GTYT Reconcile (共同赢账单 vs 到货单对账)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:23 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform the advertised spreadsheet reconciliation, but it handles sensitive billing reports through predictable temporary files and automatic Feishu delivery.

Review before installing. Use this only in a trusted environment, prefer a private output directory instead of the default /tmp, confirm the Feishu recipient before sending reports, and remove generated intermediate files when finished.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_full.py:24

Finding

Predictable Shared Temporary Files Enable Information Disclosure and Symlink-Based File Overwrite

Content

View full analysis

3 else '/tmp' os.makedirs(out_dir, exist_ok=True) here = os.path.dirname(os.path.abspath(__file__)) parsed_json = os.path.join(out_dir, 'gtyt_parsed.json') diff_xls = os.path.join(out_dir, '两表金额差异对比.xls') ``` `scripts/parse_tables.py:82`: ```python out_path = sys.argv[3] if len(sys.argv) > 3 else '/tmp/gtyt_parsed.json' ``` `scripts/parse_tables.py:186-187`: ```python with open(out_path, 'w', encoding='utf-8') as f: json.dump(output, f, ensure_ascii=False, indent=2) ``` `scripts/build_diff_report.py:22-23, 169`: ```python out_path = sys.argv[2] ``` ```python wb.save(out_path) ``` `scripts/mark_bill_diff.py:27-29, 69`: ```python bill_path = sys.argv[1] parsed_path = sys.argv[2] out_path = sys.argv[3] ``` ```python wbcopy.save(out_path) ``` ### Technical Analysis The default execution path writes sensitive reconciliation artifacts into the globally shared `/tmp` directory using fixed, predictable filenames. These files include: - `gtyt_parsed.json` - `两表金额差异对比.xls` - A predictably named marked billing workbook The intermediate JSON contains store names, SKU identifiers, quantities, unit prices, financial totals, and discrepancy details. File creation uses ordinary path-based writes without: - A private per-run temporary directory - Exclusive file creation - Symbolic-link rejection - Explicit restrictive permissions - Atomic output replacement - Unique per-run filenames On a multi-user system, an attacker can predict these paths and create symbolic links before the Skill runs. Standard file-writing operations generally ...[truncated 2013 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The core domain behavior matches the declared reconciliation intent: the script reads the expected bill and arrival-note formats, compares store-level amounts and store+SKU price/quantity/amount differences, and prepares detail suitable for later discrepancy marking. However, the declared description specifically promises a complete three-stage workflow that outputs two Excel files, including a highlighted original bill. This code chunk only performs the parsing/comparison stage and emits JSON. Because the missing Excel-generation and highlighting behavior are central deliverables in the declared purpose, this is a material description-behavior mismatch rather than a minor implementation detail.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill declares shell and file-write capable behavior but does not constrain tool scope with explicit permissions or allowed-tools. In an agent environment, this expands the blast radius of prompt injection or workflow mistakes, because the skill can write arbitrary files and invoke commands beyond what is necessary for spreadsheet reconciliation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly sends billing and delivery reconciliation outputs via Feishu DM, which may contain sensitive commercial and store-level data, but it provides no explicit user warning or confirmation step for data transmission. This increases the risk of inadvertent disclosure, especially in shared enterprise messaging environments or when users do not expect externalized file delivery.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language instructions and output entirely in Chinese, including the main docstring and command usage text. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not stated here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_full.py (reported line 46)May include surrounding context.

python

# Step 1: 解析
    print(f"[1/3] 解析账单 + 到货单 ...", file=sys.stderr)
    subprocess.check_call(['python3', os.path.join(here, 'parse_tables.py'),
                            bill_path, inv_path, parsed_json])

    # Step 2: 差异报告

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_full.py (reported line 51)May include surrounding context.

python

# Step 2: 差异报告
    print(f"[2/3] 生成差异对比 .xls ...", file=sys.stderr)
    subprocess.check_call(['python3', os.path.join(here, 'build_diff_report.py'),
                            parsed_json, diff_xls])

    # Step 3: 标黄

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_full.py (reported line 56)May include surrounding context.

python

# Step 3: 标黄
    print(f"[3/3] 在原账单上标黄差异 ...", file=sys.stderr)
    subprocess.check_call(['python3', os.path.join(here, 'mark_bill_diff.py'),
                            bill_path, parsed_json, marked_xls])

    # 输出 JSON 汇总

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This Python file contains its docstring, usage guidance, worksheet names, and status output entirely in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s natural-language interface is entirely in Chinese, including the top-level description, usage text, progress messages, and output naming. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This Python file contains a natural-language comment in Chinese ('销售全称 -> 到货简称') with no indication that the skill supports multiple languages or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.