Client Report Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:41 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its report-generation purpose, but its HTML export can carry unsafe HTML or JavaScript into client-facing reports.

Review generated HTML before sharing or hosting it, especially when report content comes from clients, analytics exports, dashboards, or other untrusted sources. Use the Markdown output when possible, and avoid publishing HTML output until escaping and link-scheme validation are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/report_to_html.py:179

Finding

Unescaped Markdown Content Enables Stored HTML and JavaScript Injection

Content

View full analysis

{apply_inline(c)}' for c in row ) ``` ```python if stripped.startswith('# '): text = stripped[2:] html_parts.append(f'

{apply_inline(text)}

') elif stripped.startswith('## '): text = stripped[3:] html_parts.append(f'

{apply_inline(text)}

') elif stripped.startswith('### '): text = stripped[4:] html_parts.append(f'

{apply_inline(text)}

') # Unordered list elif stripped.startswith('- ') or stripped.startswith('* '): if not in_list: html_parts.append('

') in_list = True text = stripped[2:] html_parts.append(f'
• {apply_inline(text)}
') # Ordered list elif re.match(r'^\d+\.\s', stripped): if not in_list: html_parts.append('
') in_list = True text = re.sub(r'^\d+\.\s', '', stripped) html_parts.append(f'
1. {apply_inline(text)}
') ``` ```python def apply_inline(text): """Apply inline markdown formatting.""" # Bold text = re.sub(r'\*\*(.+?)\*\*', r'\1', text) # Italic text = re.sub(r'\*(.+?)\*', r'\1', text) # Inline code text = re.sub(r'`(.+? ...[truncated 3196 chars]

Remediation

View remediation

` elements. - `` elements with `onerror`. - SVG-based event handlers. - Attribute-breaking quotation marks. - `javascript:` and encoded dangerous URL schemes. - Malicious content in headings, paragraphs, tables, lists, inline code, link labels, and link destinations. 7. Document that source reports and imported data are untrusted inputs and must remain encoded throughout the Markdown-to-HTML conversion pipeline. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code's primary purpose is preprocessing input data files into a normalized metrics structure. It auto-detects file format, reads CSV/TSV/JSON, classifies columns, parses numerics, computes simple statistics, and emits JSON. While this could support a reporting pipeline, it does not itself generate professional reports, client-facing summaries, campaign reports, or project status updates as declared. The behavior is therefore materially narrower and different from the stated description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims a content-generation/report-authoring capability: producing client-facing reports from raw data and metrics. The code does not analyze data, summarize KPIs, or generate report narratives. Instead, it only converts already-written Markdown into styled HTML. While this could be a supporting component within a report-generation system, the provided code chunk’s primary purpose is document formatting/rendering, which is materially different from the declared end-user function. Therefore this is a description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs the agent to read local files and invoke local scripts, but it does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization gap where the runtime may grant broader file access than users expect, increasing the risk of unintended data exposure or misuse when processing client data.

Content

No source excerpt is available for this finding.