Security audit

仓配网络优化器

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local logistics optimization skill, with normal file outputs and no evidence of hidden execution, exfiltration, persistence, or privilege escalation.

Install and run this only in a normal project or virtual environment, and use trusted or reviewed Excel/JSON inputs. Be especially careful opening generated .xlsx reports from data supplied by other parties, because formula-like values may be preserved in the report.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: run_optimization.py:308
Finding: Spreadsheet Formula Injection in Generated Excel Reports
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:94
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
pandas== openpyxl== ``` 2. Generate and verify package hashes, then install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a dependency-locking tool such as `pip-tools`, Poetry, or an equivalent mechanism to lock transitive dependencies. 4. Review and update locked versions on a controlled schedule. 5. Run automated vulnerability and provenance checks against the lock file. 6. Recommend installation inside an isolated virtual environment rather than a system-wide Python environment. 7. Avoid adding untrusted package indexes or dependency links unless their provenance and integrity are independently verified. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 该代码块的核心功能是数据预处理与格式转换，而非声明中的“仓配网络优化系统”。它使用 pandas/openpyxl 读取Excel，包含时效单位检测、字段映射、发运星期解析、区域与仓库名称整理，并将结果输出为 trunk_lines.json 和 distribution_cycles.json。虽然处理了‘时效’和区县/区域级别字段，但仅是数据清洗与标准化，不是优化系统本身，也没有MILP建模、求解器调用、目标函数/约束、路径选择、中转策略或等待时间算法。因此声明与实际行为存在实质性不符。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains its primary docstring, usage instructions, and operational notices entirely in Chinese. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This manifest-style JSON stores warehouse names and transport descriptors entirely in Chinese, such as "合肥仓", "南京仓", "单程", and "调拨", with no accompanying indication that the skill is China-specific or that users can opt into this locale. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file documents commands that generate JSON files from Excel inputs and later produce an Excel result file, but it does not explicitly warn users that new files will be created in the working directory. For a data-processing skill handling business datasets, a brief disclosure about generated artifacts would better inform users about filesystem changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON file contains all operational values in Chinese place names and region labels throughout the dataset, which effectively fixes the skill content to a single language/locale. There is no accompanying natural-language note in the file indicating user choice, multilingual support, or a justified region-only constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing natural-language text entirely in Chinese in the module docstring and usage description. The skill does not indicate that language is configurable or limited to a justified region-specific context, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The argparse description and help strings are user-visible natural-language content and are fixed to a single language. Because the file provides no language selection or explicit locale scoping, this is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.