Security audit

5S管理技能

Security checks for vulnerabilities and agentic risk

Overview

This 5S report skill is mostly coherent, but it needs review because data placed in generated HTML reports can become executable browser content.

Install only if you will use trusted inspection JSON or first fix the report generator to HTML-escape all data fields. Avoid opening or sharing generated reports from untrusted data, choose output paths carefully because existing files may be overwritten, and install Python dependencies from a reviewed, pinned dependency file rather than the ad hoc pip command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/report_generator.py:208
Finding: Stored HTML and Script Injection Through Unescaped Report Data
Content: View full analysis
5S管理报告 - {data.get('period', 'N/A')} ``` ```python 报告周期：{data.get('period', 'N/A')} | 区域：{data.get('region', 'N/A')} | ``` ```python {''.join([f'''

{i.get('type', '未知类型')} {'已整改' if i.get('status')=='resolved' else '待整改'}

{i.get('description', '')}
{'''
整改期限：{deadline}
'''.format(deadline=i.get("deadline", "未设置")) if i.get('status')!='resolved' else ''}
''' for i in issues])} ``` ```python {''.join([f'''

{imp.get('item', '')}

{imp.get('before', 0):.1f} → {imp.get('after', 0):.1f} +{imp.get('after', 0) - imp.get('before', 0):.1f}

{imp.get('date', '')}

''' for imp in improvements])} ``` ### Technical Analysis The report generator reads attacker-influenced fields from JSON and inserts them directly into an HTML document through Python formatted strings. It does not perform HTML escaping, contextual output encoding, or sanitization. Affected values include: - Report period - Region - Issue type - Issue description - Issue deadline - Improvement ...[truncated 2077 chars]
Remediation: View remediation
``` This should be defense in depth and must not replace output escaping. 6. Add automated tests using payloads containing angle brackets, quotes, event handlers, and script elements. Confirm that generated reports display the payloads as literal text and do not create executable DOM elements. ]]>

T08 · Insecure Dependencies

Note

Location: scripts/report_generator.py:18
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation
numpy== ``` 2. Generate and enforce cryptographic hashes for dependencies and transitive dependencies. For example, use a locked requirements file with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Document the approved package index and avoid silently relying on arbitrary environment-specific indexes. 4. Use a dependency-locking workflow such as `pip-tools`, Poetry, or an equivalent mechanism to produce reproducible installations. 5. Integrate dependency vulnerability scanning and periodic controlled updates into project maintenance. 6. Replace the generic installation instruction with a reference to the locked dependency file: ```text Install reviewed dependencies with: python -m pip install --require-hashes -r requirements.txt ``` 7. Correct `SKILL.md` so it accurately discloses the required third-party dependencies and their supply-chain considerations. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该描述将技能表述为一个覆盖5S全流程的综合助手，包含标准指引、检查、查询、设计、诊断、报告等多项能力。但代码只实现了其中很窄的一部分：基于已有检查数据生成可视化HTML报告，并附带简单统计和模板化建议。它不会执行检查、不会查询5S标准、不会设计现场目视化方案、也没有真正的诊断分析逻辑。因此，虽然“生成管理报告”这一点与声明部分一致，但整体描述明显夸大了能力范围，实际主功能是报告生成而非全流程5S管理辅助。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill documents use of a reporting script that reads JSON input and writes an HTML output file, but the frontmatter declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may infer broader file read/write capability than intended, increasing the chance of unintended filesystem access when the skill is invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: L020 将触发场景概括为“5S检查、标准咨询、目视化设计、现场问题诊断、改进报告生成”，这些表述覆盖面较大，但没有说明必须满足什么上下文、输入特征或排除哪些相似请求，容易与一般性的管理咨询或报告生成需求重叠。对于 markdown 技能说明，这种缺少边界和负例的触发描述属于模糊触发条件。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module description, CLI help text, report labels, and generated HTML are all hard-coded in Chinese, and the HTML explicitly sets lang="zh-CN". There is no indication that the tool is region-specific or that users can opt into another language, which may violate language/locale choice policy.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The report generator interpolates multiple untrusted JSON fields directly into HTML content and attributes without escaping, including period, region, issue type, issue description, deadlines, and improvement fields. If an attacker controls the input data, they can inject arbitrary HTML/JavaScript into the generated report, leading to stored XSS when the HTML file is opened locally or hosted/viewed in a browser; the 5S reporting context does not require active script capability, so this is unjustified and materially dangerous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation shows a command that generates an HTML report file but does not clearly warn that the workflow performs filesystem writes. Hidden or under-disclosed file creation can surprise users and agents, leading to accidental overwrites, writes to sensitive locations, or execution of output-generating behavior without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code performs a filesystem write by creating parent directories and writing the generated HTML report, but there is no confirmation prompt or explicit user-facing warning at the point of execution about modifying the filesystem. While the CLI arguments imply output generation, the operation itself lacks any direct disclosure such as a log message before writing or an overwrite notice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.