work-estimation-en

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:24 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate project-estimation Excel report skill, with some output-safety and localization caveats users should understand.

Install only if you are comfortable with a local Excel-report generator for software estimates. Treat requirement text from untrusted parties carefully, review or sanitize generated spreadsheets before sharing/opening them, keep inputs reasonably sized, and expect Chinese report labels, China holiday assumptions, and RMB cost defaults unless you adapt the skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_estimation.py:81

Finding

Spreadsheet Formula Injection in Generated Excel Reports

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises a skill that takes requirements text or documents and automatically breaks down work items and estimates effort, then outputs Excel reports. The supplied code mainly handles the last part: formatting and exporting a rich Excel report from already structured estimation data (modules with explicit per-item analysis/design/frontend/backend/algorithm/test values). The included parse_requirements function is minimal and only detects module headings; it does not create detailed work items or derive estimates. Therefore, the primary behavior is more of an Excel report generator for precomputed estimates than a full automatic estimation skill. Additionally, the code includes significant extra functionality—cost estimation and gantt/timeline scheduling—not reflected in the description. This is a meaningful description/behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The usage example begins with 'Help me estimate this project', where 'help me' is a highly generic phrase common in everyday conversation. In a markdown skill description, this can make the activation pattern seem broader than intended because it does not clearly constrain what wording should invoke the skill or what should not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill identifier includes the suffix "-en," indicating an English-only locale constraint, but the document does not offer the user a language choice or explain why English is required. This can violate language/locale policy when a skill implicitly forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description lists several trigger phrases but then extends activation to "or similar terms," which leaves the invocation boundary unclear. In a markdown/manifest context, this is an ambiguous activation condition because it does not define what nearby phrases should or should not activate the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file-level description is entirely in Chinese and presents the skill as a general-purpose Excel estimation generator, but it does not state that the skill is intended only for Chinese-speaking users or provide any language choice. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 81% confidence

Finding

auto_width iterates every cell in every column and converts each value to a string to measure width, with no input size limits on workbook content. If an attacker supplies extremely large numbers of rows or very large cell values through requirements/modules, workbook generation can consume excessive CPU and memory, causing denial of service or severe slowdown in the skill runtime.

Content

Scanner excerpt · scripts/generate_estimation.py (reported line 90)May include surrounding context.

python

def auto_width(ws):
    for column in ws.columns:
        max_length = 0
        column_letter = get_column_letter(column[0].column)
        for cell in column:
            try:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON file contains all user-facing evaluation names, requirements, and expected dimension labels exclusively in Chinese, with no indication that language choice is optional or region-specific. Under the stated policy, natural-language content that effectively constrains the skill to a specific language without opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document is primarily written in English, but line L020 includes Chinese text ('Component封装') without explanation or an explicit language/locale choice. This can violate language consistency expectations and may confuse users who did not opt into mixed-language output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file’s natural-language strings, including the module names, descriptions, and output message, are all Chinese-only. Under the policy, forcing a specific language without user opt-in or a documented justification can be a language/locale policy violation.

Content

No source excerpt is available for this finding.