SupplyFlow — 供应链管理

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

SupplyFlow is a local Chinese-language supply-chain reporting toolkit with no network, persistence, credential use, or hidden execution, though its generated reports need normal caution around untrusted input.

Install only if a Chinese-language, local supply-chain analysis toolkit fits your workflow. Treat reports generated from supplier or procurement data you do not fully trust as untrusted Markdown, and review calculations before using them for purchasing or inventory decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/supplier_perf.py:109
• Finding: Unescaped User-Controlled Values Permit Markdown Report Injection<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/inventory_tracker.py:25, 32-34, 70, 78-79` - `scripts/supplier_eval.py:27, 86, 94` - `scripts/purchase_order.py:35-38, 63-66, 76-77` - `scripts/demand_forecast.py:58, 147-148` - `scripts/cost_optimize.py:29, 138, 152` - `scripts/inventory_optimize.py:20, 109, 120` - `scripts/supply_risk.py:30-31, 153, 165, 175` - `scripts/supplier_perf.py:19, 109-115, 124, 142` **Vulnerability Type**: Untrusted Markdown content injection **Risk Level**: Medium **Classification**: T09: Insecure Skill Coding Practices ### Vulnerable Code A representative vulnerable output path appears in `scripts/supplier_perf.py:109-115`: ```python for i, s in enumerate(data["suppliers"], 1): medal = {1: "🥇", 2: "🥈", 3: "🥉"}.get(i, f" {i}") lines.append( f"| {medal} | {s['name']} | {s['otd']}% | {s['defect']}% " f"| {s['response_h']}h | ¥{s['quarterly_spend']:,.0f} " f"| {s['total']} | {s['grade']} | {s['trend']} |" ) ``` The same pattern is used throughout the project. For example, `scripts/purchase_order.py:63-66` directly places user-controlled purchase-order fields into a Markdown table: ```python f"| **订单编号** | {po['po_no']} |", f"| **日期** | {po['date']} |", f"| **供应商** | {po['supplier']} |", f"| **采购方** | {po['buyer']} |", ``` ### Technical Analysis The scripts accept free-text fields from command-line arguments or JSON input and interpolate those values directly into Markdown reports. No output-encoding or normalization is applied before values are inserted into table cells, headings, bold text, or list entries. An attacker-controlled value can contain: - Pipe characters that create additional Markdown table cells. - Newline characters that terminate the current row and create arbitrary sections. - Markdown links or images that display deceptive links or request remote resources in permissive renderers. - Raw HTML interpreted by renderers that allow HTML. - Instruction-like ...[truncated 1960 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Introduce a centralized Markdown-escaping function for all untrusted text: ```python def escape_markdown_cell(value: object) -> str: text = str(value) text = text.replace("\r", " ").replace("\n", " ") text = text.replace("\\", "\\\\") text = text.replace("|", "\\|") text = text.replace("<", "&lt;").replace(">", "&gt;") return text ``` 2. Apply the function to every user-controlled string before inserting it into Markdown, including names, countries, units, specifications, dates, buyer names, supplier names, and purchase-order identifiers. 3. Use stricter output-specific handling: - Remove line breaks from table-cell values. - Escape pipe characters in tables. - Disable raw HTML in the Markdown renderer. - Reject dangerous URL schemes if user-controlled links are ever supported. 4. Prefer structured JSON when passing results between software components or AI Agents. Render Markdown only at the final presentation boundary. 5. Add regression tests using values containing pipes, newlines, links, images, HTML, and instruction-like text. 6. Clearly label user-provided text as untrusted when reports are supplied to downstream AI systems. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/demand_forecast.py:93
• Finding: Missing Input Range and Shape Validation Causes Crashes and Invalid Operational Results<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/demand_forecast.py:57, 93-104, 158, 195-202` - `scripts/inventory_optimize.py:21-28, 48, 137-138` - `scripts/supplier_eval.py:121-123` - `scripts/cost_optimize.py:65-71, 171-173` **Vulnerability Type**: Improper input validation and local denial of service **Risk Level**: Low **Classification**: T09: Insecure Skill Coding Practices ### Vulnerable Code `scripts/demand_forecast.py:93-104` assumes that at least one prediction will be generated: ```python predictions = [] for i in range(1, months + 1): pred = max(0, round(base + monthly_rate * i)) predictions.append(pred) # Stats avg_demand = sum(demands) / len(demands) std_demand = math.sqrt(sum((d - avg_demand) ** 2 for d in demands) / len(demands)) if len(demands) > 1 else 0 cv = (std_demand / avg_demand * 100) if avg_demand > 0 else 0 total_forecast = sum(predictions) peak = max(predictions) trough = min(predictions) ``` Because `--months` is accepted as an unrestricted integer, a value of zero or less produces an empty list and causes `max(predictions)` to raise an exception. `scripts/inventory_optimize.py:21-28, 48` accepts unrestricted numeric values and passes the lead time into a square root: ```python monthly_demand = float(it.get("monthly_demand", 0)) annual_demand = monthly_demand * 12 lead_days = float(it.get("lead_days", 7)) unit_cost = float(it.get("unit_cost", 0)) holding_rate = float(it.get("holding_rate", 0.25)) order_cost = float(it.get("order_cost", 500)) demand_std = float(it.get("demand_std", monthly_demand * 0.15)) service_level = float(it.get("service_level", 0.95)) safety_stock = z * demand_std * math.sqrt(lead_days / 30) ``` A negative `lead_days` value causes a math-domain exception. Negative, non-finite, or otherwise unrealistic values can also produce invalid inventory recommendations. `scripts/supplier_eval.py:121-123` assumes that the decoded weight value contains at least four elements: ```python i ...[truncated 3006 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate top-level JSON types before processing: - Require arrays where item or supplier lists are expected. - Require objects for structured data inputs. - Require each array entry to be an object with permitted fields. 2. Enforce explicit numeric ranges: - `months`: positive integer with a reasonable upper limit. - `lead_days`, demand, quantity, cost, spend, defect rate, and response time: finite and nonnegative. - `alpha`: finite and within the intended smoothing interval, normally zero through one. - `service_level`: finite and within a documented valid range. - Scores: constrained to their documented scoring scales. 3. Reject non-finite numbers: ```python import math def finite_nonnegative(value: object, field: str) -> float: number = float(value) if not math.isfinite(number) or number < 0: raise ValueError(f"{field} must be a finite nonnegative number") return number ``` 4. Validate forecast duration before calculation: ```python if months < 1 or months > 120: raise ValueError("months must be between 1 and 120") ``` 5. Validate supplier weights completely: ```python if not isinstance(w, list) or len(w) != 4: raise ValueError("weights must contain exactly four numbers") weights_list = [float(value) for value in w] if any(not math.isfinite(value) or value < 0 for value in weights_list): raise ValueError("weights must be finite and nonnegative") if not math.isclose(sum(weights_list), 1.0, rel_tol=1e-9, abs_tol=1e-9): raise ValueError("weights must sum to 1") ``` 6. Set limits on input collection size and output length to prevent resource exhaustion. 7. Catch `JSONDecodeError`, `TypeError`, `ValueError`, `IndexError`, and arithmetic-domain errors at the CLI boundary. Return a concise validation message and a nonzero exit status rather than exposing an uncontrolled traceback. 8. Add tests for empty arrays, zero and negative forecast periods, negative lea ...[truncated 100 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill uses very broad general trigger terms such as "供应链", "供应链管理", and especially "supply chain", which can match many ordinary business queries and cause the skill to activate when the user did not intend to invoke it. Unintended activation can expose the model to irrelevant tool-routing, produce confusing responses, and increase the attack surface for prompt or workflow abuse through accidental invocation.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains natural-language text that fixes the skill's usage and purpose description to Chinese, and later user-facing output is also entirely in Chinese. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the locale constraint is explicitly justified.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The generated markdown report uses Chinese headings, labels, recommendations, and footer text with no alternative language path. This is a natural-language policy violation because the skill imposes a locale choice on all users rather than offering a documented choice or justified regional scope.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code file contains natural-language strings that define usage and behavior exclusively in Chinese, and the generated report text is also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains natural-language strings exclusively in Chinese in the module docstring and CLI descriptions, with no option for the user to select another language or any documentation that the tool is intentionally limited to a Chinese-speaking context. That creates a language/locale policy concern because the skill imposes a specific language without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This code file contains natural-language strings that effectively force a specific language/locale for usage instructions and generated reports. Under the policy, locale-specific behavior should either be optional or clearly documented as a justified regional constraint.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s natural-language interface and examples are entirely in Chinese, and the generated report strings throughout the script are fixed to Chinese labels and recommendations. There is no user opt-in, language selection, or justification that this is a region-specific tool, which conflicts with the policy against forcing a specific language or locale.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The module docstring and CLI description present the skill as Chinese-only, and all generated report content is hardcoded in Chinese. This is a natural-language locale policy concern because the skill imposes a specific language without any documented opt-in or alternative locale selection.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This markdown file presents all content in a single language and does not indicate that Chinese is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy rule, forcing one language without opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This markdown file contains user-facing natural language content exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file is written entirely in Chinese and does not indicate that the user may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: Natural-language strings throughout the file, including the module docstring, argument description, and rendered report output, are exclusively in Chinese. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific; this file does neither.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This code file contains user-facing natural-language strings such as the module docstring, CLI help text, and rendered purchase-order labels entirely in Chinese. Because the skill does not offer any language or locale opt-in, it may violate a language-choice policy for general-purpose skills.

Static analysis

No suspicious patterns detected.