自营发货策略+分区方案配置拆分导出. 读取Excel文件，按照指定的列进行分组，将相同组的数据导出到新文件，文件命名用分组字段组合命名。

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:11 AM UTC
• Version: 1.0.0

Overview

The skill is a focused Excel export tool, but its implementation can leak unexpected source spreadsheet columns into generated files despite documentation saying only five fields are kept.

Review this skill before installing or using it on business spreadsheets. Run it only on reviewed copies of input files, inspect generated workbooks before sharing them, and be aware that extra source columns may be carried into outputs despite the documentation. Also verify that the hard-coded country code US is correct for your workflow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/excel_export.py:47
• Finding: Spreadsheet Formula Injection in Generated Excel Files## Vulnerability Details **File Location**: `scripts/excel_export.py`, lines 47-67 **Vulnerability Type**: Spreadsheet formula injection **Risk Level**: Medium ```python # 邮编列进行去重 group_df = group_df.drop_duplicates(subset=['邮编']) # 增加开始邮编列. 值等于 邮编列的值 group_df.insert(3, '开始邮编', group_df['邮编']) # 增加技术邮编列. 值等于 邮编列的值 group_df.insert(4, '结束邮编', group_df['邮编']) # 删除 渠道组, 实重区间, 周长区间 列 group_df.drop(['邮编','渠道组', '实重区间', '周长区间'], axis=1, inplace=True) # 导出的文件需要增加 分区名称 列. 默认值 1 group_df.insert(0, '分区名称', 1) # 增加国家二字码列 默认值 US group_df.insert(1, '国家二字码', 'US') # 增加城市列默认值 空 group_df.insert(2, '城市', '') # 导出到新的 Excel 文件 group_df.to_excel(output_path, index=False) ``` ### Technical Analysis The script accepts cell content from an input workbook and writes it into newly generated workbooks without neutralizing spreadsheet formulas. In particular, the untrusted `邮编` value is copied into both the start-postal-code and end-postal-code columns. Other source columns that remain in `group_df` are also exported without validation. Spreadsheet-writing engines can encode strings beginning with `=` as formulas. Depending on the spreadsheet application and export engine, other formula-related prefixes such as `+`, `-`, or `@` may also require handling. Consequently, an attacker who can influence the input workbook can place a formula payload in a postal-code or retained source field. The generated workbook then carries that payload into a file likely to be trusted by its recipient. Formula execution depends on the recipient opening the workbook and on the spreadsheet application's security configuration. Potential payloads may invoke external links, initiate network requests, expose workbook or environment information, or display deceptive content. ### Attack Path 1. An attacker creates or modifies an input XLSX workbook. 2. Th ...[truncated 1356 chars]
• Remediation: ## Remediation Suggestions - Treat every value originating from the input workbook as untrusted. - Validate postal codes against a strict, business-appropriate allowlist before export. For example, accept only the expected digits, letters, spaces, and hyphens, with a defined maximum length. - Sanitize every textual output cell, not only postal-code fields. Prefix formula-capable strings with an apostrophe or otherwise force them to be stored as literal text. - Account for at least `=`, `+`, `-`, and `@` after trimming leading whitespace and control characters. - Configure the selected Excel writer engine to disable automatic conversion of strings into formulas where supported. - Add automated tests covering formula payloads, leading whitespace, control characters, and ordinary postal codes. - Verify the generated workbook at the cell-type level to ensure untrusted values are stored as text rather than formulas.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/excel_export.py:55
• Finding: Undocumented Retention of Source Columns Can Expose Sensitive Data## Vulnerability Details **File Location**: `scripts/excel_export.py`, lines 55-67 **Vulnerability Type**: Excessive data exposure through incomplete column filtering **Risk Level**: Medium ```python # 删除 渠道组, 实重区间, 周长区间 列 group_df.drop(['邮编','渠道组', '实重区间', '周长区间'], axis=1, inplace=True) # 导出的文件需要增加 分区名称 列. 默认值 1 group_df.insert(0, '分区名称', 1) # 增加国家二字码列 默认值 US group_df.insert(1, '国家二字码', 'US') # 增加城市列默认值 空 group_df.insert(2, '城市', '') # 导出到新的 Excel 文件 group_df.to_excel(output_path, index=False) ``` The documented requirement appears in `SKILL.md`, line 29: ```markdown - 导出的文件需要删除 原所有字段仅保留新增加的 分区名称, 国家二字码, 城市, 开始邮编, 结束邮编 字段 ``` This requirement states that original fields should be removed and that only the five constructed output fields should remain. ### Technical Analysis The implementation uses a denylist and removes only four specifically named columns: `邮编`, `渠道组`, `实重区间`, and `周长区间`. Any other original columns remain in `group_df` and are subsequently written to every applicable output workbook. This behavior conflicts with the documented output contract, which requires the export to contain only the zone name, country code, city, start postal code, and end postal code. Because source workbook schemas can contain arbitrary additional columns, those fields may include customer information, internal identifiers, operational notes, pricing information, or other confidential data. The mismatch is especially risky because an operator may review or distribute the generated files under the assumption that all original fields were removed. ### Attack Path 1. An input workbook contains additional columns beyond the four explicitly removed by the script. 2. Those columns contain confidential, personal, or internal business information. 3. An operator executes the export process while relying on the documented five-column output behavior. ...[truncated 1049 chars]
• Remediation: ## Remediation Suggestions - Replace the partial column denylist with an explicit output allowlist. - Construct a new DataFrame containing only the five documented fields rather than modifying the complete source group in place. - Use logic equivalent to: ```python output_df = pd.DataFrame({ '分区名称': 1, '国家二字码': 'US', '城市': '', '开始邮编': group_df['邮编'], '结束邮编': group_df['邮编'], }) output_df.to_excel(output_path, index=False) ``` - Validate that `邮编` exists before constructing the output. - Assert immediately before export that the output column list exactly matches the documented schema. - Add regression tests using input files with unexpected sensitive columns and verify that none appear in generated workbooks. - Apply the spreadsheet-formula neutralization described in the first finding to the explicitly selected output values.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documentation describes a transformation that deletes all original fields and writes multiple new files, but it does not clearly warn users about this destructive data-shaping behavior or the side effect of creating output artifacts. This can lead to unintended data loss, misuse of the exported files, or accidental processing of sensitive spreadsheet contents into many derived files.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill claims to perform grouped export, but the implementation also deduplicates rows by 邮编, inserts new columns, deletes original grouping columns, and hard-codes additional values before export. This silent data rewriting can corrupt business datasets or produce misleading outputs that users may trust as a faithful split of the original Excel file.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The script unconditionally inserts 国家二字码='US' for every exported record regardless of source data or user intent. In a logistics/export workflow, forced locale metadata can misroute shipments, invalidate downstream imports, or poison operational data because consumers may assume the generated files are accurate.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The documentation states that the exported files add a '国家二字码' column with default value 'US', which imposes a specific country/locale setting in natural language guidance. There is no indication that users can opt out, choose another locale, or that the US default is required for a region-specific workflow.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The docstring claims the function groups by fixed columns 'a, b, c' and names files using 'a+b+c', which does not reflect the actual implementation that accepts arbitrary group_columns from the CLI. It also omits that the function deduplicates rows, inserts several columns, and removes others before writing output, creating intent-level documentation drift.

Static analysis

No suspicious patterns detected.