Security audit

毅安DFA割集分析

Security checks for vulnerabilities and agentic risk

Overview

Review is needed because this skill can update a safety-analysis workbook from an outdated worksheet while its built-in check still reports success.

Use a separate workbook copy and explicitly select the source and target worksheets. Independently verify the same source and requested orders because the built-in checker cannot accept those overrides. Have a safety engineer review all generated drafts, especially EPS ECU entries, and preserve review markers separately. The static scan found no issues; the Review verdict rests on the verified worksheet-selection and review-control problems.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding is partially valid: automatic selection can choose an older non-old worksheet instead of the advertised latest list, causing incorrect updates or obsolete markings in a safety-analysis workbook. The coverage checker uses the same selection strategy, so it can validate against the same wrong source without detecting the mistake. However, --order is explicitly documented as an override and is not an undisclosed scope bypass.
Content: No source excerpt is available for this finding.

Source-sheet selection does not implement the manifest's preference for the latest cut-set list.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The checker selects the first non-old matching worksheet in workbook order, without determining which is current. With multiple candidates, stale or deliberately reordered input can produce a PASS against the wrong baseline, undermining the mandatory integrity check for the DFA deliverable.
Content: No source excerpt is available for this finding.

Claims that analysis text is reused verbatim from reviewed blocks conflict with synthesized EPS ECU templates.

Medium

Category: Excessive Agency
Confidence: 96% confidence
Finding: L26-L27 describe exact reuse of patterns observed in existing human-filled blocks, and L118-L120 specifically claim the I-column strings are taken verbatim from already-reviewed blocks. However, L168-L177 explicitly introduce EPS ECU text drafted by analogy, which L517-L521 writes into new analysis blocks without distinguishing it from reviewed-source content.
Content: No source excerpt is available for this finding.

Automatic source selection does not implement the promised preference for the latest non-old cut-set list.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: Source selection excludes names containing old but otherwise trusts workbook tab order, so an earlier stale non-old sheet can override a newer list. Because the updater saves changes in place and marks absent cutsets obsolete, this ambiguity can compromise the safety-analysis document's integrity; the matching checker selection can conceal the error.
Content: No source excerpt is available for this finding.

The unrestricted --order option bypasses the manifest's Order-2/3-only processing boundary.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The manifest explicitly limits processing to Order 2 and 3, but L574-L579 accept arbitrary integer orders without validation. Those values control source filtering and target updates at L600-L611, allowing other-order blocks to be refreshed, appended, or marked obsolete.
Content: No source excerpt is available for this finding.