Data Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent sales-report generator, but its file handling can write PDFs outside its intended folder and embed caller-selected local image files into reports.

Review this skill before installing in a shared or sensitive environment. It should be updated to generate server-controlled filenames, restrict chart inputs to files it created, avoid predictable /tmp paths, and document cleanup behavior. It is not appropriate for handling sensitive local images or running where untrusted users can control report titles or chart paths.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: __init__.py:123

Finding

Arbitrary Local Image Disclosure Through Unrestricted Chart Paths

Content

View full analysis

Vulnerability Details

File Location: __init__.py, lines 123–131
Vulnerability Type: Unrestricted local file access
Risk Level: Medium

python

for img_path in chart_paths:
    if os.path.exists(img_path):
        img = Image(img_path, width=480, height=280)
        story.append(img)
        story.append(Spacer(1, 20))
    else:
        story.append(Paragraph(f"图表文件丢失：{img_path}", normal_style))
        story.append(Spacer(1, 10))

Technical Analysis

The chart_paths parameter is controlled by the caller and is used directly to access local files. The implementation only checks whether each path exists; it does not verify that the path references a chart generated by the skill, resides in an approved directory, or is a regular non-symlink file.

ReportLab attempts to open every existing path as an image and embeds compatible files in the generated PDF. Consequently, an attacker who knows or can guess the location of a readable local image can cause that file to be included in a downloadable report. Large or malformed images may also consume excessive memory or cause report generation to fail.

Attack Path

1. The attacker identifies or guesses a readable local image path available to the skill process.
2. The attacker supplies that absolute path or a traversal-based path in chart_paths.
3. os.path.exists() confirms that the file exists.
4. Image(img_path, ...) opens the caller-selected local file.
5. The file is embedded in the generated PDF.
6. The attacker retrieves the PDF and views the disclosed image.

Impact Assessment

Exploitation permits disclosure of ReportLab-compatible local image files readable by the skill process. It does not grant additional operating-system privileges or arbitrary access to non-image files based on the reviewed code. The disclosure scope is bounded by the process account's filesystem permissions and the image formats accepted by ReportLab ...[truncated 94 chars]

Remediation

View remediation

Remediation Suggestions

• Store generated charts in a dedicated private directory controlled by the skill.
• Resolve each submitted path with os.path.realpath() or pathlib.Path.resolve().
• Verify that the resolved path is a descendant of the approved chart directory.
• Require the target to be a regular file and reject symbolic links.
• Maintain server-side identifiers for generated charts instead of accepting arbitrary filesystem paths.
• Validate file signatures and allow only explicitly supported image formats.
• Enforce image dimensions and file-size limits before processing.
• Open validated files through controlled file handles where supported to reduce time-of-check/time-of-use risks.

T09 · Insecure Skill Coding Practices

Error

• Location: __init__.py:95

Finding

Path Traversal and Arbitrary PDF File Overwrite Through Report Title

Content

View full analysis

Vulnerability Details

File Location: __init__.py, lines 95–97
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: High

python

pdf_name = f"{report_title.replace(' ','_')}.pdf"
pdf_path = os.path.join(self.output_dir, pdf_name)
doc = SimpleDocTemplate(pdf_path, pagesize=A4)

Technical Analysis

The caller-controlled report_title is incorporated into the output filename after only replacing spaces. Directory separators, .. traversal components, absolute paths, and other unsafe filename characters remain accepted.

When the second argument to os.path.join() is absolute, Python discards the preceding output directory. Relative traversal sequences can likewise escape /tmp/sales_report. During doc.build(story), ReportLab creates or truncates the resulting destination, allowing writable files outside the intended report directory to be replaced with PDF content.

Attack Path

1. The attacker invokes export_sales_pdf_report with a malicious report_title.
2. The title contains traversal components such as ../../target or an absolute path.
3. The code appends .pdf without removing the unsafe path components.
4. os.path.join() constructs a path outside /tmp/sales_report.
5. doc.build(story) writes the generated PDF to that escaped location.
6. If the process account can write to the destination, an existing file is overwritten or a new file is created.

Impact Assessment

An attacker can create or overwrite .pdf-suffixed files at arbitrary filesystem locations writable by the skill process. The vulnerability does not itself elevate the process account's operating-system privileges, but it violates the intended output-directory boundary. Potential consequences include application data corruption, denial of service, interference with other users' files, or creation of attacker-influenced PDF files in security-sensitive writable locations.

Remediation

View remediation

Remediation Suggestions

• Generate output filenames server-side using an unpredictable UUID rather than deriving them from report_title.
• Treat report_title exclusively as document content, not as a filesystem path.
• If human-readable filenames are required, apply a strict allowlist such as letters, digits, hyphens, and underscores.
• Reject absolute paths, directory separators, . and .. path components, and empty filenames.
• Resolve the final destination and verify that it remains a descendant of the resolved self.output_dir.
• Create output files atomically and with exclusive-create semantics when overwriting is unnecessary.
• Set restrictive directory and file permissions.
• Return a logical report identifier rather than exposing caller-influenced absolute paths.

T09 · Insecure Skill Coding Practices

Warning

• Location: __init__.py:60

Finding

Predictable Chart Files in Shared Temporary Directory

Content

View full analysis

Vulnerability Details

File Location: __init__.py, lines 60–62
Vulnerability Type: Unsafe temporary file handling
Risk Level: Medium

python

img_path = f"/tmp/sales_{metric}_{chart_type}.png"
plt.savefig(img_path, dpi=150, bbox_inches="tight")
plt.close()

Technical Analysis

Chart files are written under the shared /tmp directory using deterministic names derived from metric and chart_type. Repeated or concurrent requests for the same combination use the same destination.

This design permits cross-request overwrites and race conditions. In a multi-user environment where another local account can create entries in /tmp, an attacker may pre-create the predictable destination as a symbolic link. If the underlying file-opening behavior follows that link, chart generation may overwrite another file writable by the skill process. Even without a symlink attack, concurrent requests can replace one another's results and cause reports to contain charts from the wrong request.

Attack Path

1. The attacker predicts a chart path such as /tmp/sales_sales_line.png.
2. The attacker either initiates concurrent chart requests or pre-creates the path as a symbolic link to another writable file.
3. A victim or the attacker invokes plot_sales_data using the corresponding metric and chart type.
4. plt.savefig() writes to the predictable shared path.
5. The operation overwrites another request's chart or, where symbolic links are followed, writes through the attacker-controlled link.
6. The victim receives corrupted or cross-request output, or a writable target file is replaced with PNG data.

Impact Assessment

The primary impacts are cross-request data integrity failures, report confusion, and denial of service. In a hostile multi-user environment, the flaw may also permit replacement of files writable by the skill process through temporary-file link attacks. Exploitation remains limited by l ...[truncated 101 chars]

Remediation

View remediation

Remediation Suggestions

• Use the skill's dedicated output directory instead of the shared /tmp root.
• Create the directory with restrictive permissions, such as owner-only access.
• Generate unpredictable filenames with tempfile.NamedTemporaryFile, tempfile.mkstemp, or UUIDs.
• Avoid reusing filenames across requests.
• Ensure files are created atomically and do not follow pre-existing symbolic links.
• Associate generated charts with request-specific identifiers.
• Remove temporary charts after report generation when persistence is unnecessary.
• Add concurrency tests to verify that simultaneous requests cannot overwrite or retrieve one another's output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is written as a Chinese-only capability statement and presents the skill as producing Chinese business analysis artifacts such as weekly reports, without any indication that language is configurable. Per the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states it will automatically generate a PDF, persist it to local storage, and return an absolute local file path for subsequent read/download operations, but it does not document any user confirmation, storage scope, retention policy, or path safety constraints. In an agent setting, silent file creation and disclosure of local paths can lead to unintended disk writes, data persistence, and increased exposure of host filesystem details that could be chained with other tools or prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code consistently uses Chinese natural-language comments, docstrings, prompts, and user-facing return strings, such as error and report text, with no indication that users can opt into another language. That creates a locale policy concern because the skill effectively forces one language for interaction and output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.