventory outputs containing sensitive metadata.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill is authorized to use Read, Write, Edit, Bash, Glob, and Grep and explicitly instructs script-based scanning of databases/files and creation of inventory artifacts, but the description does not warn users that operational scanning and file-writing will occur. In this context, missing disclosure is dangerous because baseline inventory work often touches sensitive enterprise metadata, offline Excel files, and system topology, so a user may unknowingly trigger collection or persistence of sensitive information.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The usage section repeats expansive trigger language like 'first step for any digital foundation/data governance project' and broad uncertainty-driven prompts about what data exists. This increases routing ambiguity and can cause the skill to activate in contexts where the user is only asking for advice, resulting in unnecessary system enumeration or artifact generation beyond user expectations.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation description includes very broad phrases such as "数据不准" and "两个部门数字不一样," which can arise in many casual or loosely related discussions beyond a deliberate request for this specific skill. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not trigger the skill.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The usage examples mix concrete governance tasks with broader business situations like "在把数据集开放给更广受众之前" and "上级要做数据资产入表," which are not precise activation conditions. Without explicit boundaries, the skill could be selected for general planning or reporting contexts rather than true data-quality/governance work.

Static analysis

No suspicious patterns detected.