SIPOC技能工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:13 AM UTC
• Version: 0.1.0

Overview

This SIPOC diagram skill is mostly purpose-aligned, but its generator can create unsafe HTML from untrusted diagram data or custom CSS.

Review this skill before installing. It is suitable only when you control or trust the SIPOC JSON and any custom CSS. Do not generate or open HTML from third-party data with this version, avoid custom CSS from untrusted sources, and prefer a fixed output directory until the generator escapes HTML and limits stylesheet handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_sipoc.py:193

Finding

Stored HTML and Script Injection in Generated SIPOC Documents

Content

View full analysis

{name}

{"

" + desc + "

" if desc else ""} ''' return html ``` Additional affected output contexts include: ```python html = f''' SIPOC - {process_name} {css}

{process_name}

{"

流程编号: " + process_id + "

" if process_id else ""}

``` The same unsafe interpolation pattern is used for process step names, process step descriptions, supplier data, input data, output data, customer data, and the process identifier. ### Technical Analysis Values originating in caller-provided JSON are concatenated directly into an HTML document without contextual output encoding. The code does not use `html.escape`, a sanitizer, or a templating en ...[truncated 2324 chars]

Remediation

View remediation

``` 6. Add regression tests covering script tags, event-handler attributes, closing `title` tags, quotes, ampersands, SVG payloads, and malformed input. 7. Document that existing HTML files generated from untrusted input should not be opened until they have been regenerated with the corrected implementation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_sipoc.py:259

Finding

Arbitrary CSS Content Can Escape the Style Element and Inject Active HTML

Content

View full analysis

SIPOC - {process_name} {css} ``` ### Technical Analysis The `--css` argument accepts an arbitrary filesystem path. The selected file is read as text and inserted verbatim into a `style` element. CSS content is not confined to the style context if it includes a closing `` tag. An attacker-controlled file can terminate the existing element, insert active HTML or JavaScript, and optionally reopen the style element to preserve the remainder of the generated document. For example, a malicious stylesheet could contain: ```html ``` This is an HTML parser context-breakout vulnerability. A CSS parser alone is not involved once the injected closing tag causes the HTML parser to terminate the style element. ### Attack Path 1. An attacker creates or supplies a file presented as a custom stylesheet. 2. The file contains a `` sequence followed by attacker-controlled HTML or script. 3. The user or Agent invokes the generator with `--css` pointing to that file. 4. The script reads the complete file without validating or sanitizing it. 5. The content is embedded verbatim in the gener ...[truncated 797 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:24

Finding

Unpinned Runtime Installation of Third-Party Package and Browser Binaries

Content

View full analysis

Remediation

View remediation

``` 3. Use a lockfile or requirements file containing cryptographic hashes, and install with hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 4. Pin and verify the expected browser revision instead of relying on mutable latest artifacts. 5. Use a trusted package index and disable unintended fallback indexes to reduce dependency-confusion exposure. 6. Perform installation in an isolated virtual environment or container with minimal privileges. 7. Document the required network endpoints, downloaded artifacts, expected versions, and integrity-verification process. 8. Add Jinja2 explicitly as a pinned dependency if it remains required by `generate_sipoc.py`, or remove its unused import. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to read and write local files by generating HTML/PNG/PDF outputs, but the manifest does not explicitly declare any tool scope or permissions. This creates an authorization ambiguity where the agent may perform filesystem actions without clear user-facing consent or platform-enforced limits, increasing the risk of unintended file creation or overwrite.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions include broad phrases like '创建流程图' and '梳理输入输出', which can match many unrelated user requests and cause the skill to activate outside its intended SIPOC-only scope. Over-broad invocation raises the chance of inappropriate tool use, unexpected file generation, and context confusion, especially because the skill can produce local artifacts through scripts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The template hard-codes lang="zh-CN", which is a natural-language locale choice embedded in the output. Under the policy, forcing a specific language/locale without opt-in can be a violation unless the constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes generating HTML and exporting PNG/PDF files locally, but it does not clearly warn users that local files will be created. This weakens informed consent and can surprise users with persistent artifacts, path conflicts, or accidental disclosure if outputs are written into shared directories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This CSS file includes Chinese-language comments and sets a font stack prioritizing Chinese-specific fonts such as 'Microsoft YaHei' and 'PingFang SC'. Under the policy criteria, forcing or implicitly privileging a specific language/locale without opt-in or a documented regional purpose can be a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.