Security audit

通用报告生成器 consulting-report-generator

Security checks for vulnerabilities and agentic risk

Overview

Review recommended: the skill can generate reports, but it also requires automatic external delivery and persistent self-modification/logging beyond ordinary report generation.

Install only in an environment where automatic third-party delivery, persistent logs, and skill self-modification are acceptable. Do not use it on confidential source documents unless external delivery, self-repair write-back, and telemetry-style logs are disabled or reviewed. Avoid running the documented curl-to-sh installer; use verified, pinned dependencies instead.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:2248
Finding: Unverified Remote Installer Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/self_repair.py:141
Finding: Runtime-Controlled Error Data Can Poison Persistent Skill Instructions
Content: View full analysis
= 8 else "" new_entry = f""" ### 错误{error_number}：{error_text} {tag} **原因**：{cause_text} **修复**：{fix_text} """ marker = "---\n\n## 十三、技能自进化系统" if marker in content: content = content.replace(marker, f"{new_entry}\n{marker}") else: content += f"\n{new_entry}\n" save_skill_md(content) ``` The write operation is automatically reached for selected errors: ```python for issue in issues["errors"]: level = classify_issue(issue) issue["level"] = level if level in ("P0", "P1") and not is_error_already_documented( issue.get("description", "") ): append_error_to_skill_md( error_text=issue.get("description", ""), cause_text=issue.get("root_cause", "待分析"), fix_text=issue.get("fix", "待确定") ) ``` ### Technical Analysis Runtime error descriptions, root-cause text, repair text, function specifications, and checklist entries can be written into `SKILL.md`. The Skill’s own rules require this process after execution. There is no allowlist for permitted updates, no trusted/untrusted data separation, no Markdown escaping, no cryptographic provenance check, and no mandatory human approval. Because `SKILL.md` is later lo ...[truncated 982 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:1585
Finding: Mandatory External Delivery Hijacks Report Output and Risks Data Disclosure
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/self_evolution.py:115
Finding: Automatic Cross-Skill Inventory Exceeds Report-Generation Privileges
Content: View full analysis
| ') break ``` ### Technical Analysis The component enumerates every installed Skill directory and reads metadata from neighboring `SKILL.md` files. The main Skill instructions require a discovery scan whenever the Skill is loaded. Generating and formatting a report does not require a global inventory of unrelated installed Skills. This behavior crosses the Skill’s own directory boundary, persists discovered metadata, and creates a foundation for automatic integration of code or instructions that were not declared dependencies. ### Attack Path 1. A user invokes the report-generation Skill. 2. The required discovery workflow enumerates `~/.workbuddy/skills`. 3. The script opens neighboring `SKILL.md` files. 4. Names, descriptions, and relevance sc ...[truncated 422 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:1735
Finding: Runtime Installation Uses Unpinned Third-Party Dependencies and Model Artifacts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/generate_offline_content.py:9
Finding: Environment-Controlled Ollama Host Can Exfiltrate Prompt Content
Content: View full analysis
0 except: return False ``` ```python def call_ollama(prompt, model=DEFAULT_MODEL, max_tokens=500): """调用本地Ollama模型生成内容""" import urllib.request payload = json.dumps({ "model": model, "prompt": prompt, "stream": False, "options": {"num_predict": max_tokens} }).encode() req = urllib.request.Request( f"{OLLAMA_HOST}/api/generate", data=payload, headers={"Content-Type": "application/json"} ) try: with urllib.request.urlopen(req, timeout=120) as resp: data = json.loads(resp.read()) return data.get("response", "") except Exception as e: return f"[离线模式] 无法调用本地模型: {e}" ``` ### Technical Analysis Although the feature is described as local or offline, the destination comes directly from the `OLLAMA_HOST` environment variable. The code does not require a loopback address, constrain the URL scheme, require TLS, authenticate the server, or obtain consent for a remote endpoint. Any report content incorporated into `prompt` can therefore be posted to an attacker-selected host if the environment is influenced by a launcher, wrapper, deployment configuration, or compromised process environment. ### Attack Path 1. An attacker or compromised launcher sets `OLLAMA_HOS ...[truncated 658 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/extract_content.py:137
Finding: Sensitive Extracted Document Content Is Persisted in Predictable Plaintext Files
Content: View full analysis
.md`. 3. A consolidated copy is written to `extracted_summary.md`. 4. Derived business metrics are written to `extracted_data.json`. 5. The files remain after report generation. 6. Another local process, user, backup agent, or synchronization service accesses the retained copies. ...[truncated 293 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (59)

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: The code builds HTTP requests from the OLLAMA_HOST environment variable and sends them without validating scheme, host, or network scope. In an agent/skill environment, environment variables are often externally controlled by deployment config, so this can enable SSRF-like behavior or unexpected outbound connections to attacker-chosen endpoints, especially because the code also transmits prompts and reads responses.
Content: Scanner excerpt · references/generate_offline_content.py (reported line 62)May include surrounding context.
python
try: import urllib.request req = urllib.request.Request(f"{OLLAMA_HOST}/api/tags") with urllib.request.urlopen(req, timeout=5) as resp: data = json.loads(resp.read()) return len(data.get("models", [])) > 0 except:

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: This request sends model prompts to a URL derived from OLLAMA_HOST with no trust boundary enforcement. If an attacker can influence the environment, they can redirect prompt content and generated output handling to an arbitrary server, causing data exfiltration, SSRF, or interaction with unintended internal services under the guise of a local-model call.
Content: Scanner excerpt · references/generate_offline_content.py (reported line 86)May include surrounding context.
python
) try: with urllib.request.urlopen(req, timeout=120) as resp: data = json.loads(resp.read()) return data.get("response", "") except Exception as e:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个端到端的专业报告生成技能，覆盖输入解析、内容扩增、模板选择以及多格式文档输出。实际提供的代码块却只是一个辅助性的研究子模块，功能集中在：1）根据提取文本识别需要外部研究的指标和趋势主题；2）为每个主题构建三轮搜索查询计划；3）将研究证据与用户数据做简单融合；4）对数据点与行业基准做偏差检查。虽然这可能是报告生成流程中的一个支持组件，但就该代码块本身而言，其主功能与声明的主功能不一致，且缺失声明中大部分关键能力。因此应判定为描述与代码行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个功能非常完整的“专业报告生成”技能，核心能力应是基于多种输入自动生成结构化报告，并支持多种输出格式和设计流程。实际代码却只完成前置的“资料提取”步骤：读取文件、抽取文本/图片、识别若干数据点并保存为 md/json。虽然这可被视为报告生成流水线中的辅助环节，但它与声明中的主要用途相比差距很大，属于主要目的和能力均不匹配。代码也没有任何触发逻辑、模板设计、文档生成、搜索、推荐或自优化实现，因此应判定为描述与行为明显不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad end-to-end report generation skill centered on multi-input analysis and multi-format output, with substantial auxiliary capabilities like OCR, search, template recommendation, mind-map generation, and PPT production. The supplied code chunk only implements a narrow subset: generation of a styled DOCX document from already-structured title/sections data. This is not just a partial implementation detail; the primary behavior of the code is materially narrower and different from the declared skill scope. While DOCX support is one stated feature, the code does not substantiate most of the declared functionality and especially does not reflect the claimed default PPT/report-generation pipeline.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a comprehensive report-production system with multimodal ingestion and multi-format document output. The supplied code, however, only implements an offline/local text-section generator with connectivity checks and optional local Ollama invocation. Its primary behavior is fallback content generation for predefined topics, not end-to-end report creation. This is a material description/behavior mismatch, not merely an implementation subset, because the core promised capabilities (document generation, parsing, design/layout, OCR, and output conversion) are absent from the code shown.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该描述明显夸大了能力范围。实际代码的核心用途是“生成咨询风格PPT页面布局并输出一个示例PPT文件”，属于演示型/模板型PPT生成器，而不是一个可处理多模态输入、自动识别内容、检索素材并支持多格式输出的通用报告技能。代码中确实与描述部分一致的点包括：使用 mck-ppt-design 风格思路、python-pptx 原生绘制、微软雅黑字体、避免 BLOCK_ARC、提供多种咨询风格页面布局和主题切换。但这些只覆盖了描述中的一小部分。更关键的是，描述声称的大部分高级能力在代码中完全不存在，因此构成实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个复杂的报告生成技能，核心能力应为理解输入内容并产出专业报告；而实际代码只是一个独立的PPTX文件修复工具。它处理的对象是已存在的PPTX压缩包内部XML，进行兼容性清理与字体属性修补，再重新打包。虽然这可能作为PPT生成流程中的辅助步骤，但当前代码片段本身并未体现声明中的主要能力，且其主目的与描述明显不一致。因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码与声明存在明显的描述-行为不一致。声明的主要功能是专业报告生成与多格式文档输出，而实际代码的主要用途是一个独立的“自进化/遥测”脚本：访问本地技能目录，发现新技能，记录使用与错误数据，并生成统计摘要。虽然声明中提到“内置自进化系统：每日自动发现新技能、追踪使用模式、记录错误与改进、持续优化模板”，这与代码部分内容相符，但这只是声明中的辅助子功能，不是声明的核心用途。相反，代码片段没有实现任何报告内容处理、版式生成、PPT/DOCX/PDF导出、脑图生成、OCR、素材智能搜集、行业基准搜索等核心能力。此外，代码还包含对本地 ~/.workbuddy/skills/ 的扫描与本地持久化日志/统计文件写入，这类资源访问并未在权限中声明。综合来看，这是一个材料性不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are extremely broad and include common report-related language, and the metadata says any uploaded content auto-triggers the skill. Overbroad activation is dangerous here because the skill also prescribes network access, file writes, logging, skill scanning, and outbound delivery, so unintended invocation can lead to unintended side effects on sensitive user content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs autonomous self-modification of SKILL.md and reference files based on runtime issues and user feedback. Self-modifying behavior is dangerous because untrusted content or misclassified feedback can be persisted into future executions, creating a durable prompt-injection, policy drift, or data leakage path.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes automatic outbound file delivery to WeChat, QQ mail, and Tencent Docs, plus optional automation setup, which can exfiltrate generated reports and embedded source material. Because this skill handles arbitrary uploaded content and may enrich it with logs and metadata, automatic external delivery materially increases confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Automatic external file delivery is described without a strong privacy and consent warning. Because the skill processes arbitrary user uploads and may attach derived reports or mind maps, silent or default delivery to third-party channels can disclose confidential business information.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skill includes a command that downloads and executes a remote installation script via curl. This is a classic supply-chain and remote-code-execution risk because any compromise of the remote host, network path, or script content results in arbitrary code execution on the host running the skill.
Content: Scanner excerpt · SKILL.md (reported line 2251)May include surrounding context.
bash
# 1. 安装Ollama curl -fsSL https://ollama.com/install.sh | sh # 2. 下载模型（需要一次联网） ollama pull gemma4:e2b-it-q4_K_M

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The explicit use of a shell pipe into sh executes unreviewed remote content immediately, eliminating any opportunity for inspection or validation. In a skill context, embedding this pattern normalizes dangerous operator behavior and can lead to full system compromise if followed.
Content: Scanner excerpt · SKILL.md (reported line 2251)May include surrounding context.
bash
# 1. 安装Ollama curl -fsSL https://ollama.com/install.sh | sh # 2. 下载模型（需要一次联网） ollama pull gemma4:e2b-it-q4_K_M

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatic self-repair that writes into SKILL.md and appends checklist items means the skill can modify its own specification or adjacent files without a clear authorization boundary. That creates integrity risk, persistence opportunities, and a path for silent policy drift or malicious prompt persistence if the write target is later consumed by agents or users.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow describes delivering generated files to a WeChat mini-program, which is an off-host transmission of potentially sensitive outputs, yet no explicit consent or disclosure is mandated. This creates clear data exfiltration and confidentiality risk, especially for internal reports, customer data, or proprietary documents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The main self_repair flow automatically classifies issues, marks them fixed, rewrites SKILL.md, updates logs, writes summaries, and may bump version numbers, all without approval gates. This is dangerous because runtime-triggered self-modification can permanently alter the skill's future behavior based on error text or feedback, making the skill mutable, hard to audit, and susceptible to prompt- or input-driven persistence.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill describes capabilities that require broad access to files, shell, environment, and network, yet it does not declare any explicit tool or permission scope. That creates an overbroad execution surface where a report-generation skill could perform sensitive side effects without clear user consent or platform enforcement boundaries.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises daily discovery, usage tracking, error recording, and continuous optimization, implying persistent retention and reuse of interaction-derived data. For a report generator handling business documents, retaining usage patterns and content-derived metadata increases the risk of sensitive information being stored beyond the immediate task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Ambiguous activation criteria increase the chance that the skill enters powerful modes without clear user intent. In this context, ambiguity is more dangerous because different modes unlock additional analysis, external calls, and persistence behaviors over uploaded content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill mandates broad file generation and persistent log writes but does not present a prominent up-front warning about filesystem effects. Users may provide sensitive materials expecting ephemeral processing, while the skill retains artifacts such as logs, summaries, and generated files.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatic write-back of execution-derived information into SKILL.md and reference files can permanently embed user-originated details or attacker-supplied text into reusable artifacts. This creates both a confidentiality risk and a persistence mechanism for prompt injection into future runs.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The self-evolution workflow explicitly collects user feedback and execution details, which may contain confidential report content, file names, business metrics, or internal issues. Persisting that information across runs creates a natural-language memory store that can leak or be reused inappropriately later.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill scans local skill directories and auto-integrates newly discovered skills, which expands its effective trust boundary without review. In an adversarial environment, this can pull in malicious or unsafe skills and chain their capabilities into the current workflow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.