yanmu-report-generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.4

Overview

This skill is a local Chinese-language stock report generator that reads user-provided analysis files and writes PDF or Word reports, with no evidence of hidden execution, exfiltration, or persistence.

Install dependencies in an isolated virtual environment, consider pinning fpdf2 and python-docx before use, and review generated investment conclusions because the skill automatically produces ratings from supplied valuation data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:120

Finding

Unpinned Third-Party Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:120
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip3 install fpdf2 python-docx

Technical Analysis

The documented installation command retrieves fpdf2 and python-docx without pinning reviewed versions or verifying package integrity. Consequently, the exact code installed depends on the package index contents and dependency resolution results at installation time.

No evidence indicates that either named package is currently malicious. The weakness is that dependency behavior may change after this Skill has been reviewed. A compromised package release, compromised package-index account, unsafe configured mirror, or incompatible future release could introduce arbitrary code into the report-generation environment. Python packages can execute code during installation and later when imported by scripts/generate_report.py.

Attack Path

1. An attacker compromises a dependency release channel, package maintainer account, or package mirror used by the operator.
2. The attacker publishes or serves a malicious release under one of the referenced package names.
3. A user follows the Skill instructions and runs the unpinned pip3 install command.
4. Pip resolves and installs the attacker-controlled release.
5. Malicious code executes during package installation or when the report generator imports the installed library.
6. The payload operates with the permissions of the user running pip or the report-generation script.

Exploitation therefore depends on compromise or manipulation of the configured dependency source; the repository itself does not contain a remote payload.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on those privileges and the execution environment, the malicious dependency could read or modi ...[truncated 269 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare dependencies in a version-controlled requirements file and pin each package to a reviewed version.
2. Pin all transitive dependencies through a lock file generated by a trusted dependency-management tool.
3. Record and enforce cryptographic hashes:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Install packages from an explicitly configured trusted index rather than relying on an unknown ambient pip configuration.
5. Review dependency updates before regenerating the lock file and use automated vulnerability and provenance checks in CI.
6. Install dependencies in an isolated virtual environment under a non-privileged account; never run the installation command with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring describes the tool as a Chinese-language broker report generator, and the rest of the script hardcodes Chinese report titles, labels, and content throughout. This imposes a specific language/locale by default with no opt-in, choice, or documented regional justification, which matches the natural-language locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.