Security audit

质量成本分析技能

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate quality-cost analysis skill, but it needs review because it uses unsafe pickle loading and remote report JavaScript in under-disclosed ways.

Install only if you will process trusted local files and are comfortable reviewing or replacing the pickle workflow. Do not open generated reports with sensitive data unless the Plotly CDN dependency is removed, pinned, or otherwise controlled.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/calculator.py:290
Finding: Arbitrary Code Execution Through Unsafe Pickle Deserialization
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/chart_generator.py:293
Finding: Generated Reports Execute Mutable Unpinned Third-Party JavaScript
Content: View full analysis
\n\n\n' combined_html += '\n' combined_html += 'Quality Cost Analysis Charts\n' combined_html += '\n' ``` ```html ``` ### Technical Analysis Generated HTML documents load Plotly JavaScript from an external CDN. The explicitly constructed document uses the mutable `plotly-latest.min.js` alias rather than a fixed release and does not provide a Subresource Integrity hash. The chart fragments also use `include_plotlyjs='cdn'`, causing Plotly-generated HTML to depend on CDN-hosted JavaScript. Therefore, the executable content loaded by a report can change after this project has been reviewed and after the report has been generated. This also conflicts with the documented statement that generated reports are self-contained single files. Opening a report requires outbound network access and sends ordinary web-request me ...[truncated 1281 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This second mismatch finding describes a different overclaim set: the skill promises end-to-end quality-cost analysis and reporting, while the detected code apparently only outputs an intermediate pickle or otherwise incomplete artifact. Such discrepancies can cause unsafe automation decisions, incorrect business analysis, and unjustified trust in generated results or file outputs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This second mismatch finding describes a different overclaim set: the skill promises end-to-end quality-cost analysis and reporting, while the detected code apparently only outputs an intermediate pickle or otherwise incomplete artifact. Such discrepancies can cause unsafe automation decisions, incorrect business analysis, and unjustified trust in generated results or file outputs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents file-reading and file-writing behavior through multiple scripts and output artifacts, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can let the skill be invoked with broader filesystem access than intended, increasing the chance of overreach or unsafe file handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger condition is broad enough to match many ordinary analysis or reporting requests, which can cause the skill to activate outside its narrow competence. Over-broad activation increases the chance of inappropriate tool use, incorrect analysis on unsuitable inputs, and exposure of user files to a skill that may not need them.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation guidance lacks clear boundaries for when the skill should not run, making accidental or excessive invocation more likely. In a skill that touches local files and produces reports, ambiguous activation criteria can lead to unnecessary data access and misleading outputs in contexts where the assumptions of the workflow do not hold.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The HTML document explicitly sets the page language to "zh-CN", and the visible report content is also fixed in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template loads Plotly from an external CDN, which creates unnecessary network dependency for a skill described as local data analysis and report generation. If the CDN is unavailable, blocked, or serves compromised content, generated reports may fail to render correctly or could execute attacker-controlled JavaScript when opened.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file is natural-language guidance and all headings and instructions are presented only in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented regional justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains natural-language strings and documentation entirely in Chinese, beginning with the module docstring and continuing through CLI help and runtime output. Because the skill forces a specific language for interaction without any user opt-in or stated region-specific constraint, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Insecure deserialization: pandas.read_pickle()

Medium

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: The script deserializes attacker-controlled input with pandas.read_pickle(), which uses Python pickle under the hood and can execute arbitrary code during loading. In an agent skill context that processes user-supplied files, this is especially dangerous because a malicious .pkl file could achieve code execution as soon as the calculator reads it, before any business validation occurs.
Content: Scanner excerpt · scripts/calculator.py (reported line 300)May include surrounding context.
python
try: # 读取数据 df = pd.read_pickle(args.data) print(f"已读取数据: {df.shape[0]} 行, {df.shape[1]} 列") # 读取列类型（如果有）

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains natural-language strings that force a specific language/locale for the skill’s interface, including the module docstring and later user-facing status messages/argument help. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which is present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated chart fragments use Plotly with include_plotlyjs='cdn', which causes the resulting HTML to load JavaScript from an external network source at view time. For a local analysis/reporting skill, this introduces unnecessary outbound network dependency, creates privacy leakage about report access, and makes report integrity depend on a third-party CDN.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The saved combined HTML explicitly includes a remote , adding external code execution from a third-party origin whenever the report is opened. This expands the trust boundary beyond the skill's stated purpose and can expose sensitive business data in the report context to supply-chain or tracking risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language descriptions and CLI/help output in Chinese, starting with the module docstring and continuing throughout the script. That imposes a specific language on users without any opt-in or justification for a region-specific constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: L098 states '纯文档/脚本技能，无外部依赖风险', which contradicts the rest of the file describing executable scripts and required external packages such as pandas, openpyxl, plotly, and jinja2 in L018-L024. This is an intent/documentation contradiction rather than a mere omission, because it affirmatively asserts absence of external dependency risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 该技能文档标题与全文内容均使用中文，没有说明这是面向特定中文环境的区域性文档，也没有提供语言/locale 选择。根据规则，未取得用户选择即强制单一语言属于自然语言层面的语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 清单描述将该技能定位为质量成本分析工具，列出的是读取多Sheet数据、列识别、清洗、分类计算、图表和HTML报告输出等分析流程，但本文件实际还执行了未在描述中明确提到的中间结果持久化。将清洗后的数据保存为 pickle 属于额外的文件写入行为，而不是纯粹的数据读取/清洗实现细节。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: 该技能的 stated purpose 是质量成本分析及报告生成；写出 pandas pickle 是一种面向程序内部复用的序列化能力，而非用户可感知的分析或报告功能。相较于 CSV/Excel/HTML 等面向分析结果的输出，pickle 更像额外的工程便利能力，未从描述中得到直接支撑。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.