T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_estimation.py:78- Finding
Spreadsheet Formula Injection Through Untrusted Requirement Data
- Content
View full analysis
- Remediation
View remediation
Security audit
work-estimation-zh
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated purpose, but its Excel generator can carry unsafe formulas from requirement text into generated spreadsheets.
Review before installing if generated spreadsheets may be opened by others or built from untrusted requirement text. Ask the publisher to escape formula-like cell values, confirm before reading local requirement files, and disclose the exact output path before writing reports.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing documentation and example invocations in this file are written in Chinese, effectively imposing a single language on users without offering an explicit language or locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README uses broad natural-language trigger phrases around common project-estimation requests, which increases the chance the skill activates on ordinary conversation without clear user intent to run this specific capability. In this skill’s context, unintended activation could lead to unnecessary processing of requirement text or local files and generation of output artifacts, making the trigger design meaningfully risky rather than purely cosmetic.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrase includes the broad term “项目评估”, which can match many ordinary conversations unrelated to software effort estimation. This can cause the skill to activate unexpectedly, leading to unintended handling of user content or workflow confusion, though the skill itself does not contain obviously harmful behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file consistently defines evaluation names, requirement text, and expected dimension labels only in Chinese, which signals a locale-specific constraint in the skill's natural-language behavior. There is no indication that users can choose another language or that the Chinese-only requirement is explicitly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring and user-facing outputs are written entirely in Chinese, indicating the skill is designed around a single language/locale. The file does not offer any user choice or document a justified region-specific constraint, which can violate language/locale policy requirements.
- Content
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 75% confidence
- Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Content
python def auto_width(ws): for column in ws.columns: max_length = 0 column_letter = get_column_letter(column[0].column) for cell in column: try:
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises reading a local requirements document from a filesystem path and generating an Excel report, but provides no warning, consent step, or explanation of what files will be accessed and where outputs will be written. In an agent environment, this can normalize silent local file access and file creation, increasing the risk of surprising data exposure, misuse of sensitive documents, or unintended writes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This guide presents all instructions and content exclusively in Chinese, with no indication that the user can select another language or that the file is intentionally limited to a Chinese-speaking context.
- Content