Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent quality-report generator, but it needs Review because it can auto-install dependencies and generate unsafe HTML from report data.
Install only if you are comfortable giving the skill access to the report source files you provide. Run it in a scoped workspace, require approval before dependency installation, avoid using untrusted Excel/Markdown content, and treat generated HTML as potentially active content until the renderer escapes or sanitizes inputs and uses secure temporary files.
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
Location
scripts/md_to_html.py:45
Finding
Unescaped Markdown Content Allows Script Injection in Generated HTML Reports
Content
View full analysis
str:
html = content
html = re.sub(r'^# (.*?)$', r'
\1
', html, flags=re.MULTILINE)
html = re.sub(r'^## (.*?)$', r'
\1
', html, flags=re.MULTILINE)
html = re.sub(r'^### (.*?)$', r'
\1
', html, flags=re.MULTILINE)
html = re.sub(r'\*\*(.*?)\*\*', r'\1', html)
html = re.sub(r'^- (.*?)$', r'
\1
', html, flags=re.MULTILINE)
html = re.sub(r'\|', '', html)
html = re.sub(
r'^(.*?)$',
r'\1',
html,
flags=re.MULTILINE
)
html = re.sub(
r'```(?!mermaid)(.*?)\n(.*?)\n```',
r'text
\2
',
html,
flags=re.DOTALL
)
return html
```
The resulting content and title are inserted directly into the final document:
```python
html = f"""
{title}
{styles}
{content}
"""
```
The Markdown input reaches these sinks without sanitization:
```python
with open(md_path, 'r', encoding='utf-8') as f:
md_content = f.read()
html_content = md_content
html_content = re.sub(
diagram_pattern,
replace_with_svg,
html_content,
flags=re.DOTALL
)
html_content = convert_markdown_to_html_basic(html_content)
title = md_path.stem
html_content = generate_html_template(title, html_content)
```
### Technical Analysis
The custom Markdown converter begins with the complete input string and performs only regular-expression substitutions. It does not HTML-escape ordinary text,
...[truncated 2401 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/md_to_html.py:71
Finding
Predictable Shared Temporary Files Permit Symlink and Race Attacks
Content
View full analysis
Diagram rendering failed'
with open(temp_svg, 'r', encoding='utf-8') as f:
svg_content = f.read()
return f'
{svg_content}
'
finally:
if temp_mmd.exists():
temp_mmd.unlink()
if temp_svg.exists():
temp_svg.unlink()
```
### Technical Analysis
Temporary Mermaid input and SVG output files use predictable names based only on a small sequential diagram index:
```text
/tmp/mermaid_temp_1.mmd
/tmp/mermaid_temp_1.svg
```
The shared `/tmp` directory is normally writable by other local users. The files are opened without exclusive creation, a private directory, randomized names, or checks preventing symbolic-link traversal. An attacker can therefore pre-create one of these paths as a symbolic link or replace it during execution.
Opening `temp_mmd` with mode `w` follows symbolic links and truncates the linked target. The external `mmdc` process similarly receives a predictable output path. Concurrent report conversions also use the same names, allowing separate legitimate processes to overwrite, read, or delete one another's temporary files.
The `exists()` and `unlink()` cleanup sequence is additionally subject to time-of-check/time-of-use races because the path may chang
...[truncated 1738 chars]
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)
Tp4
High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
声明描述的是一个面向‘质量月报生成/测试成果汇总/多月数据分析’的业务型技能，预期应包含对质量月度数据的整理、分析、汇总或报告生成逻辑。实际代码并未处理任何质量数据、统计分析、月报结构生成或对比分析，而是实现了通用的 Markdown 转 HTML 渲染流程，并额外支持 Mermaid 图表转 SVG。其主要目的与声明明显不同，属于实质性能力不匹配。虽然生成月报时可能会用到 HTML 转换作为辅助步骤，但当前代码块本身仅体现文档格式转换，而非质量月报生成能力。
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill describes capabilities that imply file read/write and shell execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: an agent may invoke broader local capabilities than users or platform policy expect, increasing the chance of unintended file access or command execution.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill states that dependencies will be installed automatically on first use, which changes the system state without a clear, explicit user consent step. Automatic package installation can introduce supply-chain risk, unexpected network activity, and privilege misuse if installation commands run in a sensitive environment.
Content
No source excerpt is available for this finding.
Ssd 3
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
Instructions to accumulate and export prior conversation data create a clear risk of data leakage, especially if multiple months of internal quality data are combined and later exported without strict scoping. In this skill context, the feature is useful, but it increases the blast radius of any mistaken export, prompt confusion, or cross-request data reuse.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The skill maintains a conversation-level historical data pool and supports exporting it, but does not warn about retention, scope, or privacy handling. Because the data consists of uploaded quality reports and business metrics, silent persistence can lead to unintended reuse or disclosure of sensitive internal information across tasks.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
This markdown template is entirely written in Chinese, including all section headers and labels, which imposes a specific language/locale on generated reports. The file does not mention any user-selectable language option or justify the locale as a region-specific requirement, which fits the language-policy violation criterion.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
This markdown file presents all instructions and workflow guidance exclusively in Chinese, which can impose a specific language on users or operators without explicit opt-in. The policy allows fixed language only when a user choice is offered or the locale restriction is clearly documented and justified, neither of which appears here.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
技能清单声明用途是“基于质量月度数据生成专业的质量月报、汇总月度测试成果、进行多月数据对比分析”，而该文件实际是一个独立的 Markdown 转 HTML 工具，负责解析 Markdown、渲染 Mermaid 图表并生成 HTML 文件。该通用文档转换与外部渲染能力并不是质量月报生成目的下显然必需的核心能力，尤其是通过 subprocess 调用 mmdc 属于额外能力扩展。
Content
No source excerpt is available for this finding.
subprocess module call
Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content
Scanner excerpt · scripts/md_to_html.py (reported line 20)May include surrounding context.
The code passes user-derived Mermaid content to an external renderer (mmdc), which expands the attack surface beyond the Python process. Although there is no direct shell injection because arguments are passed as a list, untrusted diagram content can trigger vulnerabilities in the Mermaid/Chromium-based rendering toolchain, and the script writes predictable temp files in /tmp, creating additional symlink/race risks in multi-user environments.
Content
Scanner excerpt · scripts/md_to_html.py (reported line 85)May include surrounding context.
This code file contains natural-language strings that effectively force a specific language/locale for usage, including the module docstring and later CLI/help output. Under the policy, locale-specific behavior should either be optional for users or clearly justified as region-specific; neither is present here.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
This code writes parsed Excel data, including sheet contents and structured summaries, into JSON files. Although there is a success print after writing, there is no prior warning in the code comments, docstrings, or CLI help that user-provided spreadsheet data will be saved to disk, which can affect data privacy if the Excel files contain sensitive business information.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
80% confidence
Finding
This markdown file repeatedly specifies fixed Chinese enum values such as 已完成/进行中/待处理, which imposes a specific language requirement in the data format. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
91% confidence
Finding
These lines mandate exact Chinese values for work_summary[].status, temporary_works[].status, pdca_items[].status, and risks[].level. Because the file does not state that the skill is region-specific or provide a user language choice, this reads as a forced locale constraint.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
95% confidence
Finding
This code sets the output document language to "zh-CN" unconditionally via the HTML lang attribute. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly justified or configurable.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
80% confidence
Finding
User-facing strings such as the module description, CLI argument help, and status messages are presented exclusively in Chinese. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint can be a natural-language policy violation.
