T08 · Insecure Dependencies
Note
- Location
scripts/generate_doc.py:22- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
产品检验规程技能生成技能
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent document generator, but it can produce official-looking inspection documents with weak validation and unverified technical defaults.
Review generated inspection documents carefully before operational use. Treat outputs as drafts unless all product-specific standards, sampling plans, AQL values, environmental conditions, and required inspection items have been independently confirmed, and install python-docx from a trusted, pinned dependency source.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_doc.py:530- Finding
Document Generation Proceeds Despite Missing Required Validation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_doc.py:441- Finding
Unverified Technical Parameters Are Inserted as Defaults
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs reading local reference files and using a generation script, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization boundary gap: an agent may infer file access is acceptable without a least-privilege declaration, increasing the chance of unintended file reads or broader tool use in a real runtime.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
L119 的“支持中文交互”在语境中呈现为默认语言能力说明，但全文未说明是否支持用户选择其他语言或在需要时切换语言。按规则，若技能对语言/locale 施加默认约束而未提供用户选择，属于自然语言策略风险。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file presents the skill documentation entirely in Chinese and instructs the agent to produce JSON according to that specification, but it does not indicate that Chinese is optional or that the skill is limited to a Chinese-language/regional workflow. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
L016 将触发条件写为“用户要求生成检验规程、编制入厂检验规范、制作 IQC 检验文件”，虽然有一定领域限定，但仍缺少更具体的触发短语、上下文限制或不应触发的负例说明。对于相近的质量文档请求，这种描述可能导致技能被过宽激活。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring states the script generates Word inspection documents and all user-facing messages and content templates are written in Chinese, indicating a fixed language choice. There is no natural-language indication that users can select another language or that the Chinese-only behavior is a justified regional constraint.
- Content
Static analysis
No suspicious patterns detected.