T08 · Insecure Dependencies
Warning
- Location
SKILL.md:41- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Cn Text Summary
Security checks for vulnerabilities and agentic risk
Overview
This is a small local Chinese text summarizer with disclosed optional keyword extraction and no evidence of network access, persistence, credential use, or destructive behavior.
Reasonable to install for non-sensitive Chinese text summarization. Prefer a pinned jieba version if installing the optional dependency, and avoid sending confidential documents through command-line arguments; use a safer wrapper or stdin-based version for private text.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/text_summary.py:64- Finding
Sensitive Source Text Exposed Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The primary purpose broadly matches: the script accepts text and produces a summary. However, the description specifically claims '纯Python标准库' (pure Python standard library), which is inaccurate because the code attempts to import and use the external jieba package for keyword extraction. Although it can fall back to a standard-library-only approach if jieba is missing, the implemented behavior is not strictly standard-library-only. Additionally, the script also extracts keywords and includes them in the output, which is an extra user-visible capability not reflected in the declared description. No evidence of API key use, network access, or other risky undeclared permissions was found.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest name, description, title, and usage guidance are entirely in Chinese, and the dependency note explicitly states Chinese tokenization support. This indicates a language-specific constraint, but the file does not state that the skill is Chinese-only, offer an opt-in language choice, or justify the locale restriction as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code’s natural-language description, docstrings, and error output are entirely in Chinese, which imposes a specific language on users without any opt-in or fallback. The stated policy flags language or locale requirements unless the skill offers a choice or clearly documents a justified region-specific constraint.
- Content