Security audit

Data Prompt Coach 数据分析Prompt引导教练

Security checks for vulnerabilities and agentic risk

Overview

This skill is a mostly disclosed data-analysis prompt/template coach, but some automation, dynamic API, and cloud-upload templates are too powerful or inconsistent with its safety claims.

Install only after reviewing the web-scraping, Feishu, and .bat templates. Do not paste real cookies, API keys, or Feishu tokens into chat; require generated cloud-upload code to use sensitive_fields and a preview/redaction step; remove /rl HIGHEST from scheduled-task examples unless an administrator has a specific reason; and avoid using this skill for production databases, paywalls, login/session bypass, or anti-bot bypass.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

Location: references/asset-templates/bat-template-spec.md:226
Finding: Persistent Scheduled Tasks Run with Unnecessary Elevated Privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/asset-templates/feishu-base-storage-template.md:122
Finding: Feishu Cloud-Storage Template Uploads Records Without Mandatory Sensitive-Field Redaction
Content: View full analysis
Remediation: View remediation
" return redacted ``` 3. Fail closed when no sensitive-field policy is provided instead of assuming records are safe. 4. Add automatic detection for high-risk field names such as identity numbers, bank accounts, tax identifiers, telephone numbers, email addresses, addresses, and authentication tokens. 5. Prefer an explicit cloud-field allowlist so only approved fields enter the request payload. 6. Show the user a field-level upload preview and require confirmation before the first cloud write. 7. Add tests that intercept the generated HTTP request and verify that raw sensitive values never appear in the payload. 8. Update `references/examples/monday-demo.md` to use the same redaction API as the primary template. 9. Replace all source-level credential placeholders with environment-variable loading: ```python API_TOKEN = os.getenv("MONDAY_API_TOKEN") if not API_TOKEN: raise RuntimeError("MONDAY_API_TOKEN is not configured") ``` 10. Ensure `.env` is excluded from source control and avoid copying credential files into broadly accessible backup locations. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (234)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的核心能力是数据分析提示词教练、教程蒸馏、自进化与分析流程引导；而代码并未实现任何提示引导、教程蒸馏、自修改预审、回滚、CRISP-DM 流程控制或 CSV 端到端分析。它只是生成一个 Excel 骨架模板，属于交付物模板制作工具。虽然这可能是某个更大数据分析技能的配套资源，但就该代码块本身而言，其主要目的与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: 动态 API Key 模拟 is a high-risk capability because it suggests reproducing or emulating access patterns used by protected dynamic-key services such as Algolia. In a prompt skill that is not explicitly a security testing or authorized scraping tool, this can facilitate bypass-like behavior against third-party service controls and enable unauthorized data access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This test normalizes guidance for simulating short-lived dynamic API keys for a third-party interface, which is closely aligned with bypassing anti-automation or access controls. In the context of a data-prompt coaching skill, that behavior is not necessary for the stated purpose and increases the chance the model will help users evade protections on external services.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/asset-templates/bat-template-spec.md (reported line 13)May include surrounding context.
md
1. **文件覆盖风险**：.bat 执行会写入日志/输出文件，可能覆盖同名文件 2. **凭证消耗**：如涉及邮件/IM API/数据库连接，会消耗对应的 token/凭证 3. **系统资源占用**：定时任务会占用 CPU/内存/磁盘 IO，可能影响其他进程 4. **定时执行风险**：通过 `schtasks` 注册的定时任务会持续运行，用户须知道如何停止（`schtasks /delete /tn "任务名" /f`） 5. **网络外发**：如涉及结果推送，会自动外发数据，用户须确认目标地址合规 6. **执行权限**：`/rl HIGHEST` 会以高权限运行，用户须评估是否需要降权

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The spec explicitly includes database backup/write-related guidance and operational automation patterns, which conflicts with the skill manifest stating it should not be used for direct production database connectivity. Even though framed as backup/safety guidance, it normalizes generating automation that can touch production data and may lead users to create batch jobs that read from or write to live systems.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/asset-templates/bat-template-spec.md (reported line 33)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/asset-templates/bat-template-spec.md (reported line 61)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/asset-templates/feishu-base-storage-template.md (reported line 81)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/audit/security-compliance.md (reported line 93)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/audit/security-compliance.md (reported line 94)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/audit/security-compliance.md (reported line 127)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/audit/security-compliance.md (reported line 132)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/audit/security-compliance.md (reported line 136)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/audit/security-compliance.md (reported line 137)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/methods/M23-dynamic-api-key-simulation.md (reported line 59)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/methods/M26-feishu-base-dual-storage.md (reported line 310)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/methods/M26-feishu-base-dual-storage.md (reported line 325)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/methods/M26-feishu-base-dual-storage.md (reported line 326)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/methods/M26-feishu-base-dual-storage.md (reported line 328)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/methods/M26-feishu-base-dual-storage.md (reported line 329)May include surrounding context.
md
| 2 | 数据库 | DB snapshot / `mysqldump --single-transaction` / `pg_dump` | 涉及数据库写入 | | 3 | 飞书多维表格 | 飞书表 → 导出 CSV 到本地 | 涉及飞书双存储（M26） | | 4 | 增量缓存 | `copy ai_cache.json ai_cache_backup_%date:/=%.json` | 涉及 M14 增量同步 | | 5 | 配置文件 | `copy .env .env.backup` | 含 Token 的 .env 文件 | | 6 | 已有日志 | `xcopy /E /I logs backup_%date:/=%\logs` | 防止日志覆盖 | ### 内置 BACKUP_DIR 变量（v3.4.1 模板强制）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/asset-templates/bat-template-spec.md (reported line 59)May include surrounding context.
md
) REM 备份 .env（如存在） if exist "%WORK_DIR%.env" ( copy /Y "%WORK_DIR%.env" "%BACKUP_DIR%\.env.backup" >> "%LOG_FILE%" 2>&1 echo [OK] 已备份 .env 文件 >> "%LOG_FILE%" )

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/asset-templates/bat-template-spec.md (reported line 60)May include surrounding context.
md
) REM 备份 .env（如存在） if exist "%WORK_DIR%.env" ( copy /Y "%WORK_DIR%.env" "%BACKUP_DIR%\.env.backup" >> "%LOG_FILE%" 2>&1 echo [OK] 已备份 .env 文件 >> "%LOG_FILE%" )

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/asset-templates/bat-template-spec.md (reported line 76)May include surrounding context.
md
) REM 备份 .env（如存在） if exist "%WORK_DIR%.env" ( copy /Y "%WORK_DIR%.env" "%BACKUP_DIR%\.env.backup" >> "%LOG_FILE%" 2>&1 echo [OK] 已备份 .env 文件 >> "%LOG_FILE%" )

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inclusion of schtasks /create ... /rl HIGHEST provides direct guidance for creating high-privilege scheduled tasks, which is disproportionate to a prompt-coaching skill. High-privilege persistence mechanisms materially increase abuse potential because generated tasks can run unattended with elevated rights and may be hard for users to fully audit.
Content: No source excerpt is available for this finding.