Security audit

tabular data processing and analysis

Security checks for vulnerabilities and agentic risk

Overview

This table-processing skill is not evidently malicious, but it needs Review because it can send spreadsheet-derived data to a remote LLM by default and has unsafe CSV output handling.

Install only if you are comfortable with table samples, schema, and category values potentially going to the configured LLM provider. For sensitive spreadsheets, use local-only modes such as disabling abstracts and header merging, run in a restricted workspace, choose an explicit output directory, and avoid untrusted spreadsheets until filename sanitization and CSV formula neutralization are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: script/src/split_region.py:190
Finding: Spreadsheet-Controlled Output Filename Enables Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation
str: value = re.sub(r"[^A-Za-z0-9 _.-]", "_", value).strip() value = value.replace("..", "_") return value[:100] or "table" base = Path(output_dir).resolve() name = safe_component(filename) + ".csv" destination = (base / name).resolve() if base not in destination.parents: raise ValueError("Output path escapes the designated directory") ``` 5. Use collision-resistant filenames or exclusive file creation to avoid silently replacing existing files. 6. Add tests for `../`, absolute paths, Windows drive paths, path separators, Unicode separator variants, and long filenames. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: script/src/table_description.py:91
Finding: Sensitive Table Values Are Transmitted to a Configurable Remote LLM by Default
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: script/split_table_skill.py:116
Finding: Generated CSV Files Preserve Spreadsheet Formula Payloads
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Python Dependencies and Unverified Remote Report Assets Create Supply-Chain Exposure
Content: View full analysis
=1.3.0 numpy>=1.20.0 openpyxl>=3.0.0 xlrd>=2.0.0 openai>=1.0.0 matplotlib>=3.5.0 ``` ```html ``` ### Technical Analysis Every Python dependency uses an open-ended lower-bound constraint. A future installation may therefore select versions that were never reviewed with this Skill. No lockfile, package hashes, or upper compatibility bounds are supplied, making builds non-reproducible and weakening protection against compromised releases or unexpected dependency changes. The EDA instructions also direct generated HTML reports to rely on third-party browser assets. The assets are not protected by Subresource Integrity, and at least some references do not identify immutable artifact versions. If an Agent corrects the Markdown-style URL syntax into executable CDN URLs, viewing the report executes JavaScript supplied by those remote services at viewing time. The URLs shown in the template are malformed as literal HTML `src` values because they contain Markdown link syntax. This may prevent them from loading unchanged, but it does not provide a security control and may encourage generated implementations to replace them with live CDN URLs ...[truncated 1362 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (67)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This finding highlights materially relevant behavior: the skill reads API credentials from the environment and can send table content to a remote OpenAI-compatible endpoint. In a data-processing skill, that creates a real exfiltration path for sensitive spreadsheet data, especially because the skill advertises LLM-assisted header merging, summarization, and EDA on potentially confidential business records.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding highlights materially relevant behavior: the skill reads API credentials from the environment and can send table content to a remote OpenAI-compatible endpoint. In a data-processing skill, that creates a real exfiltration path for sensitive spreadsheet data, especially because the skill advertises LLM-assisted header merging, summarization, and EDA on potentially confidential business records.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This finding highlights materially relevant behavior: the skill reads API credentials from the environment and can send table content to a remote OpenAI-compatible endpoint. In a data-processing skill, that creates a real exfiltration path for sensitive spreadsheet data, especially because the skill advertises LLM-assisted header merging, summarization, and EDA on potentially confidential business records.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding highlights materially relevant behavior: the skill reads API credentials from the environment and can send table content to a remote OpenAI-compatible endpoint. In a data-processing skill, that creates a real exfiltration path for sensitive spreadsheet data, especially because the skill advertises LLM-assisted header merging, summarization, and EDA on potentially confidential business records.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding highlights materially relevant behavior: the skill reads API credentials from the environment and can send table content to a remote OpenAI-compatible endpoint. In a data-processing skill, that creates a real exfiltration path for sensitive spreadsheet data, especially because the skill advertises LLM-assisted header merging, summarization, and EDA on potentially confidential business records.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This finding highlights materially relevant behavior: the skill reads API credentials from the environment and can send table content to a remote OpenAI-compatible endpoint. In a data-processing skill, that creates a real exfiltration path for sensitive spreadsheet data, especially because the skill advertises LLM-assisted header merging, summarization, and EDA on potentially confidential business records.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The complex-header flow explicitly uses an LLM to inspect the first rows of the table, but the documentation does not warn that table content may leave the local environment. In a table-cleaning context, this is dangerous because users may submit confidential spreadsheets and reasonably assume preprocessing is local-only.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares access to environment credentials and writes output files, but it does not define an explicit tool scope such as permissions or allowed-tools. In this skill's context, that matters because the document also authorizes dynamic Python generation for EDA, which can expand from legitimate analysis into unintended file access or external data transmission if the runtime is not tightly constrained.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file consistently presents the skill name, description, warnings, and usage instructions in Chinese, which effectively imposes a single language on users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale restriction is documented.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented as a local CSV cleaning utility, but the header-merging path instantiates an LLM service and sends table content into process_complex_header_table. That expands the trust boundary from local preprocessing to external or model-backed processing without making the behavior explicit, which can expose sensitive spreadsheet contents and violate user expectations or policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code calls get_llm_service() during cleaning with no warning, consent prompt, or visible indication that table data may leave the local environment. In a table-cleaning context, inputs often contain internal business or personal data, so silent transmission to an LLM-backed service can cause confidentiality breaches and compliance issues.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module and class documentation describe the skill as generating descriptive metadata, but omit that LLM-backed summarization may occur. This is dangerous because operators may rely on the docs to judge data-handling behavior and unintentionally expose sensitive table contents to a third-party service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code conditionally initializes an external LLM service and passes table data into describe_single_table for abstract generation, which can cause CSV contents to leave the local environment. This contradicts the skill’s framing as controlled/local table processing and creates a data exposure risk, especially if users process sensitive business or personal data without realizing remote inference is involved.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: LLM-generated summaries for table data can involve sending raw or partially processed CSV contents to an external service, yet the skill description does not prominently warn users about this behavior. In a table-processing context, datasets often contain confidential or regulated information, so undisclosed external transmission materially increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a much broader capability set including industrial preprocessing, deep exploratory analysis, visualization, and report generation. This documented module only covers splitting CSV/Excel files by blank rows and writing CSV outputs, with no analysis, visualization, or report-generation logic present.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file states the skill's function is to split Excel/CSV files into independent table files, with outputs limited to split CSV paths. However, the documented implementation also fills merged cells, removes leading/trailing blank rows and columns, and performs Excel cell type cleaning/conversion via preprocess_excel, which goes beyond pure splitting behavior and changes table content semantics.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill automatically creates directories and writes multiple CSV files to a user-supplied or inferred filesystem location without any explicit consent, sandbox restriction, or overwrite policy. In agentic contexts, this can cause unintended filesystem modification, data sprawl, or writing into sensitive paths if the input/output path is influenced by untrusted input.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: 文档在流程图和错误处理部分明确写明“非 CSV 文件”会被拒绝，但展示的 run() 代码只检查文件是否存在并直接调用 pd.read_csv，没有任何扩展名或格式校验。这不是信息缺失，而是文档对实际控制流作出了与代码不符的断言。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 这是一个 markdown 文件，因此应检查是否对可能影响用户数据或文件系统的行为提供告知。文档在流程中说明会保存结果并返回输出路径，但没有显式警示会在磁盘上写出文件、默认输出到输入文件所在目录，用户可能在未留意的情况下修改工作目录内容。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill enables optional LLM summarization but the documentation does not clearly warn that table-derived content may be transmitted to an external LLM service. In a table-processing context, CSVs often contain sensitive business or personal data, so silent external sharing can cause confidentiality and compliance violations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 文档在流程与错误处理部分明确写明会拒绝非 CSV 文件，并返回“不支持的文件格式”错误；但给出的 run() 核心代码只检查文件是否存在、创建输出目录、加载文件并写出结果，没有出现 '.csv' 扩展名校验或对应错误分支。这不是单纯的文档省略，而是文档主动描述了一个安全边界/输入约束，而示例实现未体现该行为。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation presents the skill as a local CSV header-merging utility, but the described implementation sends the first 10 rows of table data to an external or project-level LLM service for analysis. This creates a real data exposure risk because users may reasonably assume purely local preprocessing and may unknowingly upload sensitive spreadsheet contents to a remote model provider.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document explicitly describes packaging the first 10 rows of a user-provided table into a prompt and sending them to an LLM, yet provides no privacy warning or consent mechanism. This is dangerous because spreadsheets often contain sensitive business or personal data, and even partial rows may disclose confidential information when transmitted to third-party services.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: A table preprocessing skill having built-in fallback to OpenAI and environment-based credentials expands its trust boundary beyond simple local file handling. Even if intended for convenience, this can cause unexpected external transmission of user data and use of privileged API credentials in environments where the skill is assumed to be offline or minimally scoped.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template fixes the output document language to Simplified Chinese, which is a natural-language locale constraint. The file does not indicate that this is optional, user-selected, or required for a region-specific purpose, so it conflicts with the policy against forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.