Security audit

Issue Analysis Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent reporting purpose, but it bundles cloud credentials and routinely publishes potentially internal support reports to a public URL without adequate safeguards.

Review before installing. Do not run this skill on real customer, employee, or internal issue data unless the COS credentials have been revoked/replaced, public-read upload is disabled or explicitly approved, reports are reviewed/redacted, and tests are changed to use local synthetic fixtures with network upload mocked or gated.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: upload_cos.py:30
Finding: Hardcoded Tencent COS Credentials Exposed in Source and Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: upload_cos.py:70
Finding: Employee and Internal Operational Data Is Published as Public-Read Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: generate_report.py:167
Finding: Stored Cross-Site Scripting Through Unsafe Spreadsheet and JSON Values
Content: View full analysis
` sequence. A value controlled through the input workbook or a supplied JSON file can therefore terminate the script element and inject new HTML or JavaScript. HTML escaping alone would not be sufficient for values inserted into a JavaScript context. The data must be serialized as JSON and protected against script-element termination. Other dynamic values inserted into HTML text or table cells must separately receive context-appropriate HTML escaping. This is a stored vulnerability because the payload is written into the generated report, uploaded to COS, and executed later when a victim opens that report. ### Attack Path 1. An attacker places a payload in an accepted workbook field, such as a reporter, resolver, platform, type, module, or week ...[truncated 943 chars]
Remediation: View remediation
` cannot terminate the script element. 3. Prefer placing serialized data in an `application/json` element and parsing it explicitly. 4. Escape all values inserted into HTML text or table cells with `html.escape`. 5. Validate numeric chart values as integers or finite numbers before rendering. 6. Validate expected labels against length and character constraints. 7. Add a restrictive Content Security Policy that disallows inline scripts where feasible. 8. Self-host trusted JavaScript and avoid granting unnecessary network capabilities. 9. Add automated tests using quotes, backslashes, HTML tags, and `` payloads. 10. Regenerate and replace previously published reports after applying safe encoding. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: test.py:48
Finding: Test Harness Automatically Reads an External Workbook and Publishes a Report
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: check_before_deploy.py:205
Finding: Caller-Controlled URL Fetch Enables Server-Side Request Forgery
Content: View full analysis
2 else None cos_url = sys.argv[3] if len(sys.argv) > 3 else None ``` That value is passed directly to an HTTP client: ```python def check_response_headers(public_url, html_path): if not Path(html_path).exists(): return False with open(html_path, 'rb') as f: original_content = f.read() response = requests.get(public_url, timeout=10) ``` No scheme, hostname, destination address, port, or redirect validation is performed. ### Technical Analysis The checker describes its third argument as a COS URL but does not enforce that requirement. A caller can provide a loopback, private-network, link-local, cloud-metadata, or attacker-controlled URL. The process then performs a GET from the machine or Agent environment running the checker. The response status, headers, body length, and body equality are exposed through program output. Even when response bodies are not printed, these signals can be used to probe internal services. The default redirect behavior also permits an initially allowed-looking URL to redirect to an internal address. ### Attack Path 1. An attacker influences the third command-line argument or asks an Agent to validate a crafted URL. 2. The URL targets an internal service, loopback endpoint, private address, or metadata service. 3. `requests.get()` sends the request from the trusted execution environment. 4. The internal service responds. 5. The script reveals status and response characteristics through its validation output. 6. Repeated requests can identify reachable internal services or trigger state-changing GET endpoints. ### ...[truncated 418 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: generate_report.py:64
Finding: Unpinned Dependencies and Unsafely Loaded Third-Party Browser Script
Content: View full analysis
``` The documented installation commands also do not pin Python packages or verify hashes: ```bash pip3 install openpyxl qcloud_cos npm install chart.js ``` ### Technical Analysis The Python dependencies are resolved to whatever versions the package index serves at installation time. No lockfile, exact version, hash, or verified dependency manifest is supplied. This makes builds non-reproducible and increases exposure to compromised future releases or dependency-resolution mistakes. The generated report executes Chart.js directly from jsDelivr whenever a viewer opens it. Although the URL specifies a library version, the script tag provides no Subresource Integrity hash. A compromise affecting the package artifact, CDN, DNS path, or delivery account could therefore introduce JavaScript into every report view. ### Attack Path 1. An attacker compromises a referenced package release, dependency account, CDN artifact, or delivery path. 2. A user installs dependencies using the unpinned commands, or a viewer opens a generated report. 3. The compromised package or remote script is retrieved. 4. Malicious code executes in the Python environment or the viewer's browser. 5. The attacker obtains the capabilities available to that runtime context. ### Impact Assessment A compromised Python dependency would execute with the privileges of the user or CI process installing or running the Skill. A compromised browser dependency would execute in the report's web origin and could alter displayed data, redirect v ...[truncated 223 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file contains hardcoded COS cloud credentials (secret_id and secret_key) in a skill configuration artifact, which creates an immediate secret-exposure risk. Anyone with access to the skill or repository can reuse these credentials to read, overwrite, or publish content in the bucket, and the surrounding instructions explicitly enable browser-rendered HTML hosting, increasing abuse potential.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script hardcodes live Tencent COS credentials directly in source code, which enables anyone with access to the file to authenticate to the cloud bucket. In the context of an issue-analysis/reporting skill, embedding secrets plus upload capability creates a strong exfiltration path and can lead to unauthorized read/write access, data publication, bucket abuse, and full compromise of the associated cloud storage account scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code explicitly sets uploaded objects to ACL='public-read' and returns a public URL, making any uploaded report accessible on the public internet. For a customer issue report workflow, this is especially dangerous because reports may contain sensitive operational, customer, or security data, and the publication behavior is built in rather than gated by user consent or classification checks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains operational instructions only in Chinese, including headings, checklist items, and deployment steps. The policy for natural-language violations applies to all file types, and forcing a specific language without user opt-in or documented regional justification can violate language/locale requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly states the workflow uploads generated reports to COS and returns a public URL, but provides no warning that the report may contain sensitive operational or personal data from customer-service issue records. In this skill context, the data originates from Excel issue exports with fields like submitter, resolver, platform, status, and descriptions, so publishing to a public object store can cause unauthorized disclosure of internal business and possibly personal information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README tells users to check that the file ACL is set to public-read so the report link is accessible, which directly encourages public exposure of generated reports. Because the report aggregates customer-service issue data and may include unresolved issues, staff names, and business-sensitive trends, making the object world-readable materially increases the risk of data leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly advertises generating a public COS link for reports, but the documentation does not warn that uploaded reports may contain internal operational data, names, unresolved issue ownership, or other sensitive business information. This creates a real risk of unintended external disclosure because users may treat upload/publication as a normal step without informed consent or data-classification checks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The output is explicitly named report_cn_latest.html, indicating Chinese-language output as the default or fixed behavior. The skill description does not offer users a language choice or explain why Chinese-only output is required, which can violate language or locale choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The weekly workflow operationalizes upload, permission setting, and link distribution as a routine step, increasing the chance that sensitive customer-support analytics are exposed externally every week. In context, the report includes named personnel rankings and unresolved issue statistics, so silent public sharing could leak internal performance data and business-sensitive trends.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file presents all operational guidance, workflow steps, and usage instructions exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language text in the module docstring that presents the skill as Chinese-only, and the runtime usage/help and status messages elsewhere in the script follow the same pattern. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The top-level documentation describes checks of field names, response headers, chart rendering, and report generation as a pre-deployment validation script, but it does not disclose that the script will contact an external URL when a COS link is provided. This is an intent-level mismatch because the implementation in L204-L272 performs outbound HTTP requests rather than only local inspection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring and CLI usage text are entirely in Chinese, and the script continues this pattern in all user-facing output. For a general-purpose checking script, this imposes a specific language/locale on users without offering a choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The configuration enables auto_upload and documents COS publication behavior without any warning, consent step, or data-classification guardrails. In this skill's context, the generated reports include customer issue data and are uploaded as inline HTML to a public-accessible path, which creates a real risk of unintended external data exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The output file name report_cn.html indicates the generated report is specifically Chinese-language, and the document does not offer any language choice or opt-in. This is a natural-language locale policy concern because the skill appears to enforce a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The published COS artifact report_cn_latest.html reinforces that the skill outputs Chinese-language reports, but the file provides no user-facing option to choose another language or acknowledge the locale restriction. This can violate language/locale policy unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The test script directly calls weekly_report(test_file), and based on the surrounding skill context this report flow may include network upload behavior via the referenced upload_cos.py path. Running a test command is typically expected to be local and non-destructive, so invoking functionality that may exfiltrate generated data or perform external side effects without an explicit warning or confirmation is unsafe.
Content: No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The put_object call is part of an outbound transfer path that copies local file contents to remote cloud storage. In isolation cloud upload is not always malicious, but in this skill context it is risky because the upload is paired with embedded credentials, public exposure settings, and a report-handling purpose that does not justify unrestricted external publication.
Content: Scanner excerpt · upload_cos.py (reported line 72)May include surrounding context.
python
print(f"\n【尝试 {retry_count + 1}/{max_retries}】上传文件...") # 上传并设置正确的响应头 response = client.put_object( Bucket=BUCKET, Body=content, Key=cos_key,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script can upload arbitrary local file contents and expose them publicly without a clear warning, approval step, or validation that the file is safe for internet publication. This increases the chance of accidental disclosure of confidential files and turns the skill into an easy data-leak mechanism if misused by a user or another component.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script automatically uploads the generated HTML report to COS using a public URL flow without any explicit consent, warning, or configuration gate at the point of transmission. Because the report summarizes customer issue data and may contain sensitive operational or user-related information, this creates a real data exfiltration/privacy risk if operators run the tool assuming processing is local-only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill documentation appears to force a single language/locale for all user-facing instructions and outputs such as report_cn.html, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file-level description repeatedly states Chinese-only behavior, including '中文完美显示', and all user-facing strings are fixed in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown report is written fully in Chinese, including headings, labels, and the linked report name, with no indication that users can choose another language or that the skill is intentionally region-specific. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown template forces a single language/locale for the generated report content, including headings and labels, and does not indicate any user opt-in or configurable language option. Under the stated policy, fixed language output without user choice can be a natural-language policy violation unless it is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's natural-language strings and description are entirely in Chinese, including the skill description and user-facing test output, with no indication that language is configurable or intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a skill implicitly forces one language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.