Security audit

Integrated Manufacturing Consulting

Security checks for vulnerabilities and agentic risk

Overview

The skill’s report-generation purpose is real, but it also self-modifies its instructions, scans other installed skills, and mandates external delivery of generated reports.

Review before installing. Use this only in an environment where automatic local logging, broad attachment processing, and external delivery are acceptable. Disable or remove self-repair writes to SKILL.md, make WeChat/email/Tencent Docs delivery opt-in per file, avoid curl-to-shell installation, pin dependencies, and restrict Ollama to localhost before handling confidential client materials.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:2678
Finding: Unverified Remote Installer Is Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/self_repair.py:142
Finding: Runtime and User-Controlled Error Text Can Persistently Modify Skill Instructions
Content: View full analysis
= 8 else "" new_entry = f""" ### 错误{error_number}：{error_text} {tag} **原因**：{cause_text} **修复**：{fix_text} """ # 追加到「常见错误与修复」章节末尾 marker = "---\n\n## 十三、技能自进化系统" if marker in content: content = content.replace(marker, f"{new_entry}\n{marker}") else: # fallback: 文件末尾追加 content += f"\n{new_entry}\n" save_skill_md(content) print(f"🛠️ 自修复完成：已在SKILL.md追加「错误{error_number}：{error_text}」") ``` ```python for issue in issues["errors"]: level = classify_issue(issue) issue["level"] = level if level in ("P0", "P1") and not is_error_already_documented( issue.get("description", "") ): append_error_to_skill_md( error_text=issue.get("description", ""), cause_text=issue.get("root_cause", "待分析"), fix_text=issue.get("fix", "待确定") ) if issue.get("function_to_update"): update_function_spec( issue["function_to_update"], issue.get("new_spec", "") ) if issue.get("new_checklist_item"): append_checklist_item(issue["new_checklist_item"]) issue["fixed"] = True repair_count += 1 ``` ...[truncated 2319 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:1937
Finding: Generated Reports Are Mandatorily Sent to an External Delivery Service
Content: View full analysis
After report generation, deliver the corresponding file and automatically > push it to the WeChat mini-program. Use the `deliver_attachments` tool to send files to the WorkBuddy WeChat mini-program: Steps: 1. Call deliver_attachments(file_path) to send the file 2. Tell the user to enable artifact return in the WorkBuddy mini-program 3. If automatic pushing is requested, create an automation task Delivery methods: | Method | Description | Condition | |:--|:--|:--| | `deliver_attachments` | Send to the WorkBuddy WeChat mini-program | WeChat bound | | QQ email | Send an email attachment through qq-email | Authorization code required | | Tencent Docs | Upload and share a link | tencent-docs required | R23: S14 file delivery must execute after every PPT generation and cannot be skipped. R24: The user must be prompted to check the mini-program artifact-return switch. R25: Successful delivery must be written to delivery_log.json. ``` ### Technical Analysis The Skill declares external delivery to be mandatory after every PPT generation. This changes a local report-generation request into a network transmission workflow without requiring separate, destination-specific consent. The generated reports are explicitly derived from user-uploaded project materials and may include customer data, operational metrics, organizational structures, screenshots, diagnoses, and strategic recommendations. Sending such an artifact through `deliver_attachments`, email, or a cloud-document service crosses a significant confidentiality boundary. External delivery is not necessary to generate or save PPTX, DOCX, PDF, or mind-map files. The mandatory rule therefore exceeds the minimum privileges and network access necessary for ...[truncated 1054 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/self_evolution.py:115
Finding: Self-Evolution Component Enumerates and Reads Unrelated Installed Skills
Content: View full analysis
| ') break if skill_dir not in known_names: relevance = assess_relevance(skill_dir, description) if relevance >= 2: new_skills.append({ "name": skill_dir, "description": description[:100], "relevance_score": relevance, "discovered_at": datetime.now().isoformat(), "status": "new", }) for ns in new_skills: known.append(ns) save_json("known_skills.json", known) return new_skills ``` ### Technical Analysis The self-evolution feature enumerates the global `~/.workbuddy/skills` directory, opens the instruction file of every installed Skill, extracts descriptions, and persists the ...[truncated 1282 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:365
Finding: Runtime Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/generate_offline_content.py:9
Finding: Unrestricted OLLAMA_HOST Can Redirect Prompts to an Arbitrary Plaintext Endpoint
Content: View full analysis
0 except: return False def call_ollama(prompt, model=DEFAULT_MODEL, max_tokens=500): """调用本地Ollama模型生成内容""" import urllib.request payload = json.dumps({ "model": model, "prompt": prompt, "stream": False, "options": {"num_predict": max_tokens} }).encode() req = urllib.request.Request( f"{OLLAMA_HOST}/api/generate", data=payload, headers={"Content-Type": "application/json"} ) try: with urllib.request.urlopen(req, timeout=120) as resp: data = json.loads(resp.read()) return data.get("response", "") except Exception as e: return f"[离线模式] 无法调用本地模型: {e}" ``` ### Technical Analysis The default endpoint is loopback, but the `OLLAMA_HOST` environment variable is accepted without validation. The code does not require a loopback destination, restrict allowed ports, enforce HTTPS for remote destinations, or ask for consent before sending a prompt. An attacker or deployment configuration capable of setting environment variables can redirect both the availability request and generation request to an arbitrary HTTP or HTTPS endpoint. The generation request contains the full prompt in JSON. In the current implementation example, prompts are short topic requests, but this helper can accept a ...[truncated 1209 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (63)

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 91% confidence
Finding: The code constructs outbound HTTP requests from the OLLAMA_HOST environment variable without validating or constraining the destination. If an attacker can influence the process environment, they can redirect requests to arbitrary internal or external endpoints, creating SSRF-style behavior, unexpected data exfiltration, or interaction with sensitive local services.
Content: Scanner excerpt · references/generate_offline_content.py (reported line 62)May include surrounding context.
python
try: import urllib.request req = urllib.request.Request(f"{OLLAMA_HOST}/api/tags") with urllib.request.urlopen(req, timeout=5) as resp: data = json.loads(resp.read()) return len(data.get("models", [])) > 0 except:

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: This request sends prompt content to a URL derived from the untrusted OLLAMA_HOST environment variable, so environment manipulation can redirect generated content and prompts to attacker-controlled infrastructure. In a skill context, prompts may include sensitive business content, making this both a confidentiality risk and a channel for SSRF against internal services.
Content: Scanner excerpt · references/generate_offline_content.py (reported line 86)May include surrounding context.
python
) try: with urllib.request.urlopen(req, timeout=120) as resp: data = json.loads(resp.read()) return data.get("response", "") except Exception as e:

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger phrases include very broad everyday requests and even state that uploading any content should automatically trigger the skill. Overbroad triggers can cause the skill to activate unexpectedly on unrelated uploads, increasing the chance that sensitive files are processed, logged, searched externally, or delivered outward without the user's informed intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The self-repair design explicitly allows the skill to modify SKILL.md and reference files based on runtime issues and user feedback. A content-generation skill should not be self-modifying; this creates a durable persistence mechanism where prompt-injected content, malicious inputs, or faulty heuristics can alter future behavior and poison the local skill base.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow includes automatic delivery to WeChat mini-program and optional email/Tencent Docs sharing, but the description does not present this as a clear, prominent warning requiring prior consent. External sharing of generated reports can disclose confidential client data to third-party platforms or unintended recipients.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The documentation includes a one-line remote install command that fetches and executes a shell script directly from the internet using curl piped to sh. This is a classic high-risk pattern because it executes unaudited remote code immediately, allowing supply-chain compromise or malicious script substitution to fully compromise the environment.
Content: Scanner excerpt · SKILL.md (reported line 2680)May include surrounding context.
bash
# 1. 安装Ollama curl -fsSL https://ollama.com/install.sh | sh # 2. 下载模型（需要一次联网） ollama pull gemma4:e2b-it-q4_K_M

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The use of a shell pipeline to pass downloaded content directly into sh compounds the risk by chaining retrieval and execution without inspection. In the context of a skill file, this is especially dangerous because users or downstream agents may treat it as an endorsed operational step and execute it automatically or with reduced scrutiny.
Content: Scanner excerpt · SKILL.md (reported line 2680)May include surrounding context.
bash
# 1. 安装Ollama curl -fsSL https://ollama.com/install.sh | sh # 2. 下载模型（需要一次联网） ollama pull gemma4:e2b-it-q4_K_M

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill specifies automatic network searches for images, icons, reference PPTs, and color sources, plus post-generation delivery to an external mini-program, without a clear warning about what user data or document-derived keywords may be transmitted. Because report-generation inputs often contain sensitive business content, silent outbound transmission materially increases confidentiality and data-leakage risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The main flow performs multiple persistent writes—error logs, summaries, and especially SKILL.md modifications—driven by runtime inputs with no approval, trust boundary checks, or integrity protections. In a skill context, this is more dangerous because it creates a self-modifying agent pattern: untrusted inputs can poison future instructions and behavior across runs, effectively turning transient input manipulation into persistent compromise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The top-level description is written to generate Chinese-language executive consulting reports and repeatedly mandates Chinese-specific style choices such as 微软雅黑 and humanizer-zh, without offering the user a language or locale choice. This can violate language/locale policy when the skill is used in broader contexts or by users expecting multilingual support.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill claims local/offline support, yet large parts of the documented workflow make network-dependent scanning, web search, installation, and external delivery mandatory or default. This mismatch can mislead users about data residency and transmission, causing sensitive materials to be handled in ways the user did not expect.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill describes a self-evolution engine that scans local skill directories, recommends or auto-integrates other skills, and logs execution behavior. That capability is not necessary for generating consulting reports and expands the trust boundary to unrelated local content, creating a path for unintended data exposure, privilege creep, and execution of unreviewed functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The self-evolution section says the skill will track usage patterns, record errors, and write logs, but this persistence is not surfaced as a clear user-facing warning. Silent local retention of user-derived activity and feedback increases privacy risk and can create long-lived stores of sensitive project information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill persistently records usage data, execution patterns, and related logs for later reuse. Storing operational traces around user interactions can capture sensitive business context over time, especially in a consulting setting where uploaded materials may be confidential.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description emphasizes automatic research and expansion of user materials but does not prominently warn users that uploaded content may be used in external web searches or transmitted to outside sources. Missing disclosure weakens informed consent and makes accidental leakage of confidential business data more likely.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow requires writing extracted user material into persistent summary files and explicitly preserving every page and data point for report reuse. For consulting documents, this can create durable local copies of highly sensitive client information beyond the immediate task, increasing exposure if the host is compromised or shared.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill mandates storing execution issues and user feedback, then feeding them back into skill files and evolution records. This couples persistent storage with behavior modification, turning user-provided content into a long-term influence on future executions and increasing the risk of prompt-injection persistence or privacy leakage.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow mandates automatic file delivery to WeChat and optionally email or Tencent Docs after report generation. Automatic outbound delivery is not required to create a report and can exfiltrate sensitive customer materials or derived outputs to external services without meaningful, per-run consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template labels the report as confidential and includes client-specific fields, but it provides no handling guidance for the sensitive business and personal data likely to be collected. In a consulting/reporting workflow, this omission can lead to over-collection, insecure sharing, and accidental disclosure of customer, employee, or operational information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The appendix explicitly asks for site photos, interview notes, participant lists, data collection summaries, and questionnaire analysis, all of which may contain personal data, trade secrets, or sensitive facility details. Without consent, privacy, and sanitization guidance, users may embed identifiable or confidential material directly into reusable reports and circulate it broadly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The checklist explicitly recommends using recording equipment and taking on-site photos, but it does not clearly require prior consent, authorization, or adherence to privacy and confidentiality controls. In a real enterprise survey context, this can lead to unauthorized capture of employee information, customer data, trade secrets, or regulated operational details, creating privacy, contractual, and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The checklist asks consultants to collect customer complaints, return data, and other detailed operational metrics without warning that such information may be commercially sensitive, confidential, or contain personal data. This omission can normalize over-collection or mishandling of sensitive business information, increasing the risk of unauthorized disclosure or noncompliant data processing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module title and description are written entirely in Chinese, and all user-facing strings and comments in the file likewise assume Chinese as the required interaction language. There is no indication that the skill offers a language choice or that the Chinese-only behavior is a documented, region-specific requirement, which makes this a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file is entirely written in Chinese and provides no indication that language choice is optional or limited to a justified region-specific context. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale/language policy issue.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · references/extract_content.py (reported line 161)May include surrounding context.
python
# 方法1: markitdown (推荐) try: import subprocess result = subprocess.run( ["markitdown", file_path], capture_output=True, text=True, timeout=120 # 大文件可能需要较长时间 )