利润表生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent local Excel report generator, but it can carry formulas from an input spreadsheet into the generated financial workbook without neutralizing them.

Review before installing or using with spreadsheets received from other people or downloaded through messaging workflows. The generated workbook should be treated as potentially formula-bearing unless the skill is updated to escape category text beginning with characters such as =, +, -, @, tab, or carriage return. Also verify the hard-coded output path and the Chinese-language assumptions fit your environment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: generate_income_statement.py:87

Finding

Spreadsheet Formula Injection Through Untrusted Category Values

Content

View full analysis

Vulnerability Details

File Location: generate_income_statement.py, lines 87–91 and 115–119
Vulnerability Type: Spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

python

# Income categories
ws.cell(row=row, column=3, value=cat2)
ws.cell(row=row, column=5, value=total)
row += 1
for cat3, amount in cat3_dict.items():
    ws.cell(row=row, column=4, value=cat3)
    ws.cell(row=row, column=5, value=amount)

# Expense categories
ws.cell(row=row, column=3, value=cat2)
ws.cell(row=row, column=5, value=total)
row += 1
for cat3, amount in cat3_dict.items():
    ws.cell(row=row, column=4, value=cat3)
    ws.cell(row=row, column=5, value=amount)

The affected values originate directly from the source workbook:

python

cat2 = ws_detail.cell(row=row, column=4).value
cat3 = ws_detail.cell(row=row, column=5).value

Technical Analysis

The cat2 and cat3 category values are read from an input workbook and written into the generated workbook without validation or formula neutralization. OpenPyXL interprets a string beginning with = as a spreadsheet formula when assigning it as a cell value.

Consequently, a malicious source workbook can place formula syntax in either category column. Instead of appearing as a literal category label, that content is stored as an executable spreadsheet formula in the resulting profit statement. Other formula-triggering prefixes, including +, -, and @, may also be interpreted specially by spreadsheet applications or downstream export workflows.

OpenPyXL itself does not execute the injected formula during report generation. Exploitation occurs when the generated workbook is opened or processed by a spreadsheet application that evaluates formulas. The exact consequences therefore depend on the application, platform, security settings, and enabled spreadsheet features.

Attack Path

1. An attacker creates or modifies a sou ...[truncated 1691 chars]

Remediation

View remediation

Remediation Suggestions

Treat all text copied from source workbooks as untrusted data and neutralize formula-leading characters before assigning values to output cells.

1. Introduce a centralized helper that converts input values to safe literal spreadsheet text:

   python

   def safe_excel_text(value):
       if value is None:
           return ''
       text = str(value)
       if text.startswith(('=', '+', '-', '@', '\t', '\r')):
           return "'" + text
       return text
   

2. Apply it to every input-derived textual field:

   python

   ws.cell(row=row, column=3, value=safe_excel_text(cat2))
   
   for cat3, amount in cat3_dict.items():
       ws.cell(row=row, column=4, value=safe_excel_text(cat3))
       ws.cell(row=row, column=5, value=amount)
   

3. Validate category values against the expected business format. If category names should not begin with formula metacharacters, reject such workbooks or report the affected rows instead of silently accepting them.

4. Keep formula generation restricted to formulas constructed entirely by the application, such as the existing fixed cell-reference totals. Never concatenate untrusted workbook content into formulas.

5. Add regression tests covering values beginning with =, +, -, @, tab, and carriage return. Reload the generated workbook with OpenPyXL and verify that sanitized category cells have the string data type rather than the formula data type.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function docstring at L62-L68 says it generates an income statement from the detail sheet, and the surrounding documentation specifies complete output structure and formatting. However, the implementation leaves major sections as placeholder comments (L124-L131) and references max_data_row at L134 without defining it, so the code as shown cannot actually produce the documented finished report.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill title, instructions, worksheet names, and generated labels are all specified in Chinese, and the template sets output strings such as '利润表' and '收入' directly. There is no indication that the user can opt into this locale or choose another language, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown skill includes a usage example and explicit input/output file locations, showing that it processes local financial spreadsheets and writes a new workbook. There is no accompanying user-facing warning about modifying local data or creating output files, which is relevant because the skill handles potentially sensitive financial information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.