培训手册生成器

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent Chinese-language training handbook generator that uses web research and a Word-generation script, with a disclosed but unhardened dependency install step.

Before installing, use an isolated Python environment and pin python-docx to a reviewed version. Confirm that you want Chinese-language handbook output and that web research is appropriate for the topic being documented.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash

C:\Users\admin\.workbuddy\binaries\python\versions\3.13.12\python.exe -m pip install python-docx --target C:\Users\admin\.workbuddy\binaries\python\envs\default\Lib\site-packages

Technical Analysis

The installation command requests python-docx without an exact version, cryptographic hash, lockfile, or explicit trusted package index. Consequently, the artifact installed when the command is run may differ from the dependency that existed when this project was audited.

Python package installation can execute package build or installation logic. Imported package code also executes with the privileges of the Python process. A future compromised release, compromised distribution account, manipulated package index, or unsafe index configured in the local pip environment could therefore introduce code that is not present in this repository.

The reviewed generator itself does not retrieve remote payloads, invoke shell commands, access credentials, establish persistence, or contain embedded malicious behavior. The risk is limited to the documented dependency acquisition process.

Attack Path

1. An attacker compromises the package release process, package distribution account, configured package index, or another part of the dependency delivery chain.
2. The attacker publishes or serves a malicious artifact under the dependency name.
3. A user follows the documented unpinned installation command.
4. Pip resolves the dependency to the attacker-controlled or compromised artifact because no reviewed version or hash is enforced.
5. Malicious code executes during package installation, package build processing, or a later import by scripts/generate_handbook.py.

Impact Assessment

Malicious dependency code would execute with the privileges of the user running pip ...[truncated 473 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin python-docx to an exact version that has been reviewed and tested.
2. Place the dependency in a lock or requirements file and enforce cryptographic hashes with pip install --require-hashes.
3. Pin and hash all transitive dependencies, not only the top-level package.
4. Use an explicitly approved HTTPS package index or an internally controlled artifact repository.
5. Install dependencies in a dedicated, non-privileged virtual environment rather than a shared interpreter environment.
6. Prevent local or environment-level pip configuration from silently substituting untrusted indexes.
7. Add automated dependency vulnerability and integrity scanning to the release process.
8. Replace the documented command with a hardened installation flow, such as:

bash

python -m pip install --require-hashes --index-url https://pypi.org/simple -r requirements.lock

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list includes very generic terms such as “操作指南”, “handbook”, and “training manual”, which can match many ordinary document-generation requests outside this skill’s specialized scope. Over-broad activation can route unrelated user tasks into a workflow that performs web research and file generation, causing unintended tool use, irrelevant behavior, or disclosure of user context to unnecessary processing steps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill metadata and instructions are written entirely in Chinese and implicitly steer output toward Chinese-language behavior without stating a locale boundary or offering a language choice. This can mis-handle user intent, produce content in the wrong language, and create compliance or usability issues when the user expects another locale, especially for policy-sensitive or enterprise documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains user-facing natural language exclusively in Chinese in the module docstring, usage instructions, configuration labels, and runtime output. Because there is no opt-in, language selection, or justification that the tool is region-specific, it appears to impose a locale preference that may conflict with organizational language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file contains natural-language instructions exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy rule, forcing a single language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.