Security audit

风险评估技能

Security checks for vulnerabilities and agentic risk

Overview

This risk-assessment skill appears purpose-aligned, but it should be reviewed because it reads full Excel workbooks and saves/prints potentially sensitive business-risk data with limited user controls.

Install only if you are comfortable with the agent reading uploaded Excel risk workbooks, including all sheets unless a sheet is specified, and with generated risk reports being saved locally. Use non-sensitive test files first, specify sheet names where possible, and avoid uploading confidential spreadsheets unless your environment protects command output, logs, traces, and saved report files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill’s declared purpose is a conversational ISO31000 risk-assessment assistant, but it also adds file-ingestion and Excel parsing behavior that materially expands its data-access surface. That mismatch can cause users or calling systems to underestimate that uploaded spreadsheets may be read in full and transformed, which is a security and privacy concern even if the functionality is plausibly related to the workflow.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to execute a local Python script on user-supplied Excel files, introducing code-execution and file-processing capability beyond pure chat guidance. Even without obvious malicious logic in this file, invoking a parser on untrusted documents increases attack surface and can expose local file contents or trigger unsafe parser behavior depending on implementation.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The TRACE section claims there is no external dependency risk, but the skill explicitly relies on pandas/openpyxl and a local parser script. This misleading assurance can reduce operator scrutiny and cause unsafe deployment assumptions about dependencies, parser behavior, and maintenance obligations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill directs parsing of uploaded Excel files without warning the user how file contents will be accessed, what sheets may be scanned, or how extracted data will be used. In a risk-assessment context, uploads may contain sensitive operational, supplier, personnel, or compliance data, so silent processing materially raises privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes saving versioned reports to disk without telling the user that their submitted business-risk information may be written as files. Because these reports can contain sensitive operational and compliance details, undisclosed persistence creates confidentiality, retention, and accidental exposure risks.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script prints the full parsed Excel contents as JSON to stdout, which can expose sensitive business or personal risk data if the tool is used in logs, pipelines, shared terminals, or agent traces. In this skill context, the files are specifically risk-assessment documents, which commonly contain incident descriptions, controls, owners, and internal assessments, making unintended disclosure more likely and more sensitive.

Static analysis

No suspicious patterns detected.