Security audit

SupplyFlow — 供应链管理

Security checks for vulnerabilities and agentic risk

Overview

SupplyFlow is a local Chinese-language supply-chain reporting toolkit with no network, persistence, credential use, or hidden execution, though its generated reports need normal caution around untrusted input.

Install only if a Chinese-language, local supply-chain analysis toolkit fits your workflow. Treat reports generated from supplier or procurement data you do not fully trust as untrusted Markdown, and review calculations before using them for purchasing or inventory decisions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/supplier_perf.py:109
Finding: Unescaped User-Controlled Values Permit Markdown Report Injection
Content: View full analysis
Remediation: View remediation
str: text = str(value) text = text.replace("\r", " ").replace("\n", " ") text = text.replace("\\", "\\\\") text = text.replace("|", "\\|") text = text.replace("<", "<").replace(">", ">") return text ``` 2. Apply the function to every user-controlled string before inserting it into Markdown, including names, countries, units, specifications, dates, buyer names, supplier names, and purchase-order identifiers. 3. Use stricter output-specific handling: - Remove line breaks from table-cell values. - Escape pipe characters in tables. - Disable raw HTML in the Markdown renderer. - Reject dangerous URL schemes if user-controlled links are ever supported. 4. Prefer structured JSON when passing results between software components or AI Agents. Render Markdown only at the final presentation boundary. 5. Add regression tests using values containing pipes, newlines, links, images, HTML, and instruction-like text. 6. Clearly label user-provided text as untrusted when reports are supplied to downstream AI systems. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/demand_forecast.py:93
Finding: Missing Input Range and Shape Validation Causes Crashes and Invalid Operational Results
Content: View full analysis
1 else 0 cv = (std_demand / avg_demand * 100) if avg_demand > 0 else 0 total_forecast = sum(predictions) peak = max(predictions) trough = min(predictions) ``` Because `--months` is accepted as an unrestricted integer, a value of zero or less produces an empty list and causes `max(predictions)` to raise an exception. `scripts/inventory_optimize.py:21-28, 48` accepts unrestricted numeric values and passes the lead time into a square root: ```python monthly_demand = float(it.get("monthly_demand", 0)) annual_demand = monthly_demand * 12 lead_days = float(it.get("lead_days", 7)) unit_cost = float(it.get("unit_cost", 0)) holding_rate = float(it.get("holding_rate", 0.25)) order_cost = float(it.get("order_cost", 500)) demand_std = float(it.get("demand_std", monthly_demand * 0.15)) service_level = float(it.get("service_level", 0.95)) safety_stock = z * demand_std * math.sqrt(lead_days / 30) ``` A negative `lead_days` value causes a math-domain exception. Negative, non-finite, or otherwise unrealistic values can also produce invalid inventory recommendations. `scripts/supplier_eval.py:121-123` assumes that the decoded weight value contains at least four elements: ```python i ...[truncated 3006 chars]
Remediation: View remediation
float: number = float(value) if not math.isfinite(number) or number < 0: raise ValueError(f"{field} must be a finite nonnegative number") return number ``` 4. Validate forecast duration before calculation: ```python if months < 1 or months > 120: raise ValueError("months must be between 1 and 120") ``` 5. Validate supplier weights completely: ```python if not isinstance(w, list) or len(w) != 4: raise ValueError("weights must contain exactly four numbers") weights_list = [float(value) for value in w] if any(not math.isfinite(value) or value < 0 for value in weights_list): raise ValueError("weights must be finite and nonnegative") if not math.isclose(sum(weights_list), 1.0, rel_tol=1e-9, abs_tol=1e-9): raise ValueError("weights must sum to 1") ``` 6. Set limits on input collection size and output length to prevent resource exhaustion. 7. Catch `JSONDecodeError`, `TypeError`, `ValueError`, `IndexError`, and arithmetic-domain errors at the CLI boundary. Return a concise validation message and a nonzero exit status rather than exposing an uncontrolled traceback. 8. Add tests for empty arrays, zero and negative forecast periods, negative lea ...[truncated 100 chars]

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill uses very broad general trigger terms such as "供应链", "供应链管理", and especially "supply chain", which can match many ordinary business queries and cause the skill to activate when the user did not intend to invoke it. Unintended activation can expose the model to irrelevant tool-routing, produce confusing responses, and increase the attack surface for prompt or workflow abuse through accidental invocation.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code file contains natural-language text that fixes the skill's usage and purpose description to Chinese, and later user-facing output is also entirely in Chinese. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated markdown report uses Chinese headings, labels, recommendations, and footer text with no alternative language path. This is a natural-language policy violation because the skill imposes a locale choice on all users rather than offering a documented choice or justified regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains natural-language strings that define usage and behavior exclusively in Chinese, and the generated report text is also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code file contains natural-language strings exclusively in Chinese in the module docstring and CLI descriptions, with no option for the user to select another language or any documentation that the tool is intentionally limited to a Chinese-speaking context. That creates a language/locale policy concern because the skill imposes a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains natural-language strings that effectively force a specific language/locale for usage instructions and generated reports. Under the policy, locale-specific behavior should either be optional or clearly documented as a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s natural-language interface and examples are entirely in Chinese, and the generated report strings throughout the script are fixed to Chinese labels and recommendations. There is no user opt-in, language selection, or justification that this is a region-specific tool, which conflicts with the policy against forcing a specific language or locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring and CLI description present the skill as Chinese-only, and all generated report content is hardcoded in Chinese. This is a natural-language locale policy concern because the skill imposes a specific language without any documented opt-in or alternative locale selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents all content in a single language and does not indicate that Chinese is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy rule, forcing one language without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains user-facing natural language content exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is written entirely in Chinese and does not indicate that the user may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings throughout the file, including the module docstring, argument description, and rendered report output, are exclusively in Chinese. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific; this file does neither.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains user-facing natural-language strings such as the module docstring, CLI help text, and rendered purchase-order labels entirely in Chinese. Because the skill does not offer any language or locale opt-in, it may violate a language-choice policy for general-purpose skills.
Content: No source excerpt is available for this finding.