T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_excel.py:91- Finding
Spreadsheet Formula Injection Through Unsanitized Extracted Values
- Content
View full analysis
- Remediation
View remediation
Security audit
P-E
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with making Excel files from images, but it needs Review because it automatically installs unpinned packages and leaves user images/data in predictable local paths without enough user control.
Install only if you are comfortable with the skill processing local images, creating an Excel file automatically, installing Python packages from pip if missing, and leaving uploaded images under /tmp/p-e-images. Prefer using non-sensitive images, choosing an explicit output path, cleaning /tmp/p-e-images after use, and reviewing generated spreadsheets before sharing them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:7- Finding
Automatic Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
/dev/null || pip3 install --user openpyxl Pillow ``` ### Technical Analysis The project installs `openpyxl`, `Pillow`, and their applicable transitive dependencies without pinning reviewed versions or verifying package hashes. The installation uses the package index and resolver configuration available in the execution environment. This makes installation non-reproducible and allows future package releases or changed transitive dependencies to become part of the effective code executed by the Skill without a corresponding review of this repository. Python package installation can execute build and installation logic under the invoking user's account. No malicious package name, typosquatted package, or known compromised version was identified in the audited files. The vulnerability is the unsafe dependency acquisition process rather than evidence that the named packages are malicious. ### Attack Path 1. A required Python dependency is unavailable in the current environment. 2. The Skill invokes the documented pip command or asks the user to run `setup.sh`. 3. Pip resolves the latest versions allowed by the current package index and configuration. 4. Pip downloads packages and transitive dependencies that were not pinned or hash-verified by the project. 5. Package build or installation logic executes with the invoking user's privileges. 6. If the selected package source or dependency chain has been compromised, attacker-controlled code can execute during installation or later import. ### Impact Assessment Installation runs with the pr ...[truncated 434 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:57- Finding
Predictable Shared Temporary Paths Permit Data Exposure and Cross-Run Interference
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises an end-to-end image extraction workflow: users send a template image and actual images, and the tool understands the format and produces Excel directly. The supplied code does not implement image ingestion, OCR, template matching, vision extraction, or any user-triggered picture-processing flow. Its sole function is to convert already structured JSON into an Excel file, with optional embedding of image files referenced by path in the JSON. While Excel generation is consistent with part of the description, the primary advertised capability—extracting data from images based on a template—is absent, making this a material description-behavior mismatch.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
第 5 步：清理临时文件
bash rm -f /tmp/p-e-data.json保留
/tmp/p-e-images/中的图片（Excel 生成后不再需要，但用户可能想保留）。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill instructs use of exec, write, and access to user-provided local file paths, but the manifest does not declare an explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where the runtime may grant broader file/system access than users expect, increasing the chance of unintended file reads or writes during execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill description and operational instructions are primarily written to enforce Chinese-language triggers and output conventions, with no explicit user choice of language or locale. This can violate language/locale policy when users have not opted into Chinese output.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill saves uploaded images and extracted structured data to local temporary files but does not clearly warn the user that their content will be persisted on disk. This is dangerous because images may contain personal or proprietary information, and temporary files can remain accessible after the task, especially since the image directory is intentionally retained.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
This duplicate finding points to the same persistence behavior: a shared /tmp/p-e-images directory is created and chat-uploaded images are written there without lifecycle controls. Because the directory is reused and not cleaned up, later runs or local users/processes may observe residual sensitive content.
- Content
bash # 用 exec 工具创建临时目录 mkdir -p /tmp/p-e-images如果图片已经在本地文件系统上（用户给了路径），直接使用该路径。
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
This duplicate finding points to the same persistence behavior: a shared /tmp/p-e-images directory is created and chat-uploaded images are written there without lifecycle controls. Because the directory is reused and not cleaned up, later runs or local users/processes may observe residual sensitive content.
- Content
bash # 用 exec 工具创建临时目录 mkdir -p /tmp/p-e-images如果图片已经在本地文件系统上(用户给了路径),直接使用该路径。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs automatic creation of an Excel file on the user's Desktop or a user-specified path without an explicit warning or confirmation step. Unprompted file creation can overwrite user expectations, leak extracted sensitive data into a prominent location, and normalize unsafe write behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example trigger "帮我把这些图片整理出表格" is a broad natural-language request that could overlap with ordinary conversation about images and spreadsheets. The document does not provide exclusion conditions or clear boundaries for when such phrasing should or should not invoke this skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code hard-codes the worksheet title to the Chinese string "数据", which imposes a specific locale in the generated output. The file otherwise contains bilingual text but provides no user option or documented justification for forcing a Chinese worksheet name.
- Content
Static analysis
No suspicious patterns detected.