蜀宁 OA 工时管理

• Outcome: Review
• Latest audit: May 28, 2026 · 6:01 AM UTC
• Version: 1.4.3

Overview

This OA timesheet helper is purpose-aligned, but it can log in with stored credentials and change or delete business records without strong confirmation or secret-handling safeguards.

Install only if you trust the publisher and need an agent to operate your OA account. Use encrypted credentials, protect OA_ENC_KEY and any local key cache, avoid saving printed tokens, verify the base URL, and require explicit confirmation before submit, update, batch, or delete actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

eval() call detected

High

• Category: Dangerous Code Execution

Content

if not expr:
            return None
        try:
            return str(int(eval(expr)))
        except Exception:
            pass
        expr = expr.rstrip("+-*/")

• Confidence: 98% confidence
• Finding: The code calls eval() on OCR-derived text from a remotely supplied captcha image. Although the regex restricts characters to digits and arithmetic operators, eval still executes Python expressions and can be abused for denial of service via expensive arithmetic or edge-case expression evaluation; using eval on untrusted input is unsafe by design.

eval() call detected

High

• Category: Dangerous Code Execution

Content

pass
        expr = expr.rstrip("+-*/")
        try:
            return str(int(eval(expr)))
        except Exception:
            return None

• Confidence: 98% confidence
• Finding: This is a second eval() on the same untrusted OCR-derived expression after trimming trailing operators. The same risk applies: untrusted server-controlled input reaches Python expression evaluation, creating an avoidable attack surface and potential resource exhaustion vector.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

if _has_modules(candidate, required_modules):
            new_env = os.environ.copy()
            new_env[ENV_GUARD] = "1"
            os.execve(candidate, [candidate, *sys.argv], new_env)

    missing = ", ".join(required_modules)
    raise RuntimeError(

• Confidence: 79% confidence
• Finding: The code re-executes the current process with a different Python interpreter chosen from environment-controlled and workspace-controlled paths. If an attacker can influence SN_WORK_RECORD_PYTHON, PATH resolution, or place a malicious binary in one of the searched virtualenv locations, they can cause arbitrary code execution under the agent's privileges.

Tainted flow: 'key' from os.environ.get (line 47, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

key = f.read().strip()
    if not key:
        raise ValueError(f"找不到解密密钥（环境变量 OA_ENC_KEY 或 {key_file}）")
    result = subprocess.run(
        ["openssl", "aes-256-cbc", "-d", "-a", "-pbkdf2", "-pass", f"pass:{key}", "-in", enc_path],
        capture_output=True,
        timeout=10,

• Confidence: 84% confidence
• Finding: The environment-derived decryption key is forwarded into an external process as a command-line argument. While this is not code execution because shell parsing is not used, it can leak sensitive credentials to local users or monitoring tools that can inspect process arguments, weakening protection of stored credentials.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The natural-language examples are broad enough that an agent could activate this skill from ordinary conversation such as '今天填了工时' or '查一下今天的工时状态' without a strong confirmation boundary. Because the skill can submit, modify, and delete OA work records, ambiguous triggering can lead to unintended actions against a live enterprise system.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes a deletion path ('--delete') but does not present a prominent warning or confirmation requirement about its destructive effect. In an agent setting, this increases the chance of accidental or misunderstood deletion of work records, especially when combined with broad trigger phrasing and hidden internal IDs.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The credential instructions tell users to store account and password data in a local markdown file, with encryption only described as supported rather than required, and without strong handling warnings. This creates a realistic risk of plaintext credential exposure, accidental check-in, improper file permissions, or weak operational practices around enterprise OA access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly supports storing account credentials in a plaintext Markdown file, including username, password, and base URL, without a strong warning or secure-default guidance. In an agent/workspace setting, plaintext secrets are easily exposed through accidental commits, logs, backups, other tools reading the workspace, or local compromise, which can lead to unauthorized access to the OA system.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/oa_utils.py:126