Security audit

A3报告技能

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent A3 report generator, but its generated HTML can preserve attacker-supplied markup or scripts in reports that users may open or share.

Review or fix the HTML escaping issue before using this with data from untrusted sources or sharing generated reports. Treat generated files as sensitive business documents, store them appropriately, and avoid opening reports created from third-party JSON/input until the renderer escapes user-controlled fields.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_a3.py:911
Finding: Persistent HTML and JavaScript Injection Through Unescaped Report Fields
Content: View full analysis
{cause} {measures} {owner} {deadline} 📋 ''') return '\n'.join(rows) def build_timeline_rows(timeline): """Build timeline-table rows.""" if isinstance(timeline, dict): timeline = [timeline] if not timeline: timeline = [{}] rows = [] for item in timeline: name = item.get('name', '') phase1 = item.get('phase1', '') phase2 = item.get('phase2', '') phase3 = item.get('phase3', '') milestone = item.get('milestone', '') verification = item.get('verification', '') rows.append(f''' {name} {phase1} {phase2} {phase3} {milestone} {verification} ''') return '\n'.join(rows) ``` ```pytho ...[truncated 4974 chars]
Remediation: View remediation
` content so `` cannot terminate the element. - Avoid inserting untrusted values into JavaScript, CSS, or URL contexts. - Do not mark dynamically constructed, user-controlled row content as safe. 4. Validate parsed JSON structures and scalar types before rendering. Reject unexpected lists, dictionaries, or non-string values in fields expected to contain text. 5. Add automated regression tests using payloads such as: - `` - `` - `` - Encoded and mixed-case variants of closing tags and event handlers Tests should parse the generated document and verify that payloads appear only as text, not as executable elements or attributes. 6. Add a res ...[truncated 346 chars]

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior does not fully match the detected capabilities: the advertised 'forced interaction' and stepwise validation are not actually implemented in code, while image upload/paste/drag-drop embedding appears to exist without being clearly disclosed. Behavior mismatches are dangerous because users and reviewers may trust the skill with sensitive operational data under false assumptions, and undisclosed content embedding can expand data exposure or create injection surfaces in generated HTML.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a local script to generate an HTML file and references reading templates/resources, but it declares no explicit tool scope or permissions. In an agent environment, missing tool restrictions can let the skill gain broader file read/write access than users expect, increasing the chance of unauthorized file access or unintended persistence of sensitive business data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L020 将触发条件定义为“用户需要撰写A3改善报告、问题分析报告、改善提案等”。其中“问题分析报告、改善提案等”范围较大，缺少明确边界，容易覆盖日常通用分析或写作请求，导致误触发。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template sets and the surrounding UI text is fixed in Chinese, which enforces a specific language/locale for all users. Under the policy, forcing a locale without opt-in is a natural-language policy violation unless the restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function docstring and surrounding logic indicate it constructs 5Why table rows from the supplied root-cause data. In practice, it only uses the input to derive row labels and row count, while discarding the actual why text and emitting blank contenteditable cells, which contradicts the stated intent of constructing rows from the provided analysis data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill generates and saves an editable HTML report containing potentially sensitive business or production data, but the documentation does not clearly warn users about local persistence and sharing risk. This can lead to inadvertent retention or distribution of operational metrics, defect data, personnel names, and corrective-action details.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file is entirely written as a Chinese-only standard reference and does not offer an alternative language or indicate that Chinese is a required, justified locale for a region-specific workflow. Under the policy check, a skill artifact that effectively constrains language without user opt-in can be a locale-policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest describes assisting report completion through guided information collection and generation of editable HTML reports. This file generates the HTML report as expected, but the embedded page additionally includes a built-in 'save as HTML' export workflow and interactive image ingestion/persistence features, which expand behavior from pure generation into a self-contained local document editor/exporter.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code creates parent directories and writes output content to the path supplied by --output, which changes the local filesystem. Although file generation is part of the script's purpose, there is no confirmation prompt, warning comment near the write, or user-facing notice in the execution flow about where data will be written.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.