T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_docx.py:313- Finding
Path Traversal Through User-Controlled Output Filenames
- Content
View full analysis
- Remediation
View remediation
Security audit
commercial-market-report
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Chinese commercial market-report generator, but it has review-worthy risks around broad credential/session use, external data sharing, and unsafe output file generation.
Install only if you are comfortable with the skill using external search services and local API keys for Chinese commercial real-estate research. Avoid using confidential project addresses or non-public deal data unless you approve the external lookups, do not expose a normal logged-in Chrome profile through remote debugging, and generate reports only into a dedicated output folder with trusted project names until path and HTML escaping are fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_html.py:58- Finding
HTML and Script Injection Through the Project Name
- Content
View full analysis
{project_name} — 市场调研汇报 ``` ```python{project_name}
``` ```python谢谢观看
{project_name} · 市场调研汇报
``` ### Technical Analysis The generator uses Python formatted strings to insert `project_name` directly into HTML element content. It does not perform HTML escaping or use a template engine with automatic contextual encoding. An attacker can terminate the surrounding element and inject arbitrary markup. For example, a project name containing closing tags and a `- Remediation
View remediation
``` 6. Avoid permitting inline scripts where possible. If inline code is required, use a nonce generated for each report rather than enabling unrestricted inline execution. 7. Add tests using values containing `<`, `>`, `&`, quotes, closing tags, and script elements to confirm that they are rendered as text. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_docx.py:10- Finding
Predictable Chart Files in a Shared Temporary Directory
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/generate_html.py:59- Finding
Generated HTML Executes Unverified Third-Party CDN JavaScript
- Content
View full analysis
@import url('https://fonts.googleapis.com/css2?family=Inter:wght@300;400;600;700&display=swap'); ``` ### Technical Analysis Every generated HTML report loads Chart.js as executable JavaScript from jsDelivr at viewing time. Although a version is specified, the resource is not protected with Subresource Integrity. Consequently, the browser trusts and executes whatever content is returned for that URL. The report also contacts Google Fonts whenever it is opened. These requests disclose network metadata such as the viewer's IP address, request time, browser headers, and potentially referrer information to third-party services. This behavior is not required for the core report-generation function. Chart.js and fonts can be bundled with the report or replaced with local assets. The remote dependency also makes an ostensibly generated artifact non-self-contained and allows its runtime behavior to depend on infrastructure outside the audited project. ### Attack Path 1. The Skill generates and distributes an HTML report. 2. A recipient opens the report while connected to a network. 3. The browser requests JavaScript from jsDelivr and font resources from Google. 4. The remote JavaScript executes with the privileges available to scripts in the report. 5. If the CDN resource, publishing account, network path, or dependency distribution is compromised, modified JavaScript can manipulate the report or initiate further network activity. No compromise of these services was observed during this static audit; this finding concerns the absence of controls that would prevent such a compromise from affecting report viewers. ### Impact Assessme ...[truncated 631 chars]- Remediation
View remediation
``` 4. Verify the exact integrity hash against a trusted release artifact and update it only through a reviewed dependency-upgrade process. 5. Add a Content Security Policy that restricts script, style, font, and connection origins to an explicit allowlist. 6. Add `referrerpolicy="no-referrer"` where applicable to reduce metadata disclosure. 7. Document all external requests made when a report is opened and provide an offline mode by default. 8. Consider rendering charts to static SVG or PNG during generation, eliminating runtime JavaScript entirely. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
代码的核心功能与声明场景总体相关，确实是在生成商业综合体市场调研报告内容，并包含竞品分析、业态组合和财务测算等模块。但声明强调的是“一次性生成三份成果”的完整工作流，而该代码块只实现了DOCX报告生成，且没有任何HTML或PPTX输出、相关依赖、模板或保存逻辑。因此描述对能力范围有明显夸大，属于描述与实际行为不一致。未发现额外越权或无关资源访问，主要问题是少实现了声明中的两类关键输出能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个完整的“市场调研报告工作流”，核心承诺是一次性输出 Word、HTML、PPTX 三种成果。而实际代码块的唯一功能是拼接 HTML 字符串、写入本地 .html 文件，并使用前端 Chart.js 渲染图表。它没有调用任何 Word 文档生成库、PPT/PPTX 生成库，也没有体现多产物工作流编排逻辑。因此，代码行为只覆盖了声明中的一部分（HTML 演示稿），不足以支撑整体描述，属于明显的描述与实际行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description says the skill is a full market research report workflow that, when triggered, produces three outputs in one run: Word + HTML + PPTX. However, the provided code chunk is limited to a single script named generate_pptx.py whose sole purpose is creating a PowerPoint presentation. It does not contain any logic for generating a Word document or HTML deck, nor does it orchestrate a multi-artifact workflow. The commercial market research domain is consistent, and the slide content does cover topics like competitor analysis, positioning, and financial estimates, so the general subject matter matches. But the primary declared capability—simultaneous generation of three deliverables—is not represented by this code chunk. Therefore this is a material description/behavior mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill instructs reading a secret API key directly from a local .env path, which normalizes raw credential access within the skill. This increases exposure risk because a compromised or overly permissive skill could read, misuse, or leak secrets beyond the intended API call.
- Content
补充搜索（公众号）： 每次 Tavily 搜索后，同步用搜狗微信搜索
{城市} {区县}相关市场/地产文章，提取专业公众号内容作为参考。.env key：
TAVILY_API_KEY（从~/.openclaw/.env读取，不要写在 skill 文件里）调用：
bash
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- ## .env API Key 配置（不要写在文件里） 从 `~/.openclaw/.env` 读取，不要把明文 key 写在 skill 文件中：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill references capabilities that imply reading environment secrets and writing output files, but it does not declare an explicit tool scope such as allowed-tools or permissions. That weakens least-privilege controls and can let the skill operate with broader access than users or the host expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Overly broad trigger phrases like '生成报告' can cause unintended activation on ordinary user requests. In a skill that performs external searches and file generation, accidental invocation can lead to unnecessary third-party data transmission or unexpected artifact creation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs use of multiple third-party services for search and trend analysis but does not clearly warn users that project/location data may be transmitted externally. This creates a privacy and consent issue, especially when project descriptions may contain non-public site details.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The hardcoded third-party endpoint confirms external network transmission as part of normal operation. In this context the danger depends on whether project details are confidential, but the absence of strong disclosure and minimization makes the transmission security-relevant.
- Content
调用：
bash curl -X POST https://api.tavily.com/search \ -H "Authorization: Bearer <TAVILY_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"query":"{城市} {区县} 商业市场 最新","max_results":5}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The hardcoded third-party endpoint confirms external network transmission as part of normal operation. In this context the danger depends on whether project details are confidential, but the absence of strong disclosure and minimization makes the transmission security-relevant.
- Content
调用：
bash curl -X POST https://api.tavily.com/search \ -H "Authorization: Bearer <TAVILY_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"query":"{城市} {区县} 商业市场 最新","max_results":5}'
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains natural-language guidance exclusively in Chinese and does not indicate that the user can choose another language or that the skill is limited to a Chinese-language or China-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing instructions in Chinese from the title onward, but does not indicate that the skill is China-specific only or provide an opt-in language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated report HTML imports executable JavaScript and fonts from third-party CDNs at render time. That creates a supply-chain and privacy risk: viewing the exported report triggers outbound network requests, leaks viewer metadata, and trusts remote content that could change or be compromised after generation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and generated content are written exclusively in Chinese, and the script produces a Chinese-language PPTX by default. There is no user opt-in, language-selection parameter, or documented justification that this skill is intended only for a Chinese locale, which conflicts with the policy against forcing a specific language without user choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a workflow for producing a market research report for a commercial complex project, implying analysis tailored to the user's project and scenario. In this file, the PPTX is assembled largely from fixed region names, competitor names, SWOT text, customer profiles, financial figures, and conclusions, with only a few numeric fields derived from inputs, so the actual behavior is closer to filling a static template than generating a genuine market research report.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description, triggers, and workflow are entirely written for Chinese-language usage and only define Chinese trigger phrases, with no indication that users may choose another language. This creates a locale constraint without opt-in or an explicit statement that the skill is intentionally limited to a China-specific or Chinese-only audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This markdown file is written entirely in Chinese and specifies a Chinese font (微软雅黑), which can be interpreted as forcing a particular language/locale presentation standard. The policy allows such constraints only when user choice or a clear regional justification is provided, neither of which appears here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The markdown specifies a Chinese Word report format throughout, including Chinese typography and Chinese example headings, but does not indicate that this skill/reference is limited to Chinese-language reports or provide any user opt-in for language/locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated HTML explicitly sets
lang="zh-CN", and the script’s user-facing content is written entirely in Chinese. This enforces a specific language/locale choice without offering the user any opt-in or alternative, which matches the language/locale policy violation criteria.- Content
Static analysis
No suspicious patterns detected.