Security audit

数据分析技能包

Security checks for vulnerabilities and agentic risk

Overview

This data-analysis skill is not clearly malicious, but it overstates its capabilities and includes under-scoped network, file-writing, and shell-execution behavior that users should review before installing.

Install only if you are comfortable reviewing and constraining how it runs. Use dedicated input/output folders, avoid passing secrets in command-line arguments or checked-in config files, do not run it against untrusted URLs or datasets, and avoid PDF generation until shell execution and filename validation are fixed. Treat the advertised database, scheduler, AI insight, and one-click install features as incomplete unless the publisher provides matching implementation and documentation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/report-generate.js:463
Finding: Shell Command Injection in PDF Report Generation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/data-fetch.js:58
Finding: Server-Side Request Forgery Through Unrestricted URL Fetching
Content: View full analysis
{ const urlObj = new URL(url); const lib = urlObj.protocol === 'https:' ? https : http; const reqOptions = { hostname: urlObj.hostname, port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80), path: urlObj.pathname + urlObj.search, method: options.method || 'GET', headers: { 'User-Agent': 'DataMaster-Pro/1.0', ...options.headers } }; const req = lib.request(reqOptions, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { if (res.statusCode >= 200 && res.statusCode < 300) { resolve(data); } else { reject(new Error(`HTTP ${res.statusCode}: ${data}`)); } }); }); req.on('error', reject); req.end(); }); } async function fetchAPI(url, method, headers) { const response = await httpRequest(url, { method, headers }); return JSON.parse(response); } async function fetchWeb(url, selector) { const html = await httpRequest(url); return parseHTML(html, selector); } ``` ### Technical Analysis The Skill's declared purpose requires outbound requests to user-selected websites and APIs. However, the implementation imposes no destination-security boundary. It does not reject: - Loopback destinations. - Private network ranges. - Link-local addresses. - Cloud instance metadata endpoints. - Internal DNS names. - IPv6 local and private ranges. - URLs containing unexpected protocols or ports. Consequently, a user or upstream system able to supply `--url` or `--api` can make requests from the Skill host's network position. That host may have access to services that are not ...[truncated 1623 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/report-generate.js:439
Finding: Path Traversal and Arbitrary File Writes Through User-Controlled Output Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/data-viz.js:427
Finding: Stored HTML Injection Through an Unescaped Visualization Title
Content: View full analysis
${title} body { margin: 0; padding: 20px; background: #f5f5f5; }
${svg}
`; } const content = options.format === 'html' ? wrapInHTML(svg, options.title) : svg; fs.writeFileSync(outputFile, content); ``` ### Technical Analysis `options.title` is controlled through the command line and is inserted directly into the HTML `` element. It is not passed through the escaping function used for SVG text. An attacker can supply a title containing `` followed by arbitrary HTML or script markup. When the generated HTML report is opened in a browser, the injected markup is interpreted as part of the document rather than displayed as text. This is a stored injection because the malicious payload is written to an output file and executes later when a user views that file. ### Attack Path 1. An attacker supplies a crafted value to `--title`. 2. The value closes the existing `` element and introduces attacker-controlled markup. 3. The Skill generates an HTML chart using `wrapInHTML`. 4. The malicious title is written into the report without contextual encoding. 5. A user opens the generated HTML file in a browser. 6. The injected script or active markup executes in the report's browser context. ### Impact Assessment Potential consequences include: - Script execution in the generated report's origin. - Modification or falsification of chart contents. - Reading data available to the same browser origin. - ...[truncated 309 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/report-generate.js:343
Finding: Stored HTML Injection Through Dataset-Controlled Report Fields
Content: View full analysis
{ const metric = analysis.metrics[field]; metricsContent += `\n### ${field}\n`; metricsContent += `- Total: ${metric.sum.toLocaleString()}\n`; metricsContent += `- Average: ${metric.average.toFixed(2)}\n`; metricsContent += `- Minimum: ${metric.min}\n`; metricsContent += `- Maximum: ${metric.max}\n`; metricsContent += `- Median: ${metric.median.toFixed(2)}\n`; }); reportContent = reportContent.replace('{{KEY_METRICS}}', metricsContent); ``` ```js saveAsHTML(content, fileName) { const htmlContent = ` Data Analysis Report ${content} `; fs.writeFileSync( path.join(OUTPUT_DIR, `${fileName}.html`), htmlContent, 'utf8' ); } ``` ### Technical Analysis Field names originate from keys in the input JSON dataset. They are interpolated directly into `metricsContent`, which is inserted into `reportContent`. The resulting content is then embedded verbatim inside the HTML document body. No HTML encoding or sanitization is applied to dataset-controlled field names. The apparent Markdown heading syntax does not provide protection because the report generator does not safely render Markdown; it places the content directly into an HTML body. A malicious JSON property name can therefore contain HTML elements or script markup that a browser will interpret. Other report strings derived from dataset field names, such as generated insight messages and trend field names, follow the same unsafe content-generation model. ### Attack Path 1. An attacker supplies or modifies the JSON dataset pro ...[truncated 988 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 描述将技能定位为覆盖抓取、清洗、可视化、报告生成的一体化数据分析包，但提供的代码只实现了数据清洗相关流程，并且输入来源仅限本地文件系统中的 CSV/JSON。它没有任何网络抓取、图表渲染、报表生成或更广义的数据分析逻辑，因此描述明显夸大了能力范围。尽管代码确实包含“清洗”和基础“报告”摘要，但整体 declared purpose 与实际行为存在实质性不一致，应判定为 mismatch。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 该描述与代码存在明显不一致。代码的主要用途是数据获取/抓取，而不是完整的数据分析流水线。虽然描述中的“抓取”部分与代码相符，但“清洗、可视化、生成报告”这些核心能力均未实现。代码仅支持命令行参数解析、HTTP请求、简易HTML表格/列表提取、API JSON获取，以及导出到JSON/CSV。数据库支持也只是示例占位，不可实际使用。因此，声明显著夸大了实际功能范围，属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该代码块的核心功能是本地文件读取与图表渲染，支持通过命令行参数选择图表类型、字段、尺寸和输出格式，并将结果保存为 SVG/HTML。它并未体现任何网络抓取、数据采集、自动化清洗、分析管道或报告生成逻辑。虽然“可视化”这一点与声明部分一致，但声明描述的是一个更完整的数据分析技能包，而实际代码只实现了其中一小部分，属于描述与实际行为的明显不一致。未发现额外的高风险越权行为，但主要用途与能力范围被明显夸大。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明描述的是一个覆盖抓取、清洗、可视化、报告生成的完整数据分析技能包，但当前代码块的实际功能聚焦于“报告生成”。它会读取指定数据文件，解析 JSON，计算统计指标、生成简单洞察和时间序列趋势文本，并输出 HTML/Markdown/PDF 报告。虽然配置中有 includeCharts 字段，实际代码并未生成图表或可视化，也没有任何网络抓取、原始数据采集、数据清洗处理逻辑。因此，代码行为只覆盖声明中的一部分，且缺少多个核心宣称能力，构成描述与实际行为不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The title and the full user-facing documentation are presented in Chinese, and no alternative language option or opt-in is offered. Per the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale limitation is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file describes network retrieval and database access, including a database URI with embedded credentials and later mentions support for cookie authentication, but the safety notes do not explicitly warn that these operations may transmit sensitive user or system data. Under the markdown criteria for missing user warnings, skills that affect privacy or credentials should disclose those risks clearly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises web scraping, API access, database connections, scheduled execution, and report/file generation but does not warn users about outbound network access, data collection, sensitive-source handling, or where outputs may be written. In an agent skill context, missing disclosure can cause users to expose internal data or permit unintended exfiltration and persistence without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The configuration example includes an Authorization bearer token directly in JSON without any warning about secret storage, rotation, redaction, or avoiding commits to source control. This encourages insecure credential handling patterns that can lead to accidental leakage of API keys and unauthorized third-party access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s natural-language strings, title, help text, logs, and usage instructions are presented exclusively in Chinese, starting with the header and continuing throughout the script. For a general-purpose data-cleaning tool, this effectively imposes a specific language/locale on users without any opt-in or documented regional justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file's user-facing title, comments, usage text, status messages, and examples are presented in Chinese, and there is no indication that users may select another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 18)May include surrounding context.
md
console.log(' node data-fetch.js --db <连接字符串> --query <SQL>'); console.log('\n示例:'); console.log(' node data-fetch.js --url "https://example.com/data" --selector "table"'); console.log(' node data-fetch.js --api "https://api.example.com/v1/data" --output data.json'); return; }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
console.log(' node data-fetch.js --db <连接字符串> --query <SQL>'); console.log('\n示例:'); console.log(' node data-fetch.js --url "https://example.com/data" --selector "table"'); console.log(' node data-fetch.js --api "https://api.example.com/v1/data" --output data.json'); return; }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/data-fetch.js (reported line 250)May include surrounding context.
js
console.log(' node data-fetch.js --db <连接字符串> --query <SQL>'); console.log('\n示例:'); console.log(' node data-fetch.js --url "https://example.com/data" --selector "table"'); console.log(' node data-fetch.js --api "https://api.example.com/v1/data" --output data.json'); return; }

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default configuration forces language: 'zh-CN', and the skill does not offer a user-selectable language option or document this as a justified region-specific constraint. This is a natural-language locale policy issue because the skill behavior is biased toward a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code uses toLocaleString('zh-CN'), which forces Chinese locale formatting in generated output. Because no user opt-in or locale selection mechanism is provided, this violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The HTML output sets <html lang="zh-CN">, indicating the report is always emitted as Chinese-language content. Without explicit user choice or a clearly justified regional limitation, this is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a data analysis skill for crawling, cleaning, visualization, and report generation, but this file implements shell-level execution via child_process.execSync to invoke wkhtmltopdf. Spawning external binaries is a stronger capability than ordinary report rendering and is not clearly justified by the stated purpose, especially since it introduces host command execution into an analytics workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This manifest hard-codes the AI insights language to "zh-CN", which is a natural-language locale restriction. The file does not offer a user opt-in or alternative locale selection, and no region-specific compliance justification is documented here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The configuration sets the AI insight language to "zh-CN", which imposes a specific language/locale by default. Under the policy, locale restrictions should either be user-selectable or clearly justified as region-specific; this file provides neither.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file uses Chinese-only names, section labels, date formatting, and output conventions, with no indication that users may choose another language or locale. This creates a natural-language locale constraint that is not presented as optional or justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill repeatedly shows commands that write outputs such as clean.csv, chart.png, charts/, report.md, and report.html, plus one-click install/run scripts, but it does not warn users about local file modifications or possible overwrites. For markdown skill descriptions, behaviors affecting user data or system state should be disclosed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The manifest description is written entirely in Chinese and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The generated HTML hard-codes lang="zh-CN", which imposes a specific locale on all output regardless of user preference or environment. The file does not provide any opt-in, configuration flag, or documented justification for restricting output to this locale.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The description says the template is suitable for weekly reports, project progress, and team reports, but it does not define any specific trigger phrases, scope limits, or exclusion conditions. In a manifest-style file, this kind of broad invocation description can overlap with common report-writing requests and make activation boundaries unclear.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/report-generate.js:462