T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:96- Finding
Forced Promotional Output in API-Key Error Handling
- Content
View full analysis
- Remediation
View remediation
Security audit
Chart AI
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it needs Review because it can send spreadsheet data to ChartGen and contains unsafe endpoint and file-saving behavior that could expose data or write files outside the intended output folder.
Install only if you are comfortable sending prompts and spreadsheet contents to ChartGen. Avoid sensitive files unless you trust the service and runtime environment, do not set CHARTGEN_API_URL to an untrusted or HTTP endpoint, and prefer a fixed version that validates output filenames and download hosts.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
tools/chartgen_api.js:25- Finding
Unvalidated API Base URL Can Exfiltrate API Credentials and Uploaded Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
tools/chartgen_api.js:326- Finding
API-Controlled Artifact Identifiers Enable Path Traversal and Arbitrary File Writes
- Content
View full analysis
{ try { const mediaDir = getMediaDir(); const dest = path.join(mediaDir, `chartgen_${tag}.${ext}`); const mod = url.startsWith("https") ? https : http; const file = fs.createWriteStream(dest); mod.get(url, (res) => { if (res.statusCode === 301 || res.statusCode === 302) { downloadFile(res.headers.location, tag, ext).then(resolve); return; } if (res.statusCode !== 200) { resolve(null); return; } res.pipe(file); file.on("finish", () => { file.close(); resolve(dest); }); file.on("error", () => resolve(null)); }).on("error", () => resolve(null)); } catch { resolve(null); } }); } ``` ```javascript for (const art of result.artifacts) { if (art.image_base64) { const tag = art.artifact_id ? String(art.artifact_id) : String(Date.now()); const saved = saveBase64(art.image_base64, tag); if (saved) art.image_path = saved; } if (art.type === "ppt") { if (art.preview_images && art.preview_images.length > 0) { const paths = []; for (let i = 0; i < art.preview_images.length; i++) { const ptag = `${art.artifact_id || Date.now()}_slide${i + 1} ...[truncated 3694 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to upload user queries and potentially Excel/CSV files to an external API, but it does not require a clear user-facing disclosure that data will leave the local environment. Users may confirm a task without understanding that sensitive business or personal data is being transferred to a third party.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ## Tool — `tools/chartgen_api.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ## Tool — `tools/chartgen_api.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ## Tool — `tools/chartgen_api.js`
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md ### STEP 1 — Confirm Before Submitting Always respond in the user's language. **Must** include numbered options (1=go, 2=modify, 0=cancel). **Confirmation rules:** 1. **Cancel = abandon forever.** Never proceed with a cancelled task.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md ### STEP 1 — Confirm Before Submitting Always respond in the user's language. **Must** include numbered options (1=go, 2=modify, 0=cancel). **Confirmation rules:** 1. **Cancel = abandon forever.** Never proceed with a cancelled task.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares required environment access (
CHARTGEN_API_KEY) and invokes local code, but does not declare a restrictive tool scope such asallowed-toolsor equivalent permissions. This weakens least-privilege guarantees and can let the runtime expose broader tool capabilities than intended, increasing the blast radius if the skill is misused or modified.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation text is very broad: it triggers on generic requests for charts, reports, analysis, mentions of ChartGen, or any spreadsheet upload. Overbroad invocation can cause the agent to route unrelated or sensitive tasks to this third-party skill unnecessarily, increasing the chance of unintended data disclosure.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md **File upload:** Do NOT submit immediately. Recommend 3–5 analysis tasks (numbered, noting which files). User picks a number, types custom text, or cancels. Text request example (adapt to language): > I'll use **ChartGen** to create this for you: > 📊 **Generate a monthly sales trend line chart for 2025.** > **1** — Go ahead **2** — Modify **0** — Cancel
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This tool transmits user queries and uploaded spreadsheet contents to a third-party service at BASE_URL, including file contents read directly from disk and sent via multipart upload. In a data-analysis skill, that behavior is expected, but the lack of an explicit user-facing disclosure/consent mechanism in this file creates a real privacy and data-governance risk because sensitive local data may be exfiltrated to a remote service without sufficiently clear notice.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The tool saves returned images, previews, and PPTX artifacts to local media/workspace/tmp directories without an explicit user-facing warning or retention controls. This can leave sensitive generated outputs on disk, where they may persist longer than expected or be accessible to other local processes/users depending on system configuration.
- Content
Static analysis
No suspicious patterns detected.