Security audit

Chart Generator Zc

Security checks for vulnerabilities and agentic risk

Overview

This chart skill is mostly purpose-aligned, but its generated HTML/SVG can include unescaped user-provided text, which could make shared chart files unsafe to open.

Review before installing if you expect to process untrusted chart labels, CSV data, or titles. Avoid opening or publishing generated HTML/SVG from untrusted input until the skill escapes markup safely, and be aware that one included script can keep local chart history under your user data directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

Location: scripts/chart.sh:1001
Finding: Unconditional Third-Party Promotion Alters Skill Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/chart.sh:123
Finding: Stored HTML and SVG Markup Injection Through Unescaped Chart Metadata
Content: View full analysis
'.format(svg_w, svg_h, svg_w, svg_h)) parts.append('') # Title parts.append('{}'.format(svg_w/2, title)) # Y-axis ticks num_ticks = 5 for i in range(num_ticks + 1): val = max_val * i / num_ticks y = margin_top + chart_h - (chart_h * i / num_ticks) val_str = str(int(val)) if val == int(val) else "{:.1f}".format(val) parts.append(''.format(margin_left, y, margin_left + chart_w, y)) parts.append('{}'.format(margin_left - 8, y + 4, val_str)) # Y-axis line parts.append(''.format(margin_left, margin_top, margin_left, margin_top + chart_h)) # X-axis line parts.append(''.format(margin_left, margin_top + chart_h, margin_left + chart_w, margin_top + chart_h)) # Bars for i, (label, val) in enumerate(pairs): x = margin_left + gap + i * (bar_w + gap) bar_h = (val / max_val * chart_h) if max_val > 0 else 0 y = margin_top + chart_h - bar_h color = colors[i] val_str = str(int(val)) i ...[truncated 6809 chars]
Remediation: View remediation
`, `&`, quotes, closing tags, event-handler syntax, and external-resource elements. Verify that the values are rendered as literal text rather than parsed as markup. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose materially understates and misstates behavior, including persistent local writes and undeclared data import capabilities. Security reviews rely on accurate manifests; when behavior exceeds the declared scope, users may authorize a harmless-looking chart tool that actually touches local files or processes unexpected inputs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill advertises executable behavior that can write files, but the manifest does not declare any tool scope or permissions. In an agent environment, this weakens reviewability and consent boundaries because users and orchestrators cannot easily see that persistent filesystem effects may occur.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description limits the skill to a 'Data visualization tool producing SVG charts', which implies SVG chart generation as the core behavior. However, the file documents substantial non-SVG functionality including ASCII charts, HTML files, formatted tables, sparklines, dashboards, progress bars, trend analysis, and heatmaps, indicating broader behavior than the manifest states.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest states the skill is for producing SVG charts, but the prominent documentation line says it generates ASCII charts or HTML files via scripts/chart.sh. This is an active intent mismatch between the stated purpose at the manifest level and the code documentation users rely on.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing help text and generated content entirely in Chinese, and the HTML output is explicitly marked with lang="zh". That imposes a specific language/locale on all users without opt-in or a documented region-specific justification, which matches the policy-violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The usage/help documentation claims support for scatter, table, heatmap, HTML export, and JSON import, but the command dispatcher only prints TODO placeholders for those operations. This is an active contradiction between user-facing documentation and actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill content is primarily presented in Chinese for usage instructions, commands, and option descriptions, while also including some English headings. This can amount to a language/locale policy issue because the skill implicitly defaults to a specific language without explicitly offering the user a language choice or documenting that the skill is intended only for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes a data visualization tool for producing charts, but the implementation creates a per-user data directory and stores history/output artifacts there. Local persistence is additional behavior beyond simply generating charts, even though it is related to the tool's operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill content is presented in Chinese, including headings, guidance, and examples, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.