Security audit

data-visualization

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent data-visualization skill, but it needs review because untrusted dataset text can be written into executable HTML dashboards.

Review this skill before installing if you expect to visualize files from other people or untrusted sources. Use trusted or sanitized CSV/Excel data, choose output paths carefully, and be aware that dashboards may load Plotly from a CDN unless the script is changed to embed a local reviewed copy.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_chart.py:302
Finding: Stored HTML Injection Through Untrusted Dataset Values
Content: View full analysis
= 0 else "#ef4444" change_icon = "↑" if change >= 0 else "↓" change_html = f'
{change_icon} {abs(change):.1f}% vs 上期
' return f"""

{icon}

{title}

{value}
{change_html}
""" ``` The untrusted value is obtained and passed into the HTML generator without escaping: ```python if characteristics['categorical_count'] > 0 and characteristics['numeric_count'] > 0: max_cat = df[categorical_cols[0]].value_counts().idxmax() metrics_html += create_metric_card(f"最常见{categorical_cols[0]}", f"{max_cat}", icon="🏷️", color="#10B981") ``` The resulting markup is inserted directly into the output document: ```html
{metrics_html}
``` ### Technical Analysis The input CSV or Excel file is treated as untrusted data. Both column names and categorical valu ...[truncated 2193 chars]
Remediation: View remediation
{safe_title}
{safe_value}
``` 3. Escape all column names, categorical values, labels, and other user-controlled strings that enter the surrounding HTML template. 4. Prefer a template engine with automatic escaping enabled rather than constructing HTML with unrestricted f-strings. 5. If selected HTML formatting must be supported, pass values through a well-maintained allowlist-based HTML sanitizer. Do not rely on removing only `script` elements, because event handlers, unsafe URLs, and other active content can also execute. 6. Add regression tests using values containing: - HTML elements. - Closing tags. - Event-handler attributes. - Single and double quotes. - Encoded and mixed-case payload variants. 7. Consider applying a restrictive Content Security Policy to generated dashboards as defense in depth, while retaining output encoding as the primary control. ]]>

T08 · Insecure Dependencies

Note

Location: SKILL.md:5
Finding: Unpinned Python Dependencies and Runtime CDN-Hosted JavaScript
Content: View full analysis
Remediation: View remediation
--hash=sha256: pandas== --hash=sha256: numpy== --hash=sha256: ``` 3. Generate and review dependency lock files through a controlled build process. Update them through explicit, tested dependency-upgrade procedures. 4. Install packages only from approved package indexes and avoid untrusted additional indexes. 5. Run software composition analysis and vulnerability scanning against the resolved dependency graph. 6. Generate self-contained dashboards by embedding the reviewed Plotly JavaScript: ```python plotly_html = fig.to_html( include_plotlyjs=True, full_html=False, config={ 'displayModeBar': False, 'displaylogo': False, 'scrollZoom': True, 'editable': False } ) ``` 7. If external hosting is operationally required, pin a specific reviewed Plotly version, document the network dependency, use a trusted HTTPS source, and enforce an appropriate Content Security Policy. Where script inclusion is controlled directly, add Subresource Integrity validation. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes behavior that writes an output HTML file but does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations can cause overbroad or implicit file-write capability, making unintended writes or misuse harder to constrain and audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger condition is very broad and overlaps with many ordinary visualization-related requests, which increases the chance the skill is invoked in situations the user did not explicitly intend. Overbroad invocation can lead to unnecessary file generation, unexpected data handling, or automatic execution paths in contexts where a simple advisory response would have been safer.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains extensive user-facing strings in Chinese, including the module description and later generated HTML with lang="zh-CN". The policy only permits a fixed language/locale when the user is given an opt-in choice or the restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill documentation does not clearly warn users that it will generate and write an HTML file derived from user-provided data. Without that warning, users may not realize data will be materialized into a local artifact, which can create privacy, overwrite, or unsafe-content concerns if the HTML embeds sensitive or untrusted content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: 该技能文档标题及全文内容均以中文呈现，但未说明这是可选语言，亦未交代该技能仅面向特定中文用户或区域场景。根据语言/locale 政策，若未提供用户选择或合理约束，强制单一语言可能构成自然语言策略违规。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 该文件从标题开始完全以中文编写，面向技能使用者提供格式规范时未说明仅适用于特定中文区域场景，也未提供语言选择或英文替代。根据规则，强制特定语言而无用户选择或明确合理限定，属于自然语言层面的政策风险。
Content: No source excerpt is available for this finding.