CNInfo Reports

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.0.1

Overview

This skill mostly matches its stated CNInfo report-downloading purpose, but it has a real file-write containment risk from untrusted remote metadata.

Review before installing. Use a trusted stock CSV path explicitly, run dry-run first, keep output/runtime directories in a disposable workspace, and avoid opening generated CSV manifests in spreadsheet software unless imported as text. The publisher should sanitize remote identifiers, enforce output-directory containment, remove broad CSV fallback search, and pin dependencies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cninfo_annual_reports/repository.py:183

Finding

Path Traversal Through an Unsanitized Remote Announcement Identifier

Content

View full analysis

None: target_path.parent.mkdir(parents=True, exist_ok=True) temp_path = target_path.with_suffix(target_path.suffix + ".part") try: response = self._request(url, stream=True, action=f"download[{target_path.name}]") with response: response.raise_for_status() with temp_path.open("wb") as handle: for chunk in response.iter_content(chunk_size=1024 * 64): if chunk: handle.write(chunk) temp_path.replace(target_path) finally: if temp_path.exists(): temp_path.unlink(missing_ok=True) ``` ### Technical Analysis The `announcement_id` value originates from the remote CNInfo API and is stored without validation. For additional report variants, it is interpolated directly into a filename. No allowlist, path-separator rejection, canonicalization, or containment check is applied ...[truncated 1966 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cninfo_annual_reports/repository.py:326

Finding

CSV Formula Injection in the Exported Report Manifest

Content

View full analysis

.csv`. 4. A user opens the generated manifest in spreadsheet software. 5. The spreadsheet interprets ...[truncated 846 chars]

Remediation

View remediation

str: text = "" if value is None else str(value) check = text.lstrip(" \t\r\n") if check.startswith(("=", "+", "-", "@")): return "'" + text return text ``` 3. Apply the function consistently to all textual fields, including names, titles, identifiers, URLs, paths, and error messages. 4. If the manifest is intended only for machine consumption, consider exporting JSON instead of a spreadsheet-oriented format. 5. Document that the CSV contains external metadata and should be imported as text when opened in spreadsheet software. 6. Add regression tests for direct formula markers, leading whitespace, tabs, carriage returns, quoted formulas, and Unicode characters that spreadsheet applications may normalize. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Reset

To restart from scratch, delete state files:

bash

rm runtime/state.db runtime/state.db-wal runtime/state.db-shm

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

To restart from scratch, delete state files:

bash

rm runtime/state.db runtime/state.db-wal runtime/state.db-shm

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill performs file reads, file writes, and network access but does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent invokes the skill with broader-than-necessary capabilities, making unintended data access or network actions harder to govern and audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The logic rejects any title lacking Chinese characters and explicitly excludes titles containing English markers such as 'english' or 'annual report'. This is a natural-language locale policy constraint embedded in code, but the file provides no user choice or documented justification that the skill is intentionally limited to Chinese-language filings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code hard-codes the Accept-Language header to prefer zh-CN, which imposes a specific language/locale behavior. Under the policy, locale constraints should be user-selectable or clearly justified as region-specific; this file does neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file mixes English with Chinese, including the title and core usage description, but does not state that Chinese is optional or provide a user language choice. This can violate a language/locale policy when a skill effectively assumes a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specification uses a lower-bound range (requests>=2.32.0) instead of pinning an exact version, which makes builds non-reproducible and can unexpectedly pull in different releases over time. In a downloader skill that makes outbound HTTP requests, this increases supply-chain and maintenance risk because behavior and security posture may change without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.32.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Because requests is not pinned, it is impossible to verify from this manifest whether the installed version includes fixes for known advisories affecting older or specific releases. This is especially relevant for a skill that downloads remote content, since HTTP client flaws can expose credentials, weaken TLS assumptions, or otherwise affect network security depending on the runtime-installed version.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

If the configured CSV path does not exist, the service recursively searches the entire current working tree for a file named "上市公司基础信息.csv" and uses the first match it finds. This can cause the skill to process an unintended or attacker-planted dataset, violating the expected trust boundary of a user-supplied input path and potentially leading to incorrect bulk downloads, data mix-ups, or abuse of local workspace contents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.