T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/export_haccp.py:86- Finding
Spreadsheet Formula Injection Through Untrusted HACCP Fields
- Content
View full analysis
- Remediation
View remediation
Security audit
HACCP技能
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Chinese-language HACCP planning and Excel export aid, with a real spreadsheet-safety caveat but no evidence of hidden, destructive, persistent, or data-exfiltrating behavior.
Install only if a Chinese-language HACCP drafting/export helper fits your workflow. Treat generated HACCP plans as drafts requiring qualified review, and avoid exporting or opening workbooks created from untrusted JSON until formula-leading values are sanitized.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
描述把该技能表述为一个可创建/完善HACCP计划并进行危害分析、设置关键控制点的工具，但实际代码只是一个本地命令行导出脚本：接收JSON数据或输入文件，使用openpyxl生成Excel工作簿并保存。没有看到任何关于危害识别、流程分析、CCP决策、规则校验或自动补全计划内容的实现，因此其主要能力比声明明显更窄。此外，声明特别提到“11列标准格式”，而代码实际定义了12个表头并合并到A:L列。导出Excel本身与声明中的“导出合规表格”部分一致，但整体描述对核心功能存在实质性夸大，因此应判定为不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger condition includes broad phrases plus a catch-all 'or similar expressions', which can cause the skill to activate in contexts the user did not clearly intend. Unintended invocation can lead to inappropriate handling of user content, accidental workflow takeover, or generation of compliance-sounding outputs without sufficient input validation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains natural-language usage instructions and operational messages exclusively in Chinese, including the module docstring and CLI help text context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a locale-specific justification is clearly documented, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The natural-language note '支持中文交互' presents the skill as Chinese-only or Chinese-default, and the document does not mention any user language choice or opt-in. Under the language/locale policy, forcing or implying a fixed language without offering alternatives can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, beginning with the title and continuing throughout the document. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire template guide is written in Chinese and presents the skill format and examples exclusively in that language. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not documented here.
- Content
Static analysis
No suspicious patterns detected.