trtc-config-inspector

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:49 PM UTC
• Version: 1.0.1

Overview

The skill has a coherent TRTC configuration-audit purpose, but it downloads and extracts user-provided archives unsafely and can silently install packages at runtime.

Install only if you trust the file sources and can run the skill in an isolated workspace with restricted network access. Avoid feeding it untrusted archives until extraction is fixed, preinstall reviewed dependencies instead of allowing runtime pip installs, and require a manual review of any proposed source-code edits before applying them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_files.py:97

Finding

Unsafe Archive Extraction Allows Path Traversal Outside the Workspace

Content

View full analysis

Vulnerability Details

File Location: scripts/download_files.py, lines 97-106
Vulnerability Type: Unsafe ZIP and TAR archive extraction
Risk Level: High

Vulnerable Code

python

if zipfile.is_zipfile(archive_path):
    print(f"解压 ZIP: {archive_path} -> {dest_dir}", file=sys.stderr)
    with zipfile.ZipFile(archive_path, 'r') as zf:
        zf.extractall(dest_dir)
elif tarfile.is_tarfile(archive_path):
    print(f"解压 TAR: {archive_path} -> {dest_dir}", file=sys.stderr)
    with tarfile.open(archive_path, 'r:*') as tf:
        tf.extractall(dest_dir)
else:
    raise ValueError(f"不支持的压缩格式: {archive_path}")

Technical Analysis

The code extracts user-supplied ZIP and TAR archives using extractall() without validating archive member names or types.

Malicious archives can contain:

• Absolute paths.
• Paths containing ../ traversal components.
• TAR symbolic or hard links pointing outside the extraction directory.
• Special file entries or files targeting existing paths.

Consequently, an archive entry can resolve outside dest_dir and overwrite or create files elsewhere with the privileges of the Skill process. This contradicts the statement in SKILL.md that extraction is limited to the workspace.

The extraction behavior is required for the declared functionality, but unrestricted archive extraction exceeds the minimum privilege necessary. Each entry should be constrained to a regular file or directory beneath the designated workspace.

Attack Path

1. An attacker creates a ZIP or TAR archive containing an entry such as ../../target-file, an absolute path, or a TAR link pointing outside the extraction directory.
2. The attacker provides the archive through --code-url or as a local code archive.
3. download_and_extract() passes the archive to extract_archive().
4. extract_archive() invokes ZipFile.extractall() or TarFile.extractall() without member v ...[truncated 795 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve every archive member's destination using canonical paths before extraction.
• Verify that the resolved path is equal to or contained beneath the canonical extraction directory.
• Reject absolute paths, drive-qualified paths, null bytes, and paths containing traversal components.
• For TAR archives, reject symbolic links, hard links, device entries, FIFOs, and other special members unless explicitly required.
• On supported Python versions, apply a restrictive TAR extraction filter in addition to explicit path validation.
• Extract entries individually rather than calling unrestricted extractall().
• Reject duplicate or conflicting paths and avoid overwriting existing files by default.
• Apply limits for archive member count, individual uncompressed size, and total uncompressed size to mitigate archive bombs.
• Extract into a newly created private temporary directory and move validated content into the workspace only after successful validation.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download_files.py:54

Finding

Unrestricted URL Fetching Enables SSRF and Resource Exhaustion

Content

View full analysis

Vulnerability Details

File Location: scripts/download_files.py, lines 40-43 and 54-74
Vulnerability Type: Server-side request forgery and unbounded download
Risk Level: Medium

Vulnerable Code

python

def is_url(path):
    """判断是否为 URL（而非本地路径）。"""
    parsed = urlparse(path)
    return parsed.scheme in ('http', 'https')

python

def download_file(url, dest_path, timeout=120):
    """下载文件到指定路径。"""
    print(f"正在下载: {url}", file=sys.stderr)
    resp = requests.get(url, timeout=timeout, stream=True, allow_redirects=True)
    resp.raise_for_status()

    # 尝试从 Content-Disposition 获取文件名
    content_disp = resp.headers.get('Content-Disposition', '')
    if 'filename=' in content_disp:
        import re
        fname_match = re.search(r'filename\*?=(?:UTF-8\'\')?["\']?([^"\';]+)', content_disp)
        if fname_match:
            original_name = unquote(fname_match.group(1).strip())
            dest_dir = os.path.dirname(dest_path)
            _, ext = os.path.splitext(original_name)
            _, dest_ext = os.path.splitext(dest_path)
            if ext and not dest_ext:
                dest_path = dest_path + ext

    with open(dest_path, 'wb') as f:
        for chunk in resp.iter_content(chunk_size=8192):
            f.write(chunk)

    file_size = os.path.getsize(dest_path)
    print(f"下载完成: {dest_path} ({file_size} bytes)", file=sys.stderr)
    return dest_path

Technical Analysis

The Skill accepts any HTTP or HTTPS URL and performs the request from the Agent's network environment. It does not restrict resolved destinations, and it follows redirects automatically without validating each redirect target.

This permits requests to:

• Loopback services.
• Private network addresses.
• Link-local services.
• Cloud instance metadata endpoints.
• Other reserved or internal network ranges unavailable to the user directly.

DNS resolution can a ...[truncated 2281 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve hostnames before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IP ranges.
• Perform the same destination validation for every redirect rather than relying on unrestricted allow_redirects=True.
• Consider an allowlist of expected domains when the operational environment permits it.
• Protect against DNS rebinding by connecting only to validated resolved addresses and checking all address records.
• Reject URLs containing embedded credentials or unexpected ports unless explicitly required.
• Enforce permitted content types and validate downloaded file signatures before parsing or extraction.
• Set maximum sizes for Excel files and source archives using both Content-Length and a cumulative byte counter while streaming.
• Delete partial files when validation fails or a size limit is exceeded.
• Use separate connection and read timeouts and, where supported, enforce an overall download deadline.
• Run network retrieval with restricted egress and without access to cloud metadata or sensitive internal networks.

T08 · Insecure Dependencies

Warning

• Location: scripts/download_files.py:24

Finding

Automatic Installation of Unpinned Runtime Dependencies Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: scripts/download_files.py, lines 24-28; scripts/parse_excel.py, lines 16-20; scripts/diff_config.py, lines 22-26
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

scripts/download_files.py:

python

try:
    import requests
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'requests', '-q'])
    import requests

scripts/parse_excel.py:

python

try:
    import openpyxl
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'openpyxl', '-q'])
    import openpyxl

scripts/diff_config.py:

python

try:
    import openpyxl
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'openpyxl', '-q'])
    import openpyxl

Technical Analysis

When a dependency is unavailable, the Skill invokes pip install automatically during normal execution. Package versions and hashes are not pinned, and the installation source is determined by the runtime's pip configuration.

Python package installation can execute package build and installation logic. The effective code executed by the Skill can therefore change after the Skill package has been reviewed, based on mutable registry state, transitive dependencies, configured package indexes, or a compromised distribution.

The names requests and openpyxl correspond to legitimate packages, and no typosquatting or intentionally malicious package was identified. The vulnerability is the uncontrolled installation mechanism rather than evidence that the current packages are malicious.

Attack Path

1. The Agent runs the Skill in an environment where requests or openpyxl is missing.
2. The corresponding ImportError handler invokes pip.
3. Pip resolv ...[truncated 1078 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic package installation from runtime code.
• Declare dependencies in a controlled dependency manifest and lock file.
• Pin exact versions of direct and transitive dependencies.
• Require cryptographic hashes for downloaded distributions.
• Install dependencies during a separate, reviewed build or deployment phase.
• Use an approved package index or internal mirror with provenance controls.
• Prefer prebuilt, verified environments with no package-manager network access during Skill execution.
• If a dependency is missing, terminate with a clear installation instruction rather than invoking pip automatically.
• Run dependency vulnerability and integrity scanning as part of the release process.
• Install into an isolated virtual environment with the minimum filesystem and network permissions required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md

| `scripts/run_inspector.py` | End-to-end inspector entry point: download -> parse -> diff -> analyze code -> generate modification plan |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly instructs downloading remote Excel files and source code archives from user-provided URLs, then extracting them into the workspace, but it does not require a safety review of the archive contents, trusted origin verification, or safeguards against malicious archives. In this context, remote archive handling can expose the agent workspace to archive bombs, path traversal during extraction, or ingestion of untrusted code/data that influences later agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill directs the AI agent to locate and modify source code based on parsed external inputs, but the warning language is weak and framed as normal workflow rather than a high-risk action requiring explicit confirmation. Because the modification plan is derived from downloaded, user-controlled files, the agent may be induced to make unsafe or incorrect changes to a project without a strong checkpoint about code integrity, review, and potential side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatically installing a dependency during normal script execution is unrelated to the core diffing logic and introduces external package retrieval capability. In a security-sensitive or enterprise environment, this can unexpectedly alter the system, bypass change controls, and expose users to supply-chain attacks or unreviewed code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script performs subprocess-based package installation silently, with no warning or confirmation. That makes the behavior more dangerous in this skill context because the documented purpose is Excel diffing, not modifying the runtime environment, so users may not expect network access or package installation as a side effect.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script executes a subprocess to run pip and install a package at runtime. This is dangerous because it performs network-dependent code retrieval and package installation without user approval, expanding the trust boundary and enabling supply-chain or environment-manipulation risks if package sources or execution context are compromised.

Content

Scanner excerpt · scripts/diff_config.py (reported line 26)May include surrounding context.

python

import openpyxl
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'openpyxl', '-q'])
    import openpyxl

# 复用 parse_excel 的逻辑

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Installing a package via pip automatically during normal script execution is risky because it performs network-dependent code acquisition and modifies the runtime environment without warning or confirmation. In a security-sensitive agent skill, this is more dangerous because the skill may run in automated contexts where unexpected package installation bypasses normal dependency review and approval processes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

The script automatically invokes pip to install the requests package at runtime if it is missing. This introduces a supply-chain and environment-integrity risk because executing package installation triggers external code retrieval and installation without explicit user consent, and in privileged or production environments this can unexpectedly modify the host system.

Content

Scanner excerpt · scripts/download_files.py (reported line 31)May include surrounding context.

python

import requests
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'requests', '-q'])
    import requests

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

For a local Excel parsing utility, embedding package installation and subprocess execution is unnecessary and expands the script's attack surface. In the skill context, where code may run in shared or automated environments, this behavior can modify the host environment, pull unreviewed code from external sources, and violate least-privilege expectations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script executes a subprocess to run pip install openpyxl automatically when the import fails. This introduces unintended code execution and supply-chain risk because running pip installs arbitrary package code from the configured package index into the current environment without explicit user approval.

Content

Scanner excerpt · scripts/parse_excel.py (reported line 21)May include surrounding context.

python

import openpyxl
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'openpyxl', '-q'])
    import openpyxl

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Automatically invoking pip without warning or confirmation can surprise users and silently alter the runtime environment. If an attacker can influence package indexes, network traffic, or dependency resolution, this may result in installation of malicious code; even without an attacker, it creates unsafe and non-reproducible execution behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script accepts user-supplied URLs and paths, then immediately calls a download-and-extract routine without any visible validation, trust boundary checks, or explicit consent/warning. This is dangerous because it can trigger unintended network access and filesystem writes/extraction from untrusted sources, which increases exposure to malicious archives, unsafe destinations, or sensitive-environment misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script's natural-language interface and usage documentation are entirely in Chinese, with no indication that the tool is region-specific or that another language is unsupported by design. Under the language/locale policy, forcing a specific language without user opt-in or justification is a policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring states that when a URL parameter is given a local file path, the script will skip downloading and directly copy it. However, for --code-url when the local path is a file, the implementation routes it to extract_archive and unpacks it instead of merely copying it. This is an active documentation-to-code contradiction about a user-visible side effect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's docstring and CLI usage/help text are presented only in Chinese, and later error/output messages also use Chinese exclusively. This imposes a specific language on users without any documented opt-in or language-selection mechanism.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script walks the supplied code directory and opens matching source files for analysis, which can expose local project contents to the tool's processing. Although this is related to the tool's purpose, there is no explicit disclosure in the code that a provided directory will be recursively scanned and file contents read.

Content

No source excerpt is available for this finding.