T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/balance_sheet_generator.py:91- Finding
Untrusted Excel Formulas Are Copied into the Generated Workbook
- Content
View full analysis
- Remediation
View remediation
Security audit
资产负债表生成
Security checks for vulnerabilities and agentic risk
Overview
This is a local Excel balance sheet generator, but it handles sensitive financial workbooks with under-scoped automatic file selection and can carry untrusted formulas into the generated file.
Install only if you are comfortable with the agent reading local financial workbooks. Prefer running it with an explicit source file and explicit output path, use trusted input files, and review the generated workbook for unexpected formulas or external links before opening broadly or sharing.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该文档从标题、使用说明到示例触发语均仅以中文呈现，并在 L23 给出固定中文指令“生成资产负债表”。根据规则，若技能强制特定语言而没有用户选择或明确、合理的区域性约束说明，属于自然语言政策问题。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes automatic reading of uploaded financial files and writing a new workbook to the workspace root without warning the user about data access, output location, or overwrite/duplication risks. Because the data involved is financial and potentially sensitive, silent file processing can lead to privacy issues, mistaken disclosure, or users unknowingly creating derived files from the wrong source.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase '生成资产负债表' is broad and the documentation says the skill will automatically read the latest uploaded file, which can cause the wrong financial workbook to be processed without explicit user confirmation or file selection. In a workspace containing multiple sensitive files, this increases the risk of unintended access, incorrect output generation, and accidental handling of confidential financial data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The rule explicitly instructs deletion of existing numeric values while preserving only selected cells, but it does not require any confirmation, backup, preview, or warning to the user before making destructive changes. In a spreadsheet-processing skill, this can cause silent data loss or corruption of financial records if the wrong workbook, sheet, or row mapping is used.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
All user-facing instructions, examples, and invocation guidance are presented exclusively in Chinese, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking environment. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This is a natural-language policy concern because the skill presents its purpose and usage in a single fixed language, which can force a locale on users without opt-in. The same pattern appears in the class/docstring and command-line usage text, indicating no alternative language path is offered.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code's user-facing natural language is entirely in Chinese, including the module description, usage text, examples, success messages, and error output. The file does not provide any user opt-in, fallback, or documented justification for restricting interaction to a specific language, which matches the locale-policy concern described for SQP-3.
- Content
Static analysis
No suspicious patterns detected.