T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fmea_tracker.py:301- Finding
Path Traversal in Project Export Destination
- Content
View full analysis
- Remediation
View remediation
Security audit
FMEA分析技能
Security checks for vulnerabilities and agentic risk
Overview
This FMEA helper is mostly purpose-aligned, but its export script can write outside the documented output folder and CSV exports do not neutralize spreadsheet formulas.
Review this skill before installing. It appears to be a local FMEA/RPN utility with no network or credential behavior, but use simple project names without slashes or path characters, avoid opening exported CSVs from untrusted inputs with spreadsheet formula execution enabled, and prefer a fixed sandboxed output directory until export path validation and CSV formula neutralization are added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fmea_tracker.py:303- Finding
Spreadsheet Formula Injection in CSV Exports
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
代码与声明中的一部分能力相符，确实支持RPN计算、风险等级评估以及基于S/O/D的简单改进建议。但声明描述了更完整的FMEA辅助能力，包括“失效模式识别”“预防措施跟踪”以及“支持DFMEA、PFMEA、SFMEA全场景”，而代码中没有相关数据建模、工作流、存储/跟踪逻辑，也没有针对不同FMEA类型的专门处理。该代码的实际主功能更窄，属于通用的RPN计算与评分参考工具，因此存在描述高于实际能力的明显不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises file-creating and exporting behavior and references Python scripts that read and write project data, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: an agent may be allowed to perform filesystem actions not clearly constrained or disclosed to the user, increasing the chance of unintended file access or writes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
L015 将触发条件写为“用户需要进行FMEA分析、评估产品风险或跟踪改进措施”，其中“评估产品风险”与“跟踪改进措施”范围非常广，未限定必须是 FMEA 语境。文档也未提供更具体的触发短语、边界条件或反例，容易与日常质量管理对话发生语义重叠。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill states that it can create and export spreadsheet files under the current working directory, but the behavior is not prominently surfaced as a user-consent-sensitive side effect. Undisclosed or under-disclosed writes can lead to accidental data creation, overwriting nearby files, workspace pollution, or leakage of sensitive project names and analysis content into local artifacts.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
L110 的“支持中文交互”本身不一定违规，但在自然语言策略层面容易被理解为该技能面向特定语言而未说明是否也接受其他语言或允许用户选择语言。当前文档没有显式提供语言/locale 选项或用户 opt-in 说明。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file includes user-facing descriptions, help text, output labels, and recommendations only in Chinese. That creates a locale/language policy concern because the skill effectively forces a specific language without user opt-in or an explicit justification that it is intended only for a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该代码文件中的模块说明、命令帮助文本和用户可见消息均使用中文，例如文件头说明和后续 CLI 帮助输出。这构成了默认语言/区域设定，但文件中没有提供用户选择语言的机制，也没有说明该限制是出于特定地区或合规场景需要。
- Content
Static analysis
No suspicious patterns detected.