Ifc Qto Extraction

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:03 AM UTC
• Version: 2.0.0

Overview

The skill’s core BIM quantity reporting is coherent, but its automation example exposes command execution and report-writing paths without enough safeguards.

Install or use this only in a controlled local workflow with trusted BIM files and trusted DDC converter binaries. Do not expose the n8n webhook as shown unless it is authenticated, path-restricted to approved model/output directories, avoids shell interpolation, and validates extensions. Generated HTML reports should escape model-derived text before being opened or hosted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:527

Finding

Webhook-Controlled Command Injection in n8n Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 527–529
Vulnerability Type: OS command injection through unsafe template interpolation
Risk Level: High

Vulnerable Code

yaml

- convert_model:
    node: Execute Command
    command: |
      "C:\DDC\RvtExporter.exe" "{{$json.model_path}}" complete bbox schedule

Technical Analysis

The n8n workflow receives requests through the /qto-extract webhook and directly interpolates the request-controlled model_path value into a command executed by a shell. Surrounding the value with double quotes does not provide adequate protection: an attacker may inject a closing quote and shell control characters, causing the shell to interpret additional commands.

The documented workflow does not authenticate the webhook, canonicalize the supplied path, enforce an approved model directory, restrict the filename extension, reject shell metacharacters, or pass the converter arguments through a non-shell process API.

Attack Path

1. An attacker sends a request to the /qto-extract webhook.
2. The request places a malicious string in model_path, containing a closing quote followed by shell command syntax.
3. n8n substitutes the value into the Execute Command node.
4. The operating-system shell parses both the intended converter invocation and the injected command.
5. The injected command executes with the privileges of the n8n service account.

Impact Assessment

Successful exploitation permits arbitrary command execution under the n8n process identity. Depending on that account's permissions, an attacker could read or alter BIM models and reports, access other files available to the service, execute programs, manipulate workflow data, or use the host as a foothold for further compromise. The scope is not necessarily administrative, but it includes all resources available to the n8n service account.

Remediation

View remediation

Remediation Suggestions

• Do not interpolate webhook input into an Execute Command shell string.
• Invoke the converter through a process API or dedicated n8n integration that passes executable arguments as a structured array without a shell.
• Canonicalize the requested path and verify that it remains under a dedicated, approved model directory.
• Enforce a strict extension allowlist, such as .rvt, and reject unexpected control characters, quotes, separators, and null bytes.
• Require authentication and authorization for the webhook.
• Run n8n and the converter under a dedicated least-privileged service account.
• Restrict filesystem access to the model input and report output directories.
• Record and monitor rejected paths and converter executions.
• If shell execution cannot be eliminated, use platform-appropriate robust escaping in addition to the allowlist and directory checks; escaping alone should not be the primary defense.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:363

Finding

Stored HTML Injection and Cross-Site Scripting in Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 363–435
Vulnerability Type: Unescaped attacker-controlled content in generated HTML
Risk Level: Medium

Vulnerable Code

python

html = f"""
<!DOCTYPE html>
<html>
<head>
    <title>QTO Report - {project_name}</title>
...
<body>
    <div class="header">
        <h1>Quantity Takeoff Report</h1>
        <p>Project: {project_name}</p>
...
"""

for category, items in sorted(by_category.items()):
    cat_count = sum(i.count for i in items)
    cat_area = sum(i.area for i in items)
    cat_volume = sum(i.volume for i in items)

    html += f"""
            <tr class="category-header">
                <td>{category}</td>
                <td class="number">{cat_count:,}</td>
                <td class="number">{cat_area:,.2f}</td>
                <td class="number">{cat_volume:,.3f}</td>
                <td class="number">-</td>
            </tr>
"""
    for item in sorted(items, key=lambda x: x.type_name):
        html += f"""
            <tr>
                <td>&nbsp;&nbsp;&nbsp;{item.type_name}</td>
                <td class="number">{item.count:,}</td>
                <td class="number">{item.area:,.2f}</td>
                <td class="number">{item.volume:,.3f}</td>
                <td class="number">{item.length:,.2f}</td>
            </tr>
"""

Technical Analysis

The report generator inserts project_name, category, and item.type_name directly into HTML text contexts without HTML escaping. Category and type values originate from converted BIM or spreadsheet data and may therefore contain attacker-controlled markup.

A malicious model can embed an HTML element with an executable event handler or other active content in one of these fields. That content is persisted in the generated report and interpreted when a user opens it in a browser. This is a stored HTML injection issue that can become stored cross-site scripting depending on the browser and delivery context.

Attac

...[truncated 1153 chars]

Remediation

View remediation

Remediation Suggestions

• Escape every dynamic text value with html.escape(value, quote=True) before inserting it into HTML.
• Apply escaping to project_name, category names, type names, levels, zones, materials, and any future model-derived fields.
• Prefer a template engine configured with automatic escaping rather than constructing HTML through string concatenation.
• Validate text fields and impose reasonable length limits, while retaining output encoding as the primary defense.
• Add a restrictive Content Security Policy, such as disallowing inline scripts and limiting external connections.
• If reports are served over HTTP, use an isolated origin without sensitive cookies or authenticated application privileges.
• Add regression tests using values containing <, >, &, quotes, script elements, and event-handler attributes to verify that they are rendered only as text.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest frames the skill as extracting quantities from BIM models with grouping and reporting. The code and examples go beyond extraction by generating new report files on disk, including formatted Excel and HTML outputs, which is a broader document-generation behavior than the narrow extraction wording suggests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code executes external converter binaries on user-supplied model paths and option lists, which introduces trust and supply-chain risk around those executables. Even though subprocess.run is used with an argument list rather than a shell string, invoking arbitrary or unverified binaries can lead to code execution in the context of the agent host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The n8n workflow exposes command execution through a webhook and interpolates untrusted input into an Execute Command node, creating a clear remote attack surface. If the webhook is reachable by unauthorized users, an attacker may trigger processing of arbitrary paths or abuse command construction depending on n8n's execution semantics, leading to unauthorized file access or command injection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill automatically writes Excel and HTML reports to output paths derived from inputs, and the n8n example writes to a provided output_path without warning or safeguards. In environments where paths come from untrusted users or automation, this can overwrite files or place generated content in sensitive locations.

Content

No source excerpt is available for this finding.