Security audit

testcase-generator-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a local Chinese-language test-case Excel generator with some overstated capabilities, but no evidence of hidden access, exfiltration, persistence, or destructive behavior.

Install only if you are comfortable with a Chinese-language, local-file tool that reads the input file you name and writes generated test cases to disk. Review the generated workbook before relying on it, and do not expect real parsing of Swagger/OpenAPI, database DDL, docx, or xlsx references unless the skill is updated.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: 该代码与“生成测试用例并导出 Excel”的核心方向大体相关，但声明明显夸大和泛化了实际能力。脚本只读取一个输入文件，做简单字符串包含判断，然后从大量硬编码的金融交易场景模板中挑选用例并写入 Excel。它没有解析接口定义、数据库表结构，也没有参考现有用例进行相似生成；所谓“智能”能力并不存在。另有一个细节偏差：CLI 提供 csv 选项，但保存逻辑始终通过 openpyxl 生成工作簿文件，不是真正的 CSV 导出。总体上，主功能领域相近，但实际行为比声明狭窄且更专用，存在实质性描述-行为不一致。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to read local input materials from the working directory, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: a user or orchestrator cannot easily tell what file access the skill requires, increasing the chance of unintended file reads if the skill is invoked in a broader workspace context.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This code file contains natural-language skill documentation entirely in Chinese, and the CLI help/output strings throughout the file are also Chinese-only. That imposes a specific language on users without offering any locale selection or documenting that the skill is intentionally region/language-specific.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest describes generating test cases from requirements documents, API definitions, database schemas, and existing case references, including batch generation. In this file, the only implemented input handling is reading one local text file and deriving canned scenarios from presence of keywords like '申购', '赎回', or '安全', with no code for API spec parsing, database schema analysis, existing-case ingestion, or batch processing.

Description-Behavior Mismatch

Medium

Confidence: 99% confidence
Finding: The command-line interface declares '--format' choices of 'xlsx' and 'csv', suggesting the tool can export CSV. However, the generation path always creates an openpyxl workbook and saves it via 'wb.save(output_file)', regardless of the selected format, so choosing CSV only changes the filename extension rather than the output behavior.

Vague Triggers

Low

Confidence: 86% confidence
Finding: The markdown instructs users to tell the AI assistant '根据[需求文档/接口定义/数据库表]生成测试用例' or request cases for a module, but it does not define explicit activation boundaries, exclusions, or negative examples. This phrasing is broad enough to overlap with ordinary requests for test-case generation, increasing the chance of unintended invocation in contexts beyond this skill's intended workflow.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The skill states that it produces Excel output but does not clearly warn that this results in writing files to disk. Hidden or insufficiently disclosed write behavior can surprise users and, in shared or sensitive workspaces, may create unintended artifacts containing business data or test content.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This markdown file contains natural-language guidance exclusively in Chinese, including the title and all instructions, with no indication that the user can choose another language or that the document is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The entire skill content, including headings, test case descriptions, and expected results, is written exclusively in Chinese with no indication that language choice is optional or that the skill is intended only for a Chinese-speaking context. This can violate a language/locale policy when users are not given an opt-in or alternative locale.

Static analysis

No suspicious patterns detected.