T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/settings_server.py:22- Finding
Unauthenticated Network-Accessible Settings and File Server
- Content
View full analysis
- Remediation
View remediation
Security audit
activity-duration-estimation
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent project-management tool, but it exposes under-scoped local network, file, and database capabilities that users should review before installing.
Install only if you are comfortable with a broad project-management skill that can persist project data and settings, read/import external databases when asked, and generate HTML reports. Do not run the settings server on an untrusted network, avoid untrusted template/project names, and treat generated reports as untrusted HTML until escaping and CDN integrity issues are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/project_docs_engine.py:321- Finding
Path Traversal in Template and Document File Operations
- Content
View full analysis
dict: """加载指定模板的JSON定义""" fpath = os.path.join(TEMPLATES_DIR, f"{template_name}.json") if not os.path.isfile(fpath): available = list(list_templates().keys()) raise FileNotFoundError( f"模板 '{template_name}' 不存在。可用模板: {available}" ) with open(fpath, "r", encoding="utf-8") as f: return json.load(f) ``` Document writing: ```python def save_document(content: str, template: dict, project: ProjectData) -> str: """保存文档到文件（数据目录下），返回文件路径""" filename = template.get("output_filename", "{project_name}_文档.md") filename = filename.replace("{project_name}", project.project_name or "未命名项目") # 保存到数据目录下的 docs/，不污染安装目录 script_dir = os.path.dirname(os.path.abspath(__file__)) skill_dir = os.path.dirname(script_dir) data_dir = os.path.normpath(os.path.join( skill_dir, "..", ".standardization", os.path.basename(skill_dir), "data", "docs" )) os.makedirs(data_dir, exist_ok=True) fpath = os.path.join(data_dir, filename) with open(fpath, "w", encoding="utf-8") as f: f.write(content) return fpath ``` Template writing: ```python def save_template(template_data: dict, new_name: str, overwrite: bool = False) -> str: if not new_name: raise ValueError("模板名称不能为空") fpath = os.path.join(TEMPLATES_DIR, f"{new_name}.json") if os.path.isfile(fpath) and not overwrite: raise FileExistsError( f"模板 '{new_name}' 已存在。如需覆盖请设置 overwrite=True" ) save_data = json.loads(json.dumps ...[truncated 3489 chars]- Remediation
View remediation
Path: base = base.resolve() candidate = (base / filename).resolve() if not candidate.is_relative_to(base): raise ValueError("Path escapes the permitted directory") return candidate ``` 4. Generate document filenames server-side rather than trusting `output_filename` from template data. 5. Sanitize the project name before using it in a filename, or use a generated identifier and retain the project name only as document content. 6. Separate built-in templates from user-created templates and prohibit deletion or overwrite of built-in files. 7. Use exclusive creation where overwrite is not explicitly authorized. 8. Consider atomic writes through a temporary file created inside the target directory, followed by `os.replace()`. 9. Add regression tests covering `../`, absolute paths, nested separators, symbolic links, and traversal introduced through `{project_name}` substitution. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/runner.py:608- Finding
Stored HTML and Script Injection in Generated Reports
- Content
View full analysis
str: return f""" {self.project_name or '项目'} - 活动历时估算报告 ...{self.project_name or '项目'} - 活动历时估算报告
生成时间: {datetime.now().strftime('%Y-%m-%d %H:%M')}
""" ``` Unescaped phase names and deliverables in table markup: ```python if not groups: lines.append('') for i, p in enumerate(self.phases, 1): lines.append(f"" f"" f"") lines.append('
') ``` Unescaped phase name in both attribute and element-body contexts: ```python lines.append(f'# 阶段 O M P 交付物 {i} {p.get('name','')} {p.get('o','-')} {p.get('m','-')} {p.get('p','-')} {p.get('deliverable','-')} ' f'') ``` WBS data inserted into markup without HTML encoding: ```python def _build_wbs_tree_section(self) -> str: ...[truncated 3711 chars]{t["name"]}' f'' f'' f'{dur_label}- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/templates/economic-report.html:7- Finding
Third-Party JavaScript Loaded at Report Viewing Time Without Integrity Protection
- Content
View full analysis
``` The same remote script reference appears in both economic and earned-value report templates. ### Technical Analysis The generated reports load executable JavaScript from a third-party CDN when a user opens them. Although a concrete version is specified, the script tag does not contain a Subresource Integrity hash. The browser therefore trusts whatever response the remote server provides for that URL at viewing time. This behavior conflicts with the description of the reports as self-contained. It also means the effective code executed by a report is not limited to the code reviewed inside the Skill package. The dependency introduces two security properties: 1. A compromised CDN, registry artifact, or upstream package can modify the JavaScript executed by reports. 2. Opening a report generates a network request to the CDN, disclosing viewer network metadata such as the IP address, request timing, and standard HTTP headers. No evidence was found that the project intentionally uses this dependency maliciously. The issue is the lack of integrity enforcement and the undeclared runtime trust relationship. ### Attack Path 1. The Skill generates an economic or earned-value HTML report. 2. A user opens the report while connected to the network. 3. The browser requests Chart.js from `cdn.jsdelivr.net`. 4. If the CDN response or referenced artifact has been compromised, the browser receives modified JavaScript. 5. Because no `integrity` attribute is present, the browser executes the modified content without detecting the change. 6. The remote code runs in the generated report's browser contex ...[truncated 639 chars]- Remediation
View remediation
``` 4. Confirm the integrity value from the exact reviewed artifact rather than copying an unverified value. 5. Enforce a Content Security Policy that restricts scripts and network destinations to explicitly trusted sources. 6. Document the runtime network dependency and associated metadata disclosure. 7. Prefer fully self-contained reports so that opening a report never retrieves mutable executable code. 8. Apply the same correction to both `economic-report.html` and `evm-report.html`. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (90)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
该代码块与声明只部分匹配。它确实覆盖了“活动历时估算”中的若干子能力，如CPM、支持多种分布的蒙特卡洛模拟、依赖关系处理、重叠分析和SVG图表输出。但声明中的大量核心功能在代码中完全没有体现，尤其是WBS工作分解、项目文档生成、经济效益分析、挣值管理、数据库隔离架构、以及HTML/专项报告输出。因此该代码块的实际主功能明显更窄，不能准确代表完整声明。未发现明显额外越权能力；问题主要是声明远超代码实际行为。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code is consistent with one subset of the description: EVM analysis. It clearly supports EV/PV/AC-based earned value calculations and forecasting metrics such as EAC/ETC/VAC. However, the declared description presents a much broader multifunctional skill with duration estimation, WBS planning, document generation, economic analysis, database architecture, and report output. None of those additional capabilities appear in this code chunk. Because the declared purpose substantially overstates what this supplied code actually does, the description does not accurately represent the chunk’s behavior. This is best classified as a mismatch due to materially broader declared functionality than the implemented behavior shown.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该代码块的实际职责是一个“挣值管理独立知识库接口”，核心行为是对 SQLite 数据库中的 evm_analyses 和 evm_periods 进行建表、写入、查询和索引检索，并从 shared.db 读取项目基础信息或登记技能记录。这与声明中的“挣值管理”子功能是一致的，但声明描述的是一个范围明显更大的综合技能，包含历时估算、WBS、文档生成、经济效益分析和多类报告输出，而这些能力在本代码块中均不存在。按照评估标准，如果代码的实际主要目的仅覆盖声明中的一小部分，而缺失大量核心宣称功能，则描述不能准确代表该代码块实际行为，因此应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
该代码块与声明存在明显偏差。声明强调的是项目管理分析功能本身：估算、WBS规划、文档生成、经济测算、挣值分析及报告输出；而代码主要是一个底层 schema/转换工具模块。它做了两类事：1）知识条目和项目数据的标准格式转换与校验；2）定义跨子技能注册表以及 economic/evm 的数据库表结构。虽然其中包含 WBS JSON 字段、economic/evm 表结构常量，能被视为支撑项目管理技能的数据层基础设施，但代码并未实现声明中的核心业务能力，例如三点估算算法、蒙特卡洛方法、ROI/NPV/IRR/BCR 计算、PV/EV/AC/SPI/CPI 计算、项目文档双模式生成、HTML 报告输出等。相反，它还实现了一个未在描述中体现的“知识库标准化接口”和“外部数据库映射检测”能力，这属于新增且不相关/弱相关的能力。因此应判定为描述与实际代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明描述的是一个综合型项目管理技能套件，范围覆盖估算、WBS、项目文档、经济分析、EVM 和数据库隔离架构；但本代码块仅是其中“项目文档生成”子模块。它确实支持手动空模板、逐节自动/混合组装、模板定制与保存，且能利用已有 WBS、CPM、估算摘要填充上下文，因此与“项目文档双模式生成”这部分是匹配的。然而，从该代码本身看，不包含经济效益分析、挣值管理、蒙特卡洛/三点估算计算、WBS 分解生成、数据库读写或 HTML 报告生成等关键声明能力。故若以整体声明对照此代码块，描述明显宽于实际行为，构成能力层面的不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该代码块的核心功能是“知识库存储与检索”。虽然 projects/work_packages/dependencies/task_benchmarks 这些表与项目管理场景有关，也会保存 mc_p50/mc_p90、关键路径计数等字段，但这些只是对外部已有结果的持久化，并非实现“三点估算/蒙特卡洛四种方法”、WBS 规划生成、经济分析或 EVM 分析本身。更重要的是，声明中强调的报告输出、自包含 HTML、economic.db / evm.db 三库隔离，在此代码中均未出现。相反，代码提供了 connect_external 和 import_external_knowledge，可连接任意外部 SQLite 并执行 SQL，这属于声明中未提到的额外能力。综合看，代码行为与声明的主要用途存在实质性偏差。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
该代码块的核心职责是“风险分析支持层”：基于context选择风险维度，并拼装给LLM的风险分析提示词，还能在LLM失败时生成一个简化的风险维度HTML概览。这与声明描述的主能力集合明显不一致。声明强调的是进度估算、WBS分解、项目文档生成、经济评价和挣值管理，而当前代码没有看到这些功能的实现；即使代码中引用了CPM/Monte Carlo结果，也只是将其作为风险分析提示中的输入背景，而不是执行这些分析本身。根据评估标准，这属于 materially different primary purpose 和 undeclared capability，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
描述与代码存在实质性不一致。代码确实覆盖了声明中的一部分：WBS 分解、活动历时估算（含 CPM 与多种蒙特卡洛分布）、项目文档生成、HTML 报告输出，这些与声明部分吻合。但声明中较核心的两大能力——经济效益分析和挣值管理——在该代码片段中完全没有体现：没有 ROI/NPV/IRR/BCR 计算，没有 PV/EV/AC/SPI/CPI 相关数据结构、公式或报告生成逻辑。与此同时，声明特别强调的三库隔离架构也未在代码中出现；实际仅加载 settings 并在文件系统 reports 目录写出 HTML，未见数据库访问。虽然后者可能在其他文件中实现，但就本代码块而言，声明的核心能力与资源架构均未被支撑。另一个方向上，代码还包含较强的全流程编排、依赖校验、审计与自动修复能力，这属于声明未突出说明的额外能力。综合判断，描述高估并偏离了该代码块的实际行为，应判定为 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description claims a full-featured project management and analysis skill, but this code chunk only manages persistent configuration for part of the skill. While configuration management is a legitimate supporting component, the actual code shown does not perform the declared core functions and instead has a narrower primary purpose: runtime settings storage and CLI/UI support. This is a material description-behavior mismatch for the supplied code chunk, not merely an omitted implementation detail.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个复杂的项目管理分析技能，而给定代码块仅是设置管理配套组件（settings_server）。它的主要用途是启动一个HTTP服务，向浏览器提供settings.html，并通过/api/load、/api/defaults、/api/schema、/api/save、/api/reset等端点读写设置。虽然“设置面板”可能是某个更大技能的辅助部分，但就此代码块本身而言，其行为与声明的核心能力明显不一致：没有活动历时估算、WBS分解、项目文档生成、经济效益指标计算、挣值管理、数据库分析处理或报告生成。根据评估标准，这属于主要目的 materially different 且存在未声明能力（HTTP配置服务/API暴露）的描述-行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
代码块的实际职责是“WBS 引擎”，属于声明中的一个子模块，而不是声明描述的完整多功能技能。它确实支持WBS分解、验证、编码、依赖推演和多格式导出，也保留了O/M/P三点估算字段，作为后续估算流程的输入准备。但从该代码本身看，缺少声明中的大部分核心能力：没有经济效益计算公式与流程，没有挣值指标计算，没有项目文档生成逻辑，没有数据库隔离架构实现，也没有HTML报告生成，更没有蒙特卡洛或其他活动历时估算方法的实际执行。因此，声明对该代码块所代表的能力范围有明显夸大，属于描述与行为不一致。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function exposes arbitrary SQLite file access and explicitly returns a live connection object for callers to execute raw SQL against any existing database path. In an agent skill context, this materially expands data-access capability beyond the declared purpose and can enable unauthorized reading or modification of local application data if an attacker can influence the path or downstream SQL usage.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Binding the HTTP server to 0.0.0.0 exposes the settings service on all network interfaces, making the unauthenticated configuration endpoints reachable by other hosts on the network. In combination with the save/reset APIs and permissive CORS, this enables remote configuration changes outside the expected local desktop setup flow.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises low sensitivity and omits an explicit tool scope, yet the content clearly describes code paths that read and write files and may access environment-backed configuration or external data directories. When a skill with undeclared capabilities is auto-selected, reviewers and calling agents can underestimate its authority and expose local data or permit unintended filesystem modification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description text is predominantly Chinese and frames the skill's behavior in that language, with only partial English glosses. Because the file does not explicitly offer a user language choice or state that output language follows user preference, this can violate the language/locale policy for users expecting another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language description is written entirely in Chinese while presenting the skill as a general-purpose project-management tool, and there is no indication that users may choose another language or that the locale restriction is intentional. For a broadly scoped skill, this can amount to an implicit language policy constraint without user choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is extremely broad and bundles many loosely related project-management, estimation, document-generation, economic-analysis, and EVM terms without clear activation boundaries. This can cause the skill to activate in contexts the user did not intend, leading to inappropriate interception of requests, unexpected data handling, or generation of authoritative-seeming outputs outside the skill's proper scope.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document is entirely written in Chinese and presents normative skill guidance without any indication that users may choose another language or that the skill is intentionally region-specific. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file is written entirely in Chinese, including all section headings and operational descriptions, with no indication that language is selectable or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule, natural-language instructions or documentation that effectively enforce a single language without opt-in can be a locale-policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file presents all operational guidance, trigger definitions, and API usage exclusively in Chinese. Under the natural-language policy rule, forcing a specific language without user opt-in is a policy concern unless the locale constraint is explicitly justified, which is not stated here.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire FAQ is written in Chinese and does not indicate that language selection is optional or that the skill is intentionally restricted to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The FAQ says that when O/M/P values are missing, the skill may guide the model to search for external sources or perform sourcing beyond the declared local estimation/planning/reporting scope. This creates a scope-expansion and untrusted-input risk: an agent may fetch external content unexpectedly, exposing prompts, introducing prompt-injection from search results, or violating least-privilege expectations for a planning skill.
- Content
Static analysis
No suspicious patterns detected.