Security audit

LocalDataAI

Security checks for vulnerabilities and agentic risk

Overview

The skill’s local document-AI purpose is coherent, but its security, sandboxing, offline, and audit claims are materially stronger than what the code actually enforces.

Review this skill before installing in any sensitive environment. Treat the sandbox and compliance features as incomplete application code, not as real isolation or certified audit controls. Use a disposable virtual environment, pin and verify dependencies/models, restrict file access, and avoid processing highly sensitive documents until sandbox path validation, output handling, audit-key management, and documentation gaps are fixed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/sandbox.py:35
Finding: Arbitrary Filesystem Deletion Through an Unvalidated Sandbox Identifier
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/sandbox.py:154
Finding: Path Traversal in Sandbox Output Operations Allows Arbitrary File Read and Write
Content: View full analysis
Optional[str]: output_path = self.output_dir / output_filename if not output_path.exists(): return None with open(output_path, 'r', encoding='utf-8') as f: return f.read() def write_output(self, filename: str, content: str): output_path = self.output_dir / filename with open(output_path, 'w', encoding='utf-8') as f: f.write(content) ``` ### Technical Analysis Both methods construct paths from caller-controlled filenames without validation or containment enforcement. Values containing `../` can traverse outside `self.output_dir`. Absolute filenames cause `pathlib` to ignore the intended output directory entirely. `read_output()` therefore provides a local file-read primitive for text files accessible to the process. `write_output()` opens the resolved target in write mode, allowing existing files to be truncated and replaced or new files to be created. The methods are presented as sandbox-restricted output operations, but they do not establish any actual boundary around the output directory. ### Attack Path #### Arbitrary File Read 1. Start a `SecureSandbox`. 2. Call `read_output()` with traversal components or an absolute path. 3. The path resolves outside the sandbox output directory. 4. If the target exists and is readable as UTF-8 text, its contents are returned to the caller. #### Arbitrary File Write 1. Start a `SecureSandbox`. 2. Call `write_output()` with traversal components or an absolute target path. 3. The path resolves outside the sandbox. 4. Python opens the target in `w` mode. 5. The target is created or truncated and replaced with attacker-controlled content. ### Impact Assessment An attacker can access files within the privile ...[truncated 567 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/sandbox.py:20
Finding: Security Sandbox Configuration Does Not Enforce Filesystem, Network, or Resource Isolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/compliance_logger.py:44
Finding: Hardcoded Audit Encryption Password and Non-Persistent Key Derivation Make Historical Logs Unrecoverable
Content: View full analysis
bytes: password = b"local_data_ai_secret_key" salt = os.urandom(16) kdf = PBKDF2HMAC( algorithm=hashes.SHA256(), length=32, salt=salt, iterations=100000, ) key = base64.urlsafe_b64encode(kdf.derive(password)) return key ``` ### Technical Analysis The encryption key is derived from a password embedded directly in source code. This value is public to anyone with access to the package and cannot serve as confidential secret material. A fresh random salt is generated whenever a logger is constructed without an explicit key. Neither the salt nor the resulting key is persisted. Consequently, each process restart or new `ComplianceLogger` instance derives a different Fernet key. Existing log entries were encrypted under the previous key and cannot be decrypted with the newly generated key. Historical integrity verification also fails because verification first requires successful decryption. Although the random salt prevents straightforward reconstruction from the hardcoded password alone, the absence of durable key storage destroys audit-log availability across logger lifecycles. ### Attack Path 1. The application creates `ComplianceLogger` without supplying `encry ...[truncated 974 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned and Unverified Dependency Installation Creates Supply-Chain Exposure
Content: View full analysis
=2.0.0 transformers>=4.35.0 sentence-transformers>=2.2.2 unstructured[all-docs]>=0.11.0 pymupdf>=1.23.0 pdfplumber>=0.10.0 python-docx>=0.8.11 openpyxl>=3.1.0 pandas>=2.0.0 paddlepaddle-gpu>=2.5.0; sys_platform != "darwin" paddlepaddle>=2.5.0; sys_platform == "darwin" paddleocr>=2.7.0 easyocr>=1.7.0 chromadb>=0.4.0 faiss-cpu>=1.7.4 langchain>=0.1.0 langchain-community>=0.0.10 jinja2>=3.1.0 pyyaml>=6.0.1 chardet>=5.2.0 charset-normalizer>=3.3.0 pillow>=10.0.0 opencv-python>=4.8.0 cryptography>=41.0.0 pycryptodome>=3.19.0 tqdm>=4.66.0 requests>=2.31.0 numpy>=1.24.0 pytest>=7.4.0 pytest-cov>=4.1.0 ``` ### Technical Analysis All dependencies are declared with open-ended minimum versions. No lock file, package hashes, or approved package index is specified. As a result, the same installation command can resolve to different direct and transitive package versions over time. The dependency set is extensive and includes packages with native components, optional extras, model frameworks, parsers, and installation-time behavior. The use of `unstructured[all-docs]` further expands the transitive dependency graph. This does not demonstrate that any listed package is currently malicious. The risk arises because future releases or compromised upstream artifacts can be selected automatically without a project review or integrity check. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` command. 2. The resolver queries the configured public or organizational package index. 3. It selects the newest ve ...[truncated 980 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (95)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A skill presented as local private AI file processing appears to include generic retry/fallback orchestration and cross-skill import behavior via filesystem path and sys.path modification. Hidden orchestration or dynamic module-loading behavior expands the attack surface and may execute code outside the user's expected trust boundary.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A skill presented as local private AI file processing appears to include generic retry/fallback orchestration and cross-skill import behavior via filesystem path and sys.path modification. Hidden orchestration or dynamic module-loading behavior expands the attack surface and may execute code outside the user's expected trust boundary.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A skill presented as local private AI file processing appears to include generic retry/fallback orchestration and cross-skill import behavior via filesystem path and sys.path modification. Hidden orchestration or dynamic module-loading behavior expands the attack surface and may execute code outside the user's expected trust boundary.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A skill presented as local private AI file processing appears to include generic retry/fallback orchestration and cross-skill import behavior via filesystem path and sys.path modification. Hidden orchestration or dynamic module-loading behavior expands the attack surface and may execute code outside the user's expected trust boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README title and description are entirely in Chinese and repeatedly position the tool around domestic Chinese environments and formats, but do not state that this locale restriction is optional or region-specific by design. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file includes an example that processes a directory and writes outputs to ./处理结果/, which is a file-system affecting operation. The surrounding documentation does not warn users that running the batch workflow will create or modify local output files or advise them to verify the target directory before use.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises code-related capabilities and installation steps that imply file and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may grant broader access than users expect, especially for a skill claiming privacy-sensitive local document processing.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Claiming fully offline/local-only operation while requiring a model download is misleading for users operating in air-gapped, regulated, or privacy-sensitive contexts. The danger is not just inconsistency: users may approve installation believing there will be no network egress, undermining compliance assumptions and deployment controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Automatic model download is a network transfer with supply-chain and policy implications, yet the installation instructions do not warn users about external connectivity. In a skill handling sensitive local files, undisclosed downloads materially increase risk because they can violate environment restrictions or fetch unverified artifacts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This config hard-codes OCR language handling to simplified Chinese and English only via the language setting. For a general parser configuration, that is a natural-language/locale policy concern because it constrains language processing without any visible opt-in or documented region-specific justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This manifest/config file is written entirely in Chinese comments and includes China-specific compliance settings such as 等保 2.0, 个保法, and 数据安全法, with no natural-language indication that the skill is limited to a China-specific deployment or that users can choose another locale/compliance regime. Under the policy, forcing a specific language or locale context without opt-in or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings throughout the file, including the module description, docstrings, prompts, and console output, force a specific language without any opt-in or alternative. This can violate language/locale policy when users are not given a choice or when no region-specific justification is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code exports an audit report containing user and activity metadata and only prints a generic success message, without warning that a potentially sensitive artifact is being written to disk. In a tool marketed for private/local processing of sensitive documents, silent report generation increases the risk of unintended disclosure through leftover files, broad filesystem access, or later collection by backup/sync tools.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module claims logs are 'tamper-proof', but the implementation only encrypts entries in locally writable files and even includes automated deletion logic. This can create a false sense of evidentiary integrity: an attacker or insider with filesystem access can delete, replace, or rewrite logs, undermining forensic trust and compliance assurances.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The logger automatically invokes _cleanup_old_logs() during initialization, and that routine deletes files with log_file.unlink() based on retention age. Although there is a brief print after deletion, there is no prior warning, confirmation, or prominent disclosure at initialization that constructing the logger may immediately remove existing audit files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Audit reports include detailed operational records and are exported as plaintext JSON/XLSX files into the local log directory without encryption or access-control hardening. In this skill context, the product handles private local documents, so exported reports may expose sensitive filenames, user identifiers, metadata, and errors to any local user or malware that can read those files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring for _export_pdf says it exports a PDF report, and export_audit_report advertises format: 导出格式 (pdf/excel/json). However, the implementation explicitly returns _export_json(...), so a caller requesting PDF does not receive a PDF at all. This is an active contradiction between the documented intent and runtime behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring is written entirely in Chinese, and the script presents itself as a general-purpose model download tool rather than a region-specific or Chinese-only skill. This imposes a specific language on users without opt-in or justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Multiple docstrings and printed messages shown to the user are exclusively in Chinese, including the tool banner, status updates, and usage instructions. Because the file does not offer a language/locale choice or justify a locale restriction, this is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The top-level docstring presents the skill entirely in Chinese and describes support for domestic mainstream formats, which imposes a specific language/locale presentation on users without any opt-in or alternative. Under the policy, language constraints should either offer user choice or be explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Natural-language text in the module docstrings and status messages is presented only in Chinese, with no indication that users can choose another language. This creates a language/locale policy concern because the skill effectively forces one language without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The class docstring advertises '断点续传、崩溃恢复', but in _process_large_file the code calls _load_checkpoint at L141 before self.checkpoint_file is set at L157. Since _load_checkpoint immediately returns None when self.checkpoint_file is unset, the documented resume/crash-recovery behavior contradicts the actual control flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The PDF chunking path writes temporary files containing user document content to disk using predictable filenames derived from the original path. Even in a local-only skill, this can expose sensitive data through leftover temp files after crashes, concurrent access by other local users/processes, or symlink/path-manipulation issues in shared directories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Excel sheet processing writes user data to a predictable temporary .xlsx path based on the source filename and sheet name. This creates local data-exposure risk similar to the PDF path and may also allow filename collisions or failures when sheet names contain problematic characters for filesystem paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The summarization prompt explicitly instructs the model in Chinese, and similar Chinese-only prompts/docstrings appear throughout the file, which makes the skill operate in a fixed language. The file does not offer any user opt-in, language selection, or justification that this is a region-specific tool, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.