T08 · Insecure Dependencies
Warning
- Location
SKILL.md:58- Finding
Automatic Installation of Unpinned Third-Party Packages
- Content
View full analysis
- Remediation
View remediation
Security audit
商品表市场洞察分析
Security checks for vulnerabilities and agentic risk
Overview
The skill performs the advertised spreadsheet analysis, but its local-only claims conflict with network-capable permissions, remote report JavaScript, and automatic unpinned package installation.
Review this skill before installing if your product spreadsheets contain sensitive business data. It appears intended for legitimate local product-table analysis, but it can install packages, write report files, and generate reports that contact a third-party CDN unless changed or clearly approved.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:155- Finding
Remote JavaScript Retrieval and Execution in Generated Reports
- Content
View full analysis
``` ### Technical Analysis The Skill requires generated HTML reports to load Chart.js from jsDelivr. When a report is opened, the browser retrieves and executes JavaScript supplied by an external service. The instructions do not require a Subresource Integrity hash, a restrictive Content Security Policy, or a locally reviewed copy of the library. Although the URL specifies a package version, the report still trusts the CDN and its delivery infrastructure at runtime. The effective executable content is therefore obtained after the Skill itself has been reviewed. A compromised CDN response, package artifact, or delivery path could cause attacker-controlled JavaScript to execute in the report's browser context. This network behavior also conflicts with the Skill's statements that processing is local and data is not uploaded. Even without compromise, opening the report exposes network metadata such as the user's IP address, request headers, timing, and the requested resource to the CDN. No evidence was found that the Python analysis script itself uploads product data. ### Attack Path 1. The agent generates an HTML report containing the required remote script element. 2. The user opens the report in a browser while connected to a network. 3. The browser contacts `cdn.jsdelivr.net` to retrieve Chart.js. 4. The CDN or another trusted delivery component returns modified JavaScript because its infrastructure or hosted artifact has been compromised. 5. The browser executes the returned JavaScript in the generated report's context. 6. The malicious script reads or modifies report content and may transmit information through outbound browser requests, subject to browser securi ...[truncated 748 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
主体分析方向与声明高度一致：代码确实支持CSV/Excel输入，并完成类目、词频、价格、卖家、卖点、竞争度及建议等商品表洞察分析。因此不存在完全不同或可疑的越权行为，也没有未声明的敏感资源访问。 但声明中一个关键承诺是“生成交互式HTML可视化报告”，这属于面向用户的重要输出能力，而代码中没有任何HTML生成、图表渲染、前端模板、可视化库调用或文件写出逻辑，只有JSON打印。此外，“品牌格局”在实现上更接近店铺/卖家统计，而非独立品牌分析。综合来看，代码实现了大部分分析核心，但对外描述的最终交付形式和部分分析表述与实际实现存在实质差异，因此应判定为描述与行为不完全匹配。
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The skill has persistent local modification capabilities (Write/Edit/Bash) and a workflow that creates artifacts from user-supplied data. In this context, persistence is somewhat expected for report generation, but the permissions are broader than necessary and could retain sensitive spreadsheet contents or generated outputs on disk beyond user awareness.
- Content
md agent_created: true allowed-tools: - Read - Write - Bash - Edit - WebFetch
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
WebSearch is not justified for a spreadsheet-only local analysis workflow and expands the skill's authority beyond need. Unnecessary network capability increases attack surface and raises the risk of accidental data disclosure or future prompt-injected behavior causing outbound queries with user-derived content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation list includes broad phrases such as "分析这张表", "帮我看看这些商品", "市场洞察", and "商品表格", which can plausibly occur in ordinary conversation outside the intended skill scope. The file does not provide exclusion conditions or tighter constraints to distinguish when the skill should activate versus when a general assistant response would be more appropriate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The workflow writes temporary CSV files and an HTML report into the user's working directory without prominently warning the user. Silent local file creation can expose sensitive business data to other local processes/users, create persistence of uploaded content, and surprise users who expected in-memory analysis only.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims analysis is local-only, but it instructs loading Chart.js from a public CDN and also enables web-capable tools. That creates a data-flow inconsistency: opening the generated report may contact a third party, leak metadata such as access time/IP/referrer, and undermine user expectations around offline/local processing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The requirement that all labels and prompts use Chinese forces a specific language/locale for generated output. The file does not indicate that this is optional, user-selected, or justified as a region-specific constraint, so it conflicts with the language/locale policy criteria.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation simultaneously states that the skill does not perform online search or data enhancement while requiring a remote CDN script and granting web tools. This contradiction can cause users to share sensitive product spreadsheets under false assumptions about confinement, making the skill context more dangerous because uploaded business data may be commercially sensitive.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring specifies the skill in Chinese and states its input/output behavior entirely in Chinese, including fixed Chinese JSON analysis content descriptions. This indicates a default language/locale constraint without offering the user a choice or documenting why the skill must be Chinese-specific.
- Content
Static analysis
No suspicious patterns detected.