Security audit

multi-source-data-cleaner-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local data-cleaning utility, but its privacy and data-integrity safeguards are weaker than its documentation says.

Install only after reviewing the privacy and deduplication limitations. Treat all generated output and audit files as potentially sensitive, avoid relying on mask/drop for complete PII removal, and keep original data backups before using fuzzy deduplication.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run_pipeline.py:60
Finding: Raw PII Is Persisted in the Audit Profile Before Masking or Removal
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run_pipeline.py:12
Finding: Documented PII Masking and Removal Policies Leave Multiple Sensitive Data Classes Unchanged
Content: View full analysis
Dict[str, Any]: out: Dict[str, Any] = {} for k, v in row.items(): kl = k.lower() # date columns by name hint if any(t in kl for t in ("date","time","日期","时间")): iso = to_iso_date(v); out[k] = iso if iso else v elif any(t in kl for t in ("phone","mobile","手机","电话")): p = to_phone(v) if p and pii_policy == "mask": p = mask_pii(p, "phone") elif p and pii_policy == "drop": p = None out[k] = p elif any(t in kl for t in ("amount","price","金额","价格","数量","qty")): n = to_number(v); out[k] = n if n is not None else v elif any(t in kl for t in ("is_","enabled","active","有效","启用")): b = to_bool(v); out[k] = b if b is not None else v elif kl in ("name","姓名"): v = str(v) if v is not None else v if v and pii_policy == "mask": v = mask_pii(v, "name") elif v and pii_policy == "drop": v = None out[k] = v elif any(t in kl for t in ("id_number","身份证","idcard")): v = str(v) if v is not None else v if v and pii_policy == "mask": v = mask_pii(v, "id") elif v and pii_policy == "drop": v = None out[k] = v else: out[k] = v return out ``` ### Technical Analysis The skill documentation claims automatic PII handling for names, identity numbers, phone numbers, email addresses, physical addresses, bank-card numbers, IP addresses, and license plates. The implementation only recognizes limited column-name hints for ...[truncated 1747 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dedup.py:12
Finding: Fuzzy Deduplication Automatically Deletes Records Without the Promised Human Review Gate
Content: View full analysis
Dict[str, Any]: groups: List[List[int]] = [] assigned = [-1] * len(rows) for i, r in enumerate(rows): if assigned[i] != -1: continue group = [i] for j in range(i + 1, len(rows)): if assigned[j] != -1: continue sims = [similarity(str(r.get(k, "")), str(rows[j].get(k, ""))) for k in keys] if sims and sum(sims) / len(sims) >= threshold: group.append(j); assigned[j] = len(groups) assigned[i] = len(groups) groups.append(group) canonical = [rows[g[0]] for g in groups] return { "deduplicated_rows": canonical, "merge_groups": [g for g in groups if len(g) > 1], "input_count": len(rows), "output_count": len(canonical), "duplicate_pairs_removed": len(rows) - len(canonical), } ``` ```python if dedup_keys: d = dedup(all_rows, dedup_keys) all_rows = d["deduplicated_rows"] dq["uniqueness"] = { "input": d["input_count"], "output": d["output_count"], "removed": d["duplicate_pairs_removed"], } ``` ### Technical Analysis Every group whose average `SequenceMatcher` score reaches the hardcoded default threshold of `0.85` is automatically collapsed to its first row. All other records in the group are removed without conflict resolution or explicit approval. The pipeline replaces `all_rows` immediately with `deduplicated_rows`. Although `dedup()` returns `merge_groups`, the pipeline does not persist them for review. This contradicts the documented safeguard that uncertain fuzzy matches below 0.95 confidence are flagged for human review rather than automatically com ...[truncated 1622 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad, industrial-strength data cleaning system covering file/source handling, schema analysis, normalization, missing-data processing, cross-source reconciliation, deduplication, and reporting. The supplied code chunk does not implement that overall behavior. It is a narrow helper that accepts already-loaded rows and key names, groups similar records by average string similarity, and returns deduplicated rows plus basic counts. There is no evidence of source parsing, cleaning pipeline orchestration, schema handling, reporting, or other advertised capabilities. This is therefore a material description-to-behavior mismatch, primarily because the actual code covers only one subfeature of the much broader declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad end-to-end data cleaning system across heterogeneous sources, including file ingestion, schema analysis, missing-value processing, deduplication, source reconciliation, and report generation. The supplied code chunk is much narrower: it implements low-level type normalization utilities and PII masking helpers. While type normalization is one supporting aspect of data cleaning, the actual code does not substantiate the majority of the declared functionality. Additionally, PII masking appears as an undeclared capability. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad, production-grade data cleaning and unification capability across many file types and sources. The supplied code only profiles one tabular dataset from CSV or JSON and emits summary statistics. While profiling and limited CSV encoding fallback are tangentially related to the declared tool, the primary purpose is materially different: analysis/reporting rather than cleaning/merging/reconciling. There is no evidence of deduplication, missing-value processing, schema alignment, type normalization, multi-source support, or cleaned dataset generation. Therefore the description substantially overstates the implemented behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description overstates the implementation. The code does implement parts of a data-cleaning workflow: ingesting one or more files, per-source profiling, basic type normalization, optional deduplication, and outputting cleaned data plus reports. However, several headline capabilities in the declared purpose are absent or not evidenced in this chunk: no visible encoding/delimiter detection, no schema reconciliation across heterogeneous sources, no explicit missing-value treatment, and no clearly fuzzy deduplication. The supported-format claim is also not substantiated here because the code delegates reading to _read_rows without showing broad-format handlers. Additionally, the code includes a materially undeclared capability: PII masking or dropping based on policy. Overall, the actual behavior is a narrower demo cleaner with basic reporting and PII handling, not the full production-grade heterogeneous cleaning system described.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Overly broad trigger keywords can cause the skill to activate on generic requests, increasing the chance that user data is routed into a powerful file-processing workflow unexpectedly. In a data-cleaning skill that reads multiple local files and produces transformed outputs, over-triggering can lead to unintended handling of sensitive datasets, accidental modification workflows, or bypass of a more appropriate specialized skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes production-grade cleaning across CSV/Excel/JSON/Parquet/SQL dumps/log files, including schema reconciliation, type normalization, missing-value handling, fuzzy deduplication, and unified clean dataset output. In contrast, this script only reads JSON or CSV, computes basic per-column counts/uniqueness/null rates, and writes a profiling summary; it performs no cleaning, merging, deduplication, schema alignment, or support for the other claimed formats.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The generated report includes raw sample values from the dataset (sample: non_null[:3]) and may print them to stdout or write them to a file without any warning or masking. In a data-cleaning context, inputs often contain PII, credentials, financial records, or other sensitive business data, so this behavior can cause unintended disclosure through logs, terminals, shared files, or pipeline artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The pipeline writes the cleaned dataset to disk unconditionally, and the CLI allows --pii-policy=keep, which can preserve names, phone numbers, and ID numbers in the output file without any explicit warning, confirmation, or safer default behavior at write time. In a data-cleaning skill that processes heterogeneous user datasets, this increases the risk of accidental retention and disclosure of sensitive personal data through local artifacts, backups, or downstream sharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The docstring states the skill normalizes 'common Chinese/English data types,' which is a natural-language locale constraint. Because the file does not offer user opt-in for this language scope or explain why the limitation is required, it may violate the policy against forcing a specific language or locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.