T09 · Insecure Skill Coding Practices
Error
- Location
scripts/chart-generator.py:113- Finding
Path Traversal Through Dataset-Controlled Chart Filenames
- Content
View full analysis
- Remediation
View remediation
Security audit
Excel2Insights Pro
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent spreadsheet analysis tool, but it has unsafe local output handling that could write files outside the intended folder or create risky HTML reports from untrusted data.
Review before installing, especially if you may analyze spreadsheets from other people. Run it only in a contained working directory, avoid untrusted datasets until chart filename sanitization and HTML escaping are fixed, review generated reports before sharing, and prefer pinned dependencies or a lockfile for reproducible installs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report-generator.py:99- Finding
Stored HTML Injection Through Unescaped Dataset Column Names
- Content
View full analysis
Numeric{len(num_cols)}{', '.join(num_cols[:10])}{'...' if len(num_cols) > 10 else ''}" if cat_cols: html += f"Categorical{len(cat_cols)}{', '.join(cat_cols[:10])}{'...' if len(cat_cols) > 10 else ''}" ``` ### Technical Analysis Column names are obtained from the input dataset and interpolated directly into an HTML document. The code does not apply HTML escaping before joining and inserting those names. A malicious CSV, TSV, or spreadsheet can therefore use an HTML element as a column name. When the report is generated, that element is persisted verbatim in the output document. If the element contains an executable event handler or another active HTML construct, opening the report in a browser can activate the injected content. Although Pandas-generated statistical tables generally perform their own escaping, the manually constructed “Column Types” rows above bypass that protection. ### Attack Path 1. An attacker supplies a dataset with a crafted column header containing active HTML, for example an image element with an error event handler. 2. The victim runs `report-generator.py` or the automatic pipeline on the dataset. 3. Pandas classifies the maliciously named column as numeric or categorical. 4. The report generator inserts the raw column name into the HTML table. 5. The victim opens the generated report in a web browser. 6. The browser parses the injected header as markup rather than text and executes any browser-supported active behavior. ### Impact Assessment The injected content executes in the context of the locally opened report. Depending on browser controls and how the report is hosted, it may: - Modify or falsify report content. - Display decep ...[truncated 509 chars]- Remediation
View remediation
10 else "" html += ( f"Numeric{len(num_cols)}{names}{suffix}" f"" ) ``` 2. Prefer an auto-escaping template engine rather than assembling HTML through string concatenation. 3. Escape all other untrusted values, including chart paths, filenames, sheet names, and future dataset-derived report fields. 4. Add a restrictive Content Security Policy, such as disabling scripts unless report functionality explicitly requires them. 5. Add regression tests with column names containing HTML tags, quotes, event handlers, character entities, and malformed markup. 6. When reports are served by a web application, deliver them from an isolated origin and use an appropriate sandbox policy. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The package description is written entirely in Chinese, which signals a language-specific skill presentation without any indication that users can choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the policy, language or locale constraints should be opt-in or clearly justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example trigger phrases are broad natural-language requests like '帮我分析这份销售数据' and '看看有没有异常数据', which could cause the skill to be invoked in contexts the user did not specifically intend. In an agent environment, overly generic invocation examples can increase accidental execution of analysis pipelines, potentially causing unintended file reads, processing, and report generation on local data.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run_script(script_path, args_list): cmd = [sys.executable, str(script_path)] + args_list result = subprocess.run(cmd, capture_output=True, text=True, cwd=Path(script_path).parent.parent) if result.returncode != 0: return {"error": result.stderr} try:
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The default value for --charts includes "correlation", but generate_charts only supports the key "heatmap". This directly contradicts the documented supported chart behavior and causes the default invocation to silently skip correlation heatmap generation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script can persist analysis output to any user-specified path, and that output may include sensitive dataset contents such as categorical top values, cross-tabulated labels, sheet-derived metadata, and statistical summaries that can reveal private information. In an agent/skill context, users may not realize that analysis results are being written to disk, which increases the risk of unintended data retention or disclosure through insecure locations, shared workspaces, or later exfiltration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The HTML template sets lang="zh-CN", which imposes a specific language/locale setting on generated output. The file does not provide a user opt-in, configuration option, or documented region-specific justification for this locale choice.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The interface and documentation present this as a report generator supporting "html", "markdown", and "pdf" formats, but execution always calls generate_html_report and writes HTML content regardless of the selected format. This is an active intent/code mismatch because the declared option implies behavior the implementation does not provide.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README describes ingesting spreadsheet and tabular files, generating charts, and producing reports, but it does not warn users that sensitive business or personal data may be read, transformed, and reproduced in derivative outputs. This can lead to accidental exposure when users process confidential datasets and then share generated charts or reports without realizing sensitive fields may be retained or inferred.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing documentation is entirely in Chinese, including usage guidance and feature descriptions, with no indication that this language choice is optional or tied to a justified regional requirement. This can violate language/locale policy where skills should not force a specific language without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly describes generating charts and reports into an output directory but does not warn users that uploaded dataset contents may be reproduced in derived artifacts such as markdown reports and PNG chart files. This can lead to unintended persistence or wider exposure of sensitive data, especially if the output directory is shared, synced, or later inspected by other tools or users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document declares
lang="zh-CN", which fixes the content to a specific language/locale. The file does not indicate that this is optional, user-selected, or justified as a region-specific skill, so it may conflict with language-choice policy expectations.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This is a markdown file, so SQP-2 applies to omissions in user-facing warnings about behaviors affecting user data or system integrity. The walkthrough states that running the pipeline will produce analysis files, charts, and an HTML report under
output/, but it does not warn users that executing the commands will create or overwrite local files.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency is specified with a lower bound only, so installs can vary over time and across environments. This weakens reproducibility and can inadvertently pull in a newly introduced vulnerable or incompatible pandas release through the supply chain.
- Content
text pandas>=2.0.0 numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
pandas has at least one historical advisory, but because the manifest does not pin an exact version, it is impossible to verify from this file alone whether an affected release would be installed. The danger is uncertainty: environments may resolve to a vulnerable version if version constraints and transitive dependencies are not tightly controlled.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The numpy requirement is not pinned to an exact version, which allows different environments to resolve to different releases. That increases supply-chain risk and makes it harder to ensure that only tested and non-vulnerable versions are installed.
- Content
text pandas>=2.0.0 numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
numpy has multiple known advisories, and the unpinned manifest prevents confirming whether the eventual installed version is safe. While this file does not prove exploitation, it leaves a verifiable gap in dependency security assurance and could allow vulnerable versions into the environment.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Using openpyxl>=3.1.0 permits any newer version, including versions not yet reviewed for security or compatibility. This creates a low-severity supply-chain and reproducibility risk rather than an immediately exploitable flaw in the file itself.
- Content
text pandas>=2.0.0 numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0 tabulate>=0.9.0
Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
openpyxl has known historical security issues, and the lack of exact version pinning means the manifest cannot demonstrate that a safe version will always be used. In a skill that may process spreadsheets, this uncertainty is more relevant because vulnerable parsing libraries can increase exposure when handling untrusted files.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
matplotlib is not pinned exactly, so dependency resolution may change over time and introduce untested code into deployments. This undermines deterministic builds and can expose the environment to avoidable supply-chain issues.
- Content
text pandas>=2.0.0 numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0 tabulate>=0.9.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The seaborn dependency is version-ranged instead of fixed, allowing future installs to pull in different releases. That increases the chance of accidental adoption of vulnerable or breaking upstream changes.
- Content
text numpy>=1.24.0 openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0 tabulate>=0.9.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
tabulate is also unpinned, so builds are not reproducible and may consume new upstream releases without review. This is a classic low-severity dependency hygiene issue with supply-chain implications.
- Content
text openpyxl>=3.1.0 matplotlib>=3.7.0 seaborn>=0.12.0 tabulate>=0.9.0
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code creates an output directory and writes analysis and report artifacts, but it does not include a clear warning that running the pipeline will create files under the chosen output path. The status prints show progress and destinations after the fact, but they do not function as a user-facing disclosure before the write occurs.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring says the tool supports a "correlation heatmap", but the implementation only recognizes the chart type key "heatmap" in the dispatch table. This is an active documentation mismatch because a user following the documented name would not get the intended behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code creates parent directories and writes an HTML report to the specified output path, which is a file-system modifying operation. Although the CLI exposes an --output argument, there is no confirmation prompt, warning comment/docstring near the write, or user-facing log message disclosing that the script will create directories and write files.
- Content