Security audit

Data Quality Check

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent construction data-quality helper that reads user-provided data and can create local reports, with reliability caveats but no hidden or malicious behavior found.

Install only if you are comfortable giving the skill access to the project files you point it at. Treat generated quality reports as local files that may contain sensitive construction data, and review the sample validation logic before relying on it for financial, compliance, or safety decisions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:342
Finding: Zero-valued range boundaries are silently disabled
Content: View full analysis
Remediation: View remediation
max_val`. 2. Verify that the target column is numeric before applying numeric bounds. 3. Define an explicit policy for null values rather than relying on incidental Pandas behavior. 4. Add regression tests for `min_val=0`, `max_val=0`, negative bounds, positive bounds, omitted bounds, and reversed bounds. 5. Test the documented `Volume_m3` and `Cost` rules with negative values to ensure they fail. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:448
Finding: Configured pipeline checks are overwritten by default validation checks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes exporting detailed quality reports to Excel without an explicit warning that potentially sensitive project data, validation issues, and metadata will be persisted to disk. In environments handling confidential construction data, this can cause unintended local data exposure, especially if users assume the skill only analyzes data in memory.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description emphasizes validation, thresholds, and reporting, which primarily suggests analysis behavior. The code goes beyond in-memory assessment by performing filesystem output through Excel report generation, a behavior not mentioned in the manifest description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.