Kai Report Creator V1.23.3 Publish

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:11 AM UTC
• Version: 1.23.3

Overview

This report-generation skill is mostly coherent, but it deserves review because generated reports can load mutable third-party browser scripts and the docs normalize sending report content to Telegram.

Before installing, treat generated HTML reports as network-active unless you verify they are bundled/offline. Avoid opening confidential reports while they load third-party CDNs, review generated HTML before sharing, and require explicit confirmation before any Telegram or other messaging send.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: templates/en/dark-tech.html:7

Finding

Generated reports execute mutable third-party JavaScript without integrity protection

Content

View full analysis

Vulnerability Details

File Location: templates/en/dark-tech.html:7-9, 963-976
Vulnerability Type: Third-party JavaScript supply-chain exposure
Risk Level: Medium

Vulnerable Code

html

<script src="https://cdn.jsdelivr.net/npm/chart.js@4/dist/chart.umd.min.js"></script>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>

javascript

/* Preload html2canvas eagerly — fires while user reads, so first export is instant */
let libPromise = null;
function loadLib() {
  if (libPromise) return libPromise;
  libPromise = new Promise(resolve => {
    if (window.html2canvas) { resolve(); return; }
    const s = document.createElement('script');
    s.src = 'https://cdn.jsdelivr.net/npm/html2canvas@1/dist/html2canvas.min.js';
    s.onload = resolve; document.head.appendChild(s);
  });
  return libPromise;
}
loadLib(); /* start loading immediately */

The same design is prescribed in references/html-shell/export.md:51, references/rendering/chart.md:7, and references/rendering/media-code-callout.md:21, and appears in multiple English and Chinese templates.

Technical Analysis

Generated reports execute JavaScript obtained from third-party CDNs. Some dependencies use mutable major-version selectors such as @1, @4, @5, and @11, and the static imports do not provide Subresource Integrity metadata. Consequently, the executable content delivered to a report can change after the Skill package has been audited.

The html2canvas dependency is loaded eagerly when the report opens rather than only after the user requests an export. This creates an external request and grants third-party code access to the report's browser context even when image export is never used.

The inspected export code does not explicitly ...[truncated 1613 chars]

Remediation

View remediation

Remediation Suggestions

1. Make bundled, locally audited dependencies the default for generated reports.
2. Pin every browser dependency to an exact reviewed version rather than a major-version selector.
3. Add integrity hashes and crossorigin="anonymous" to static CDN script and stylesheet imports when remote loading remains supported.
4. Load html2canvas only after an explicit user click on an image-export action; remove the eager loadLib() invocation.
5. Apply a restrictive Content Security Policy. In particular, constrain script-src, connect-src, img-src, and style-src to the minimum required sources.
6. Ensure bundled dependencies are obtained through a reproducible process with checksums or a lock file, and review dependency updates before release.
7. Clearly disclose that non-bundled reports contact third-party CDNs and may therefore be inappropriate for confidential or offline reports.
8. Add automated quality-gate checks that reject mutable CDN version selectors and external scripts lacking approved integrity hashes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (304)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README describes a workflow that goes beyond report generation into directly sending generated images to a Telegram channel. That introduces external data exfiltration risk: sensitive work summaries, KPIs, or internal decisions could be transmitted off-platform under the guise of a reporting action, especially if users invoke the skill assuming it is local-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Telegram example normalizes automatic external sending without an explicit warning, confirmation step, or discussion of data sensitivity. In skill ecosystems, examples strongly influence agent behavior; this could cause confidential operational summaries or business data to be exported to a third-party channel with insufficient user awareness.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a content-generation skill whose primary function is creating or refining reports and dashboards. The actual code instead performs repository documentation validation for the kai-report-creator project. Its purpose is to check whether documentation files contain specific contractual phrases and guardrails, including review-system wording and context-budget statements. While the code references review-related text in docs, it does not itself review report content or generate any output documents. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Yes, this is a mismatch. The declared description presents a full-featured report creation skill, but the provided code chunk contains only an init.py docstring for evaluation helpers. Based on the supplied code alone, the actual behavior is limited to defining a package/module placeholder and does not substantiate the declared primary purpose or capabilities. This is a materially different purpose from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a full creation/generation workflow for reports and dashboards, including multiple operational modes and output-related features. The supplied code chunk instead implements static contract checks and parsing helpers for structured content blocks. While this code could be a supporting validation component inside such a tool, on its own it does not perform the main declared functions. Therefore the description materially overstates the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes an end-user content generation skill for producing reports, dashboards, and research documents. The actual code does not implement report creation, rendering, review, theming, bundling, or export behavior. Instead, it is an internal developer utility for running automated tests. This is a materially different primary purpose, so the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose describes a content/report generation skill with multiple generation-oriented flags and document-output capabilities. The supplied code instead performs a maintenance task: finding and deleting generated Python cache files, or checking for their presence. Its primary purpose, command-line interface, and side effects are unrelated to report generation. The deletion of filesystem artifacts is an undeclared capability and the actual behavior does not implement any of the advertised features.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose is a content-generation/report-authoring skill, but the supplied code implements an evaluation-diff tool for comparing two captured-run JSON results. Its primary purpose, inputs, outputs, and flags all differ materially from the declaration. No report-generation, dashboard rendering, multilingual document creation, theme preview, review/refinement, or approved-plan ingestion is present. This is not a minor implementation detail; it is a fundamentally different utility.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description suggests an end-user content creation skill that generates reports, dashboards, or research documents and supports operational flags like --plan, --generate, --review, --from, --bundle, and --export-image. This code chunk does not implement document generation, rendering to HTML, review/refinement, ingestion from URLs/files, bundling, or export behavior. Instead, it performs internal analysis of an intermediate representation (IR): parsing frontmatter, extracting one IR block from mixed context, computing hashes, inferring themes/archetypes, choosing reference docs, and comparing snapshots. These behaviors are materially different from the declared primary purpose and indicate an internal validation/context-isolation utility rather than a report-generation skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a strong description/behavior mismatch. The declared purpose centers on creating or generating reports, dashboards, and research documents, including plan/generate/review/theme workflows. The code does none of that: it does not synthesize content, process notes/data/URLs into a report, create dashboards, review text, or render HTML from source material. Instead, its sole purpose is exporting an already-finished HTML report into image files for desktop/mobile/IM use. That is not just an omitted detail; the description explicitly states that exporting finished HTML to PPTX/PNG should be handled by a different skill (kai-html-export). Therefore the code implements a materially different and explicitly excluded capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk does not implement the declared primary purpose of creating or generating reports, dashboards, summaries, or research documents. Instead, it performs pre-generation validation of an intermediate representation (IR) file. This is a materially different function: quality/control gating rather than content generation/rendering. While validation could be a supporting internal component of a report-generation skill, the supplied description focuses on user-facing creation/generation actions and flags (--plan, --generate, --review, --themes, etc.) and does not mention a guard validator that checks IR structure, required frontmatter, block validity, and report classification. There are no suspicious extra permissions or unrelated external resource accesses, but the actual behavior is substantially narrower and different from the declared capability, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a user-facing creation/generation skill with multiple authoring and export-related modes. The supplied code instead performs post-generation validation of HTML report output. Its primary purpose is checking structural markers, theme integrity, and KPI values in existing HTML, not creating or rendering reports. While this may support a broader report pipeline, this specific code chunk materially differs from the declared purpose and omits the headline capabilities in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill creates or generates reports, business summaries, dashboards, and research documents, with generation-oriented flags and explicit exclusions around PPTX/PNG export and slide creation. The actual code does none of that. It is a test/evaluation utility for 'late-context isolation evals': it loads a manifest, reads repo files, builds expected/isolated/baseline snapshots, compares drift fields, measures extraction time, and prints or writes evaluation summaries. This is a materially different primary purpose with unrelated inputs, outputs, and CLI interface. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an end-user content creation skill for producing reports and dashboards. The supplied code instead runs lightweight evals over preexisting repo-contained cases. It validates frontmatter, IR structure, and HTML shell markers, then prints or writes evaluation summaries and rubric packets. This is a materially different primary purpose: QA/testing of report artifacts rather than report generation. The discrepancy is substantial enough to be a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill should be used to create or generate reports, dashboards, business summaries, and research documents, including planning, HTML rendering, review, theme previews, bundling, and related report-generation flags. The actual code chunk does not implement report creation functionality for end users. Its primary purpose is to evaluate another skill (kai-report-creator) by reading test manifests and traces, optionally launching a live Codex run, detecting evidence of expected report-generation flow, checking HTML artifacts and style rubrics, and computing scores across outcome/process/style/efficiency. This is a materially different purpose, not just an implementation detail. Although the code references HTML reports and the report-creator skill, it acts as QA/test infrastructure rather than the generator described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a content-generation skill focused on creating reports, dashboards, and research documents. The supplied code does not generate reports or dashboards for end users. Instead, it acts as a developer/release engineering utility that orchestrates verification steps across a repository using subprocess calls. While one sub-step references report evals and another does an image export smoke check on an HTML fixture, these are test/validation activities, not the primary user-facing generation capabilities described. Therefore the code's primary purpose is materially different from the declared purpose, and it exposes several undeclared capabilities related to repository testing and release verification.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code chunk does not implement the declared report creation/generation workflow. Instead, it defines shared test fixtures: dynamically imports scripts/export-image.py, conditionally launches a Playwright Chromium browser, creates pages, and opens a local minimal_report.html fixture. That behavior is materially different from the declared primary purpose of creating/generating reports from user inputs. The strongest mismatch is that the code centers on export-image testing, while the description explicitly states exporting finished HTML to PPTX/PNG is out of scope for this skill and handled by a different skill. Although test scaffolding can be a supporting detail, here the visible functionality is specifically tied to an excluded capability, so this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a user-facing content generation skill for creating reports, dashboards, and research documents. The actual code chunk does not generate, plan, review, theme, or export reports. Instead, it is a test module for validating that an existing HTML report conforms to chart rendering and structural regression requirements. This is a materially different primary purpose: QA/testing of generated output versus document generation. No dangerous extra permissions are evident, but the behavior is clearly outside the declared scope, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk’s primary purpose is automated front-end regression/contract testing of a color system, not report or dashboard creation. It opens a local fixture HTML page and asserts palette signatures for badges and KPI cards. None of the declared generation features (--plan, --generate, --review, --themes, --from, --bundle, --export-image) are implemented or evidenced here. The behavior is materially different from the declared description, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an end-user skill for generating reports and dashboards in Chinese/English, including multiple generation and export-related modes. The actual code chunk does not implement any of those capabilities. Instead, it is a unit/integration test module focused on verifying static text and styling conventions across CSS, markdown references, shell templates, and demo HTML pages. This is a materially different primary purpose: QA/testing for a color/theme system rather than report creation. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code does not implement or expose the declared report-generation functionality. Instead, it is a unit test module for internal context-isolation logic, focused on parsing IR blocks from text fixtures and ensuring noisy context does not alter derived snapshots. That is a materially different primary purpose from generating reports, dashboards, or research documents. While such testing could support a larger reporting system, this specific code chunk’s behavior is unrelated to the declared end-user skill capabilities, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes an end-user content creation skill focused on generating reports and related artifacts. The actual code does not generate reports, dashboards, HTML, themes, or exports. Instead, it is test infrastructure for verifying that repository documentation stays in sync with a skill contract, including detecting drift across SKILL.md, README files, and a checklist reference. This is a materially different primary purpose, with different resources and behaviors (filesystem manipulation and subprocess invocation for test validation) than the declared report-generation functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is an end-user content generation skill for creating business reports, dashboards, and research documents with generation/review/theme/export-related flags. The actual code chunk does not implement any report creation workflow. Instead, it is a test file for an evaluation contract: it checks repository files, parses CSV/JSON schema artifacts, and executes a repo-local evaluation script to verify report-case test outputs. This is a materially different primary purpose and includes undeclared capabilities related to internal testing/evaluation infrastructure rather than user-facing report generation. Therefore, the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch. The declared description is for creating/generating reports, dashboards, business summaries, and research documents. It explicitly states that exporting finished HTML to PPTX/PNG is out of scope and should use a different skill. However, the actual code is focused on testing an export-image utility: screenshot resolution, PNG/JPEG output modes, mobile/IM target widths, and hiding export UI before taking screenshots. That is not supporting logic for report generation itself; it belongs to the explicitly excluded export-image domain. Therefore the code chunk’s primary purpose materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This is a clear description-behavior mismatch. The declared description presents an end-user skill for creating and rendering reports and dashboards in Chinese/English, with multiple generation-related modes and export options. The actual code chunk is a test module (tests/test_guard_integration.py) focused on regression tests for a validation guard. It checks that validate_ir_text and resolve_report_class behave correctly, that the CLI reads a file and outputs JSON, that validator logic is reused from contract_checks, and that missing titles are treated as fatal. These are internal testing/validation behaviors, not report creation features. While validation could be a supporting component of a report generator, this specific code chunk’s primary function is unrelated to the declared skill behavior and omits the core advertised capabilities.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:18

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_skill_eval_runner.py:19