T09 · Insecure Skill Coding Practices
Error
- Location
scripts/connect_datasource.py:146- Finding
Automatic schema exploration and query output disclose unmasked sensitive records
- Content
View full analysis
- Remediation
View remediation
Security audit
商业数据洞察 / Biz Data Insight
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a local business-data reporting skill, but it can expose raw business records and database credentials in ways users should review before installing.
Install only for trusted local use with least-privileged, read-only datasource accounts. Avoid putting passwords in command lines or connection URIs, assume explore/query outputs may contain raw sensitive records, and review reports generated from untrusted data before sharing them.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/anomaly_detector.py:336- Finding
Caller-controlled subscription tier bypasses paid-feature authorization
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report_generator.py:32- Finding
Untrusted datasource values can inject Markdown and Mermaid report content
- Content
View full analysis
str: lines = [f'```mermaid', f'pie title {title}'] for item in data: label = item.get("label", "Unknown") value = item.get("value", 0) lines.append(f' "{label}" : {value}') lines.append("```") return "\n".join(lines) ``` ```python # scripts/report_generator.py:68-79 labels = [f'"{item.get("label", "")}"' for item in data] values = [str(item.get("value", 0)) for item in data] lines = [ "```mermaid", "xychart-beta", f' title "{title}"', f' x-axis [{", ".join(labels)}]', f' y-axis "{y_label}"', f' line [{", ".join(values)}]', "```", ] ``` ```python # scripts/report_generator.py:235-260 for dim in dimensions: name = dim.get("name", "Unknown dimension") dim_type = dim.get("type", "") data = dim.get("data", []) charts_parts.append(f"### {name}\n") charts_parts.append("| Item | Value |") charts_parts.append("|------|------|") for item in data: label = item.get("label", "") value = item.get("value", 0) charts_parts.append(f"| {label} | {format_chinese_unit(value)} |") charts_parts.append("") if is_paid and data: if dim_type == "distribution": charts_parts.append(generate_pie_chart(name, data)) elif dim_type == "trend": charts_parts.append(generate_line_chart(name, data)) elif dim_type == "ranking": charts_parts.append(generate_bar_chart(name, data)) ``` ### Technical Analysis Report titles, dimension names, labels, and values are interpolated directly into Markdown and Mermaid syntax without context-specific escaping ...[truncated 1486 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/connect_datasource.py:282- Finding
Database credentials can be exposed through process arguments and command history
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明描述的是一个更完整的数据洞察产品能力：接入数据源、生成分析报告和看板。而提供的代码仅实现了对输入 JSON 数据的异常值检测，支持标准差和 IQR 两种方法，输出结构化检测结果。它没有展示任何外部业务数据源连接、报表生成、可视化看板构建或触发式集成逻辑。虽然异常检测可以算作数据分析的一个子功能，但与声明中的主要用途相比过于狭窄且功能重心不同，因此属于明显的描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
声明描述强调的是更高层的商业数据分析产出能力（报告、看板）。但给定代码块只负责连接数据库/文件数据源、测试可读性、枚举表结构、统计行数、抽取少量样本数据，并做简单字段角色识别。这与“连接业务数据源”部分一致，但与“自动生成数据分析报告和看板”存在明显能力落差。代码也没有表现出额外危险或越权资源访问；问题主要是声明范围大于实际实现，且主要功能更接近‘数据源连接与Schema探查工具’而非完整BI报告/看板生成器。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述强调的是更高层的“商业数据洞察”能力，即连接业务数据源后自动生成分析报告和看板。但代码本身仅提供数据查询与简单聚合统计功能：支持数据库和文件数据源，构造或接收 SQL，做只读校验，执行查询，并输出 columns/rows/row_count/stats。虽然这些功能可作为数据分析系统的底层支撑，但并没有任何报告生成、可视化、看板布局、图表输出、自然语言总结或自动洞察逻辑。因此其实际主功能与声明存在明显落差。另一方面，连接数据源这一点与声明部分一致，因此不是完全无关，而是“声明过于高层且夸大了已实现能力”的不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to read environment variables, access local files/paths (CSV/Excel/JSON, reference docs), and connect to external data sources, but it declares no explicit tool scope or permission boundaries. This increases the risk of over-broad access and makes it harder for the runtime or reviewer to constrain what resources the skill may touch.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
文件中的自然语言说明明确写明“你始终使用中文与用户沟通”，这会强制施加单一语言/locale 约束。根据规则，若未提供用户选择或 opt-in，这属于语言/locale 政策违规。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
该行为准则重复要求始终使用中文，进一步确认这是全局强制性的语言限制，而不是默认偏好。规则要求语言限制需提供用户选择，或在文档中明确说明并合理限定适用场景。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill description, examples, and invocation guidance are written exclusively in Chinese, and the interactive example query is also Chinese-only. There is no indication that users may use another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context, which creates a language/locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The title and entire guidance are presented as Chinese-only reference material for the skill, and the document explicitly emphasizes Chinese label support later in the file without offering any language choice. For a skill artifact, this can indicate a language/locale constraint that is not framed as optional or region-specific, which matches the language-policy violation criterion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents all user-facing documentation and report templates exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. That creates a natural-language locale policy concern because the skill appears to force a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains user-facing natural-language descriptions entirely in Chinese, including the module description and usage guidance, with no indication that the user can choose another language or that the tool is intentionally limited to a Chinese-speaking or region-specific context. That creates a locale-policy concern under the rule for natural-language policy violations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The database schema exploration routine returns up to 5 raw rows from every table, which exceeds the stated purpose of connection testing and schema discovery. In a business-data analysis skill, those rows can easily contain PII, credentials, financial records, or other sensitive production data, causing unintended data exposure to whoever invokes or receives the output.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script exposes sample database rows without any explicit warning that real table contents will be displayed. This increases the likelihood of accidental disclosure because users may reasonably expect schema exploration to reveal structure, not actual data values.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file exploration path emits raw sample records from local CSV/Excel/JSON files rather than only schema details. Because this skill is designed to inspect business datasets, the sampled rows are likely to contain sensitive business or personal information, creating an unnecessary disclosure channel.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file exploration workflow displays sample file contents without explicitly informing the user that records will be printed. For local business files, this can leak confidential data into logs, terminals, or downstream systems consuming the JSON output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring, usage text, and CLI help/descriptions are written in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly flags language or locale constraints when the skill does not offer a language choice or document a justified region-specific limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains user-facing natural-language strings and usage documentation only in Chinese, including the module description and CLI help context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation when no language choice or locale justification is provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring and user-facing documentation strings are written entirely in Chinese, which imposes a language choice without offering users an alternative or opt-in. Under the stated policy, forcing a specific language without documented choice or justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The utility explicitly accepts a database password via a command-line argument. On many systems, command-line arguments are exposed through process listings, shell history, audit logs, or orchestration metadata, which can leak credentials to other local users or monitoring tools. In a business data connector context, those credentials may grant direct access to sensitive databases, making the issue more consequential than in a non-sensitive utility.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The top-level description and usage text are presented only in Chinese, and the CLI help/messages throughout the script also use Chinese without an opt-in or alternative locale. This creates a language policy concern because the skill effectively mandates one language for all users.
- Content
Static analysis
No suspicious patterns detected.