occupation-analysis

• Outcome: Review
• Latest audit: Aug 1, 2026 · 3:40 AM UTC
• Version: 1.1.1

Overview

This appears to be a legitimate vocational report generator, but it has under-scoped network, credential, dependency, and privileged install behavior that users should review carefully.

Install only in a contained environment. Avoid running the sudo install step unless you trust the package and need Word export, review or trim requirements.txt before installing, use --no-pdf or restrict PDF URLs to trusted official sources, and do not place live API keys in .env unless it is excluded from version control and protected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes reading and writing files and using the network. This creates a transparency and governance gap: operators may approve or run the skill under the assumption that it is purely local/report-generation logic, while it can access additional resources and produce side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The public description presents the skill as a vocational-analysis report generator, but the documented workflow also includes remote PDF retrieval, local dataset processing, mapping logic, and validation steps. This mismatch can mislead users and platform policy layers about the skill's real operational footprint, increasing the risk of unintended data access or network activity.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The documentation frames processing as based on local documents, but elsewhere instructs downloading PDFs from URLs. That inconsistency can bypass user expectations or security controls designed for offline-only skills, and it introduces supply-chain and data-exfiltration risk through unvetted remote content.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The skill claims the model must not call external APIs, yet the documented scripts can fetch remote PDFs by URL. Even if implemented in scripts rather than the model itself, this still introduces network interaction and can confuse reviewers into underestimating outbound connectivity and associated risks.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The workflow establishes a mandatory authoritative source for occupation definitions, then later permits fallback behavior that fabricates or copies missing definitions and tasks. This undermines data integrity, allowing hallucinated or transplanted occupational data to enter downstream analysis and reports as if it were authoritative, which can mislead users and contaminate generated outputs.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script downloads and parses PDFs from arbitrary user-supplied URLs without allowlisting, scheme restrictions, or destination validation. In an agent/skill context, this creates an SSRF-style primitive and broadens the skill beyond its declared occupation-analysis purpose, enabling access to internal services or untrusted content that may trigger unsafe parser behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly tells users to place API credentials into a `.env` file via shell commands, but it provides no warning about secret handling, file permissions, or the risk of accidentally committing `.env` into version control. This can lead to credential exposure through source control, shared workspaces, shell history, or copied setup transcripts.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- pypdf==3.17.0
    - python-docx==1.2.0
  system:
    - sudo apt-get update && sudo apt-get install -y pandoc
---

# 职业教育职业分析 Skill

• Confidence: 94% confidence
• Finding: The duplicated root-install instruction is still dangerous because it normalizes privilege escalation as part of ordinary skill setup. Any skill that can trigger or depend on sudo package operations increases host risk well beyond simple document generation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- pypdf==3.17.0
    - python-docx==1.2.0
  system:
    - sudo apt-get update && sudo apt-get install -y pandoc
---

# 职业教育职业分析 Skill

• Confidence: 94% confidence
• Finding: The duplicated root-install instruction is still dangerous because it normalizes privilege escalation as part of ordinary skill setup. Any skill that can trigger or depend on sudo package operations increases host risk well beyond simple document generation.

Credential Access

High

• Category: Privilege Escalation

Content

|------|------|----------|
| Python 版本过低 | 系统安装的是 Python 2 或旧版 3.x | 安装 Python 3.8+ |
| 数据文件缺失 | 未下载或路径错误 | 检查 assets/ 目录 |
| IMA 凭证未配置 | .env 文件不存在或未加载 | 创建 .env 文件并配置环境变量 |
| 依赖安装失败 | 网络问题或版本冲突 | 使用国内镜像或更新 pip |

---

• Confidence: 89% confidence
• Finding: This duplicate finding points to the same secret-handling weakness: the document normalizes storing credentials in `.env` without any protective controls or warning. Even though the content is instructional, it can still lead to accidental exposure of live API credentials.

Credential Access

High

• Category: Privilege Escalation

Content

|------|------|----------|
| Python 版本过低 | 系统安装的是 Python 2 或旧版 3.x | 安装 Python 3.8+ |
| 数据文件缺失 | 未下载或路径错误 | 检查 assets/ 目录 |
| IMA 凭证未配置 | .env 文件不存在或未加载 | 创建 .env 文件并配置环境变量 |
| 依赖安装失败 | 网络问题或版本冲突 | 使用国内镜像或更新 pip |

---

• Confidence: 89% confidence
• Finding: This duplicate finding points to the same secret-handling weakness: the document normalizes storing credentials in `.env` without any protective controls or warning. Even though the content is instructional, it can still lead to accidental exposure of live API credentials.

Credential Access

High

• Category: Privilege Escalation

Content

ls assets/occupation_dictionary_split/

# 4. 配置环境变量（创建 .env）
echo "IMA_OPENAPI_CLIENTID=your_client_id" > .env
echo "IMA_OPENAPI_APIKEY=your_api_key" >> .env

# 5. 运行测试

• Confidence: 97% confidence
• Finding: The command `echo "IMA_OPENAPI_CLIENTID=your_client_id" > .env` directly instructs users to write a credential into a plaintext file from the shell. In practice, this encourages insecure secret storage patterns and may also leak through command history, terminal recording, or copied setup logs.

Credential Access

High

• Category: Privilege Escalation

Content

# 4. 配置环境变量（创建 .env）
echo "IMA_OPENAPI_CLIENTID=your_client_id" > .env
echo "IMA_OPENAPI_APIKEY=your_api_key" >> .env

# 5. 运行测试
python scripts/search_major.py --major "汽车运用与维修" --level "中等职业教育"

• Confidence: 97% confidence
• Finding: The second `echo` command writes the API key into `.env`, which is especially sensitive because API keys often grant direct service access. In the context of this skill, the danger is elevated because the document is a setup guide that users are likely to follow verbatim, turning an insecure example into real-world credential exposure.

Known Vulnerable Dependency: Authlib==1.6.9 — 6 advisory(ies): CVE-2026-41425 (Authlib: Cross-site request forging when using cache); CVE-2026-44681 (Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect); CVE-2026-41479 (Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-co) +3 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: `Authlib==1.6.9` is flagged with multiple high-severity advisories including CSRF and open redirect issues in OAuth/OIDC flows. In a skill ecosystem that may authenticate to external services or APIs, vulnerable auth libraries can enable token theft, account compromise, or redirection to attacker-controlled endpoints.

Known Vulnerable Dependency: click==8.3.1 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: `click==8.3.1` is reported as vulnerable to command injection. While `requirements.txt` alone does not prove exploitability, command-building libraries in agent or CLI tooling are risky because user-controlled input may reach shell or subprocess contexts.

Known Vulnerable Dependency: cryptography==3.4.8 — 10 advisory(ies): CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); GHSA-5cpq-8wj7-hf2v (Vulnerable OpenSSL included in cryptography wheels) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: `cryptography==3.4.8` is an outdated version with numerous advisories, including timing-oracle and bundled OpenSSL issues. Since this package underpins TLS, token handling, and cryptographic operations across many dependencies, weaknesses here can undermine confidentiality and trust boundaries broadly.

Known Vulnerable Dependency: GitPython==3.1.45 — 10 advisory(ies): GHSA-2f96-g7mh-g2hx (GitPython: Command Injection via git long-option prefix abbreviation bypass of C); GHSA-3rp5-jjmw-4wv2 (GitPython: git-config section-name injection enables arbitrary config directives); GHSA-6p8h-3wgx-97gf (GitPython: Incomplete unsafe_git_clone_options denylist omits --template enablin) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: `GitPython==3.1.45` has multiple advisories including command injection and unsafe clone/config handling. In an agentic environment, any feature that processes repositories, branches, remotes, or clone options from user-influenced input could lead to code execution or repository-based compromise.

Known Vulnerable Dependency: httplib2==0.20.2 — 2 advisory(ies): CVE-2026-59939 (httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Respon); CVE-2026-59939 (httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, htt)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: `httplib2==0.20.2` is flagged for decompression-bomb denial of service. If the skill or its dependencies fetch remote content, an attacker could supply crafted compressed responses that exhaust memory or CPU and disrupt service availability.

Known Vulnerable Dependency: idna==3.11 — 2 advisory(ies): CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA): Specially crafted inputs ); CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA) for Python provides suppor)

High

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: `idna==3.11` is reported with advisories related to specially crafted internationalized domain inputs. This is generally a lower-level parsing issue, but it can matter in systems that validate, normalize, or connect to user-supplied domains, potentially affecting SSRF protections or hostname validation.

Known Vulnerable Dependency: langchain==1.0.3 — 2 advisory(ies): CVE-2026-55443 (LangChain: Path traversal and sandbox escape in LangChain file-search middleware); CVE-2026-55443 (LangChain is a framework for building agents and LLM-powered applications. Prior)

Medium

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: `langchain==1.0.3` is flagged for path traversal and sandbox escape issues in file-search middleware. Because this skill appears to be part of an LLM/agent stack, vulnerabilities in agent tooling are more dangerous than in a standalone app: they can expose host files or bypass intended execution constraints.

Known Vulnerable Dependency: langchain-core==1.0.2 — 10 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa); CVE-2026-40087 (LangChain has incomplete f-string validation in prompt templates) +7 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: `langchain-core==1.0.2` carries critical advisories including SSRF, template injection, and incomplete validation. In an agent skill context that may process user prompts and external resources, these flaws can enable internal network access, prompt/template abuse, data exfiltration, or escalation into broader agent compromise.

Known Vulnerable Dependency: langchain-openai==1.0.1 — 2 advisory(ies): CVE-2026-41488 (langchain-openai: Image token counting SSRF protection can be bypassed via DNS r); CVE-2026-41488 (LangChain is a framework for building agents and LLM-powered applications. Prior)

Medium

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: `langchain-openai==1.0.1` is flagged for SSRF-protection bypass in image token counting. In an LLM-integrated skill, this can allow attacker-controlled URLs or DNS tricks to trigger requests to internal services or sensitive metadata endpoints.

Known Vulnerable Dependency: langgraph==1.0.2 — 2 advisory(ies): CVE-2026-28277 (LangGraph checkpoint loading has unsafe msgpack deserialization); CVE-2026-28277 (LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver th)

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: `langgraph==1.0.2` is reported with unsafe checkpoint deserialization. Deserialization flaws in agent state management are highly dangerous because loading attacker-controlled checkpoint data can result in arbitrary code execution or full compromise of the runtime.

Known Vulnerable Dependency: langgraph-checkpoint==3.0.0 — 4 advisory(ies): CVE-2026-48775 (LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading); CVE-2026-27794 (LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code E); CVE-2026-48775 (LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading) +1 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: `langgraph-checkpoint==3.0.0` includes unsafe JSON/deserialization issues and related cache loading risks. If checkpoint or cache content can be influenced by users, external systems, or shared storage, exploitation could corrupt agent state, leak data, or lead to remote code execution depending on the deserialization path.

Known Vulnerable Dependency: langgraph-sdk==0.2.9 — 2 advisory(ies): CVE-2026-48776 (LangGraph SDK has unsafe URL path construction); CVE-2026-48776 (LangGraph SDK has unsafe URL path construction)

Medium

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: `langgraph-sdk==0.2.9` is flagged for unsafe URL path construction. In systems that call backend APIs using user-influenced identifiers or paths, this can cause request smuggling-like path confusion, broken authorization boundaries, or access to unintended endpoints.

Static analysis

No suspicious patterns detected.