T09 · Insecure Skill Coding Practices
Error
- Location
scripts/excel_toolkit.py:45- Finding
Spreadsheet Formula Injection in Generated Excel Workbooks
- Content
View full analysis
- Remediation
View remediation
Security audit
Excel 全栈处理技能
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a normal Excel helper, but it needs review because one test script can import code from an outside hard-coded path and the package has unsafe install and spreadsheet-output handling.
Review before installing. Do not run scripts/test_toolkit.py until the hard-coded sys.path entry is removed. Install dependencies in an isolated environment with pinned versions from a trusted index, treat generated XLSX files from untrusted CSV/JSON/PDF inputs as potentially formula-bearing, and require explicit confirmation before any Feishu cloud read/write/append operation.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/test_toolkit.py:5- Finding
Arbitrary Module Execution Through Hard-Coded Import Path Precedence
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:54- Finding
Unpinned Dependencies Installed from a Third-Party Package Mirror
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: openpyxl== --hash=sha256: pdfplumber== --hash=sha256: ``` ```powershell python -m pip install --require-hashes -r requirements.txt ``` 4. Prefer the canonical Python Package Index unless an organizationally managed and verified mirror is required. 5. Remove `--trusted-host` when the package source supports correctly validated HTTPS. 6. If a mirror must be used, document its governance, synchronization policy, and integrity controls. 7. Keep dependency declarations consistent across `README.md`, `SKILL.md`, and the lock file. 8. Add automated dependency vulnerability and provenance scanning to the release process. 9. Recommend installation in an isolated virtual environment without administrator privileges. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
描述覆盖面明显大于代码实际能力。代码确实实现了部分已声明功能：文件读取、格式转换、样式化报表、多Sheet合并、PDF表格转Excel。但声明中的若干重要能力在代码中不存在，例如飞书云端表格、爬虫数据导出，以及更广义的工作簿编辑和数据清洗/分析能力。这里不属于危险的额外未声明能力，而是描述夸大、与实际实现不完全一致，因此应判定为描述与行为不匹配。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The entire skill README is presented only in Chinese, with no indication that users may choose another language or that the skill is intended exclusively for a Chinese-language context. This can be a natural-language policy issue when a skill effectively forces a specific language without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The top-level description is written as a Chinese-only skill description (
Excel全栈处理技能) with no indication that language can be selected by the user. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill includes write and append examples for Feishu cloud spreadsheets without requiring explicit confirmation, warning about external data transmission, or emphasizing that remote state will be modified. In an agent setting, this can lead to unintended exfiltration of sensitive spreadsheet contents or unauthorized modification of collaborative documents.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language strings throughout the module, including the top-level description and CLI messages, are exclusively in Chinese, which imposes a fixed language on users. The policy allows locale constraints only when users can opt in or the restriction is clearly justified as region-specific, neither of which is present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code saves generated workbooks directly to the destination path, and similar write operations occur in the convert/report/merge flows. Although completion messages are printed after success, there is no prior disclosure or warning that the command will create or overwrite files at the specified path.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file documents commands that generate or write Excel outputs such as report generation, sheet merging, and PDF-to-Excel conversion, but it does not warn users that these actions create or overwrite files. Under the markdown-specific warning criterion, behaviours affecting user data or local files should be disclosed clearly.
- Content
Static analysis
No suspicious patterns detected.