T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/data_io.py:115- Finding
Spreadsheet Formula Injection in CSV and Excel Exports
- Content
View full analysis
- Remediation
View remediation
Security audit
过程能力分析技能
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent process capability analysis skill, but users should use trusted input data and choose output paths carefully because generated reports can overwrite files and preserve spreadsheet formulas.
Install only if you are comfortable running local Python scripts on quality data. Keep outputs inside a chosen reports directory, avoid overwriting important files, and treat generated spreadsheets from untrusted data as potentially unsafe until formula-like cells are reviewed or sanitized.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/data_io.py:110- Finding
Unrestricted File Overwrite Through User-Controlled Output Paths
- Content
View full analysis
- Remediation
View remediation
Path: root = Path(output_root).resolve() destination = (root / requested_path).resolve() if destination != root and root not in destination.parents: raise ValueError("Output path is outside the approved report directory") if destination.exists(): raise FileExistsError("Refusing to overwrite an existing file") return destination ``` Production code should additionally perform race-resistant file creation and symlink protection rather than relying only on pre-write checks. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents the skill as a full process capability analysis tool, but this code chunk only handles reading/writing CSV/Excel/JSON data and basic validation. While export_results references sections like capability indices and PPM, it merely formats and writes precomputed results; it does not calculate them. The implemented behavior is a supporting data I/O module, not the described analytical capability itself, so the description materially overstates and misrepresents what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
整体领域与主要用途基本一致，确实用于质量/过程能力分析和可视化，也支持控制图、直方图、能力图生成。但声明中有两项关键能力与实现不符：第一，PP/PPK 被明确列为支持指标，实际代码只计算了 CP/CPK 及单侧 CPU/CPL，没有实现 PP/PPK；第二，声明支持正态/二项分布建模，而代码只使用正态分布拟合与正态 CDF 估算缺陷率，没有任何二项分布建模或二项能力分析逻辑。因此描述对能力范围有实质性夸大，应判定为不匹配。
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill instructs writing files such as charts and exported reports, but it declares no explicit tool scope or permissions. In agent environments, missing least-privilege declarations can allow broader-than-necessary file write capability, increasing the chance of unsafe writes, overwrites, or use in unintended filesystem locations.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a skill for computing CP/CPK/PP/PPK, statistical modeling, visualization, and generating quality analysis reports. While report export is in scope, these functions provide broad CSV/Excel read-write utilities for arbitrary data structures and directory creation, which is a materially wider behavior than analysis-focused process capability evaluation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The CSV export function writes to a fully user-provided path and creates missing directories without any path restrictions, overwrite checks, or confirmation. In an agent or automation context, this can enable unintended file creation or overwriting of arbitrary writable locations, increasing risk of data loss or misuse of the host filesystem.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The Excel export path is also fully controlled by input and the function creates directories and writes files directly with no safeguards. In a skill executed by an agent, this makes filesystem side effects easy to trigger and can overwrite important user files if the runtime has write access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The formatted report export writes JSON or XLSX reports to arbitrary user-supplied paths, again with directory creation and no overwrite controls. Because this skill is centered on data analysis, users may provide rich result data, so unintended writes can cause both integrity issues and accidental persistence of sensitive analysis outputs to unsafe locations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring and subsequent user-facing help/output strings are written only in Chinese, and the script provides no option to choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The argparse description and help strings are all user-facing text, but they are presented exclusively in Chinese. Because the script does not offer multilingual support or an explicit locale justification, this constitutes a language policy issue.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language text and CLI help in Chinese, starting with the module docstring, and later uses Chinese-only argument descriptions and error output. Because the skill does not offer a language option or explain that it is intentionally region-specific, it appears to enforce a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown guide presents all headings and explanatory content only in Chinese, with no indication that the user can choose another language and no documented reason that the content must be Chinese-only.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and subsequent user-facing CLI descriptions are written only in Chinese, which imposes a specific language on users without opt-in. This matches the policy category for language or locale constraints not presented as a choice or justified as region-specific.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The CLI supports an 'export' action that accepts arbitrary user-supplied data and writes it to CSV/XLSX/JSON without performing process capability analysis. This makes the script usable as a general data export tool, which is broader than a skill intended for quality engineers to assess process capability or generate analysis reports from computed results.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
ArgumentParser descriptions, help strings, and printed error messages are all hard-coded in Chinese. This creates a natural-language policy issue because the script does not offer users any language selection or indicate a justified locale restriction.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The function saves a generated chart directly to disk via the provided output path, and similar saves occur in other chart generators, but there is no explicit warning, confirmation, or user-facing message about file creation. This is a safety-relevant file-write operation under the audit criteria.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function persists generated output to disk using the caller-provided path, but does not provide any user-facing notice that a file will be created or overwritten. Under the code-file warning criteria, file writes should be disclosed unless already clearly surfaced elsewhere.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The capability chart function saves an image to the specified output path with no visible warning, confirmation, or disclosure to the user. This is a file-write operation that meets the audit's missing-warning criteria.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code creates directories automatically and later saves chart files to the user-supplied output path, but there is no user-facing disclosure beyond generic argument names. For a code-file audit, file writes should have some visible warning, confirmation, or clearly stated disclosure unless the behavior is explicitly communicated as part of the skill's stated purpose.
- Content
Static analysis
No suspicious patterns detected.