T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/md_to_pdf.py:276- Finding
Untrusted Markdown Can Trigger Local or Remote Resource Retrieval During PDF Rendering
- Content
View full analysis
- Remediation
View remediation
Security audit
横纵研究工作台
Security checks for vulnerabilities and agentic risk
Overview
The research workflow is coherent, but the optional PDF export has unsafe handling of report files and risky dependency-install advice.
Install only if you need a Chinese-language deep-research workflow, and treat PDF export as the risky part: use trusted Markdown only, prefer a virtual environment, avoid `--break-system-packages`, and run conversion in a constrained directory or sandbox if processing user-supplied reports.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
scripts/md_to_pdf.py:8- Finding
Unpinned Dependencies Are Installed with System Package Protections Disabled
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file states '输出语言：中文' as a default contract, which imposes a specific language choice in natural-language instructions. The policy allows locale or language constraints only when the skill offers user choice or clearly justifies the restriction; this file does not provide opt-in language selection or a documented regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language instruction requires the skill to 'deliver a structured Chinese research report,' which imposes a specific language regardless of user preference. This is a language/locale policy concern because the file does not offer a user choice or document a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown template is entirely written in Chinese and provides no indication that language choice is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file switches into Chinese and labels the default report structure as mandatory, with all required section headings written only in Chinese. This imposes a specific language on output without any opt-in, alternative locale, or justification that the skill is region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown guidance switches into Chinese for the substantive instructions, effectively imposing a language requirement on users who rely on the file. The file does not indicate that Chinese is optional, nor does it justify a China-specific or Chinese-language-only context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow content is written entirely in Chinese and presents the process as the default way to operate, but it does not offer an alternative language or state that the skill is intentionally limited to Chinese-speaking users. That creates a natural-language policy concern because it effectively forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated document sets
<html lang="zh-CN">unconditionally, which forces a specific language/locale in the output regardless of user preference. The file also uses Chinese-only default titles and labels, but the explicit locale setting is the clearest policy-relevant issue because no language selection mechanism or justification is provided.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing instructions entirely in Chinese, beginning at L014 and continuing through the rest of the document. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or alternative language option is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON schema includes user-facing natural-language text in Chinese while surrounding schema labels are in English. Because the file does not state that it is intended only for Chinese-speaking users or provide an opt-in language choice, it may violate a language/locale policy requiring explicit user choice or justification.
- Content
Static analysis
No suspicious patterns detected.