Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/fixtures/run_fixtures.sh # 离线三档一次跑完，末行自报档数与不合枚数
Security audit
图表规格
Security checks for vulnerabilities and agentic risk
Overview
The skill prepares chart drafts as described, but its checker can report incorrect numbers as verified.
Use this as a drafting aid, and independently check each number against its source cell. Supply the source table and file/line citations; neither PASS nor [待人工] proves completed verification or human approval. Keep confidential documents offline until you understand and authorize the optional parser's data handling. Review installation versions and choose an output path safe to overwrite. The scanner's shell coverage gap was investigated; external-parser behavior remains unverified.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)
MCP server referenced without pinned version: 'npx skills'.
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The installation command executes an unpinned npm CLI and installs skill content from an unpinned repository reference. Although this is not itself an MCP server declaration as the finding suggests, compromised or unexpectedly changed upstream releases could execute code or introduce malicious agent instructions.
- Content
MCP server referenced without pinned version: 'npx skills'.
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The recommended command executes an unversioned npm CLI and retrieves skill instructions without an immutable repository revision. The MCP-specific label is inaccurate, but the underlying supply-chain exposure is real: upstream compromise could affect both local code execution and subsequent agent behavior.
- Content
The external parsing workflow lacks a clear disclosure that document data may be sent to a third-party service.
Medium
- Category
- Output Handling
- Confidence
- 88% confidence
- Finding
The workflow recommends external parsing, including a real local-file parsing test, without clearly explaining which document contents or access URLs leave the machine and who processes them. Asking permission to use the helper or incur costs does not establish informed consent to disclose potentially non-public financial data, especially alongside broad statements that the skill uploads nothing.
- Content
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Page-only citations can pass without the promised column-to-cell verification.
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
Page-only citations satisfy the location requirement, but verify_cells only verifies rows identified by file-and-line citations and returns without checking page-only references. The page check merely requires any quoted fragment to occur on the cited page, so authentic but unrelated labels and numbers can be combined into a misleading claim that passes despite the skill's promised exact cell attribution.
- Content
The investment-assertion gate permits prohibited assertions whenever their paragraph contains [待人工].
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
Any paragraph containing the report-controlled marker [待人工] bypasses both investment-assertion checks, regardless of what else it contains. Although this exception is explicitly intended to support human review, the checker neither requires that review nor prevents a normal PASS, allowing prohibited recommendations to pass a skill advertised as producing zero investment assertions.
- Content
The success message claims numbers were verified even when no source table was supplied.
Medium
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
Without --table, the checker skips source-dependent verification but can still return exit code 0 and print a PASS message claiming that numbers were verified against the table. The separate unverifiable notice reduces ambiguity for careful readers, but automated consumers or users relying on the success headline can mistake unverified or fabricated chart claims for validated results.
- Content
Tainted flow: 'body' from pathlib.Path.read_text (line 125, file read) → pathlib.Path.write_text (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python p = Path(a.out) try: p.parent.mkdir(parents=True, exist_ok=True) p.write_text(body, encoding='utf-8') except OSError as e: print('取值域故障：写不到 %s（%s）' % (p, e.strerror or '原因未取到')) return 3