T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/macro.sh:42- Finding
Unsanitized Task Input Can Inject VBA into Generated Macro Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Macro Helper
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly behaves like an Excel/VBA helper, but it also ships an unrelated local data and logging utility that is not clearly disclosed.
Review this skill before installing. Its main VBA helper script is mostly purpose-aligned, but the package also contains a separate generic data-management script that can write local data and history files outside the documented macro workflow. Treat generated macros as executable code: inspect them, test on backup workbooks, and avoid running generated VBA from untrusted task descriptions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises an Excel/VBA-focused assistant, but the supplied code is a standalone Bash command-line tool for simple local record management and logging. Its primary purpose is materially different: it stores entries in a local log/database file under a data directory, supports generic CRUD-like and search/export operations, and logs command usage. There is no evidence of VBA code generation, macro explanation, Excel integration, debugging, template handling, format conversion, or performance optimization. This is a clear description-behavior mismatch.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script materially deviates from the declared Excel/VBA-assistant purpose and instead exposes a generic local data-management CLI with persistent storage and logging. This kind of capability mismatch is dangerous because it broadens the skill's effective privileges and behavior beyond user expectations, creating opportunity for covert collection, retention, or misuse of local data under an unrelated cover story.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This shell skill presents its identity, command descriptions, and examples primarily in Chinese, which imposes a specific language on users. The file does not indicate that Chinese is optional, configurable, or justified as a region-specific tool, so it conflicts with the language/locale policy criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The generated VBA templates include row deletion, cell value rewriting, worksheet clearing, and sheet creation, which can affect user data. Although the VBA snippets contain success messages, the shell skill itself does not warn users that these templates may modify or remove workbook data when used.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The in-file description explicitly presents the script as a 'Multi-purpose utility tool,' which contradicts the skill metadata claiming it is an Excel macro/VBA helper. Such contradiction is a security concern because misleading labeling can conceal non-obvious behavior and defeats informed user consent and reviewer trust.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The logging function writes command activity and arguments to a persistent history file without any user-facing notice, consent, or retention explanation. This is dangerous because command arguments may include sensitive workbook names, macro content, search terms, or other user data that becomes silently stored on disk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The add/list/remove/search/export commands implement generic data handling unrelated to macro generation or VBA assistance. In the context of a narrowly described productivity skill, these capabilities are suspicious because they enable collection and retrieval of arbitrary user-provided content without a clear product need.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The add command persists arbitrary user-supplied content to a local file with no warning that the data will be stored. This creates privacy and data-governance risk because users interacting with what they believe is a macro helper may inadvertently save sensitive business content, formulas, or code snippets to disk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill description and workflow heading are presented in Chinese, while also including some English text, but there is no explicit statement that users may choose their preferred language. This can be a natural-language policy issue if organizational policy requires avoiding forced language or locale without user opt-in.
- Content
Static analysis
No suspicious patterns detected.