Security checks for vulnerabilities and agentic risk
Overview
This GDPR skill is a local report-and-template helper with no evidence of network access, persistence, credential access, or system modification, but users should treat its outputs as advisory and avoid untrusted HTML report content.
Install only if you are comfortable with a Chinese-language, advisory GDPR checklist/template tool. Do not treat generated reports as legal advice or compliance proof, pin dependencies in a controlled environment, and avoid generating or opening HTML reports from untrusted input until HTML escaping is fixed.
"
```
3. Prefer an auto-escaping template engine rather than constructing HTML with f-strings. If Jinja2 is used, configure an environment with `select_autoescape(["html", "xml"])` and do not mark report fields as safe.
4. Apply encoding separately for element text and HTML attributes. Do not rely on JSON encoding, Markdown encoding, or input validation as substitutes for HTML output encoding.
5. If reports are served over HTTP, add a restrictive Content Security Policy, such as one that blocks inline scripts, event-handler execution, plugins, and unexpected remote resources.
6. Add regression tests using at least the following payload classes:
- ``
- ``
- ``
- Encoded closing tags and quotation-mark payloads
7. Document whether report fields may contain untrusted organizational or user-provided content, and treat all such fields as untrusted by default.
]]>
=2.0.0
jinja2>=3.1.6
```
The documented installation command in `README.md` is:
```bash
pip install -r requirements.txt
```
### Technical Analysis
The requirements file states that dependency versions are locked, but both packages use minimum-version constraints. The `>=` operator permits installation of any later release satisfying the constraint.
Consequently, a future installation may retrieve dependency versions that were not present during this audit and may have materially different code or transitive dependencies. No lock file or package hashes constrain resolution to reviewed artifacts.
Python dependency installation can invoke build backends and package installation logic. Therefore, dependency resolution is part of the code-execution trust boundary rather than merely a compatibility concern.
The reviewed executable scripts do not import `pandas` or `jinja2`, making this exposure avoidable for the currently packaged command-line functionality.
### Attack Path
1. A user follows the documented setup procedure:
```bash
pip install -r requirements.txt
```
2. The package index resolves the newest releases satisfying `pandas>=2.0.0` and `jinja2>=3.1.6`, including their current transitive dependencies.
3. A future compromised release, maliciously replaced distribution artifact, or vulnerable transitive dependency satisfies the broad constraints.
4. `pip` downloads the unaudited package artifacts.
5. Build or installation logic executes under the account running `pip`, or the malicious package code executes when imported later.
6. The compromised dependency obtains the same local privileges and environmental access as the installing or executing
...[truncated 776 chars]
Remediation
View remediation
jinja2==
```
3. Generate a lock file that also fixes all transitive dependency versions for each supported Python environment.
4. Require cryptographic hashes for every distribution:
```bash
pip install --require-hashes -r requirements.txt
```
5. Generate locked and hashed requirements through a reproducible dependency-management process, such as `pip-compile --generate-hashes`.
6. Install dependencies inside a dedicated virtual environment as an unprivileged user. Do not recommend installation with `sudo`.
7. Add automated dependency vulnerability scanning and scheduled review of direct and transitive dependencies.
8. Correct the requirements-file comment so it accurately describes the constraints and does not claim versions are locked unless exact versions and hashes are enforced.
]]>
If the tool mainly generates documents or templates while claiming broad compliance assessment functionality, users may treat generated output as if it reflects a complete GDPR review. For a local-only compliance skill, this context makes the issue less about external compromise and more about integrity and trustworthiness of governance processes, but that can still cause material harm.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
If the tool mainly generates documents or templates while claiming broad compliance assessment functionality, users may treat generated output as if it reflects a complete GDPR review. For a local-only compliance skill, this context makes the issue less about external compromise and more about integrity and trustworthiness of governance processes, but that can still cause material harm.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
If the tool mainly generates documents or templates while claiming broad compliance assessment functionality, users may treat generated output as if it reflects a complete GDPR review. For a local-only compliance skill, this context makes the issue less about external compromise and more about integrity and trustworthiness of governance processes, but that can still cause material harm.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
If the tool mainly generates documents or templates while claiming broad compliance assessment functionality, users may treat generated output as if it reflects a complete GDPR review. For a local-only compliance skill, this context makes the issue less about external compromise and more about integrity and trustworthiness of governance processes, but that can still cause material harm.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
If the tool mainly generates documents or templates while claiming broad compliance assessment functionality, users may treat generated output as if it reflects a complete GDPR review. For a local-only compliance skill, this context makes the issue less about external compromise and more about integrity and trustworthiness of governance processes, but that can still cause material harm.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises file-writing behavior such as generating reports, but it does not declare an explicit tool scope like permissions or allowed-tools. That creates an authorization ambiguity where an agent or platform may permit broader file operations than the skill metadata makes clear, increasing the risk of unintended writes or misuse. The repeated safety language does not mitigate this and instead highlights that the manifest is relying on claims rather than enforceable restrictions.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The skill description and the rest of the markdown are written entirely in Chinese, and there is no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
This Python file contains user-facing documentation and runtime messages entirely in Chinese, including the class/module docstrings and interactive prompts. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
This Python file hard-codes user-facing descriptions, help text, severity labels, and report output in Chinese throughout the CLI. The policy scope includes language/locale violations for all file types, and there is no option for users to select another language or explicitly opt into Chinese-only output.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
This Python file contains natural-language policy text, so SQP-3 applies. The clause states that all disputes are governed by the law of the People's Republic of China and resolved in the developer's local court, which imposes a specific locale/jurisdiction by default rather than making it optional or documenting it as region-specific.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
This code embeds Chinese-language strings throughout the generated reports and explicitly sets the HTML document language to "zh-CN". Because the file provides no user opt-in, language selection, or documentation that the skill is intentionally region-specific, it constitutes a natural-language locale policy concern.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
This file contains natural-language content that forces a specific language/locale for the tool description and user interaction. Under the policy, language restrictions should either be optional for the user or clearly documented and justified as region-specific.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The interactive prompts, printed messages, and argument help strings are all Chinese-only, which imposes a language choice on users. The file does not provide an alternative language, user opt-in, or a documented justification for the locale constraint.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
This code file contains natural-language strings and docstrings that require Chinese for understanding and operation, including the tool description and later prompts. The policy allows locale constraints only when the user is given a choice or when the restriction is clearly documented and justified, neither of which is present here.
Content
No source excerpt is available for this finding.
Ae4
Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
This code file contains user-facing descriptions and docstrings primarily in Chinese, including the tool title and operational description. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation, and there is no indication here that users may choose another language or that the tool is intentionally limited to a Chinese-speaking context.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
This Python file includes natural-language docstrings and output text that force a specific language/locale for users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is present here.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
This code file contains natural-language documentation and runtime messages that are exclusively in Chinese, including the module docstring and method descriptions. Under the policy for natural-language violations, forcing a specific language without offering a user choice can be a locale/language policy issue.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
This Python file contains its module docstring entirely in Chinese and later emits Chinese user-facing messages, which constitutes a language/locale constraint expressed in natural language. The policy allows locale constraints only when documented and justified or when users are given a choice, neither of which is present here.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
Multiple return messages in this validator are natural-language outputs intended for users or downstream operators, and they are written only in Chinese. Because the file does not provide locale selection or clearly justify a China-specific scope, this is a policy-relevant language restriction.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
83% confidence
Finding
This markdown file contains substantial Chinese-language user-facing content such as headings and release notes, while also using some English labels. Under the language/locale policy rule, forcing a specific language without user opt-in or documented justification can be a policy concern, and no such choice or justification is provided in this file.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
96% confidence
Finding
The file's user-facing instructions and operational guidance are presented in Chinese throughout, including setup, usage, features, and legal notices. Under the policy, forcing a specific language without giving users a choice or documenting the locale constraint is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
89% confidence
Finding
This markdown file presents all guidance in Chinese and does not indicate that the language is optional, user-selectable, or justified as a region-specific constraint. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
84% confidence
Finding
The natural-language comments present the skill description entirely in Chinese, which can indicate a language-specific constraint without any user choice or explicit justification in this file. Under the policy, language or locale restrictions should be opt-in or clearly documented as region-specific.
Content
No source excerpt is available for this finding.
Unpinned Dependencies
Low
Category
Supply Chain
Confidence
94% confidence
Finding
Using a lower-bound specifier for pandas instead of an exact pinned version makes builds non-reproducible and can silently pull in future releases with breaking changes or newly introduced vulnerabilities. Because this skill relies on local execution and data processing libraries, an unsafe or incompatible dependency version could affect confidentiality, integrity, or availability of processed compliance data.
Content
Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
` - `` - Encoded closing tags and quotation-mark payloads 7. Document whether report fields may contain untrusted organizational or user-provided content, and treat all such fields as untrusted by default. ]]>