T08 · Insecure Dependencies
Warning
- Location
SKILL.md:179- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Document Generator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local document generator whose file reads, writes, templates, images, formulas, and font handling mostly match its stated purpose, with some usage cautions.
Install in a virtual environment, prefer pinned dependency versions, only use the skill when you want a document file created, choose safe output paths, and avoid passing untrusted spreadsheet data as formulas unless reviewed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_excel.py:80- Finding
Unrestricted Excel Formula Injection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the code only generates DOCX while the skill advertises Excel and PDF generation, downstream systems may send sensitive business data into an incompatible or lossy path and receive misleading artifacts. The security risk is primarily integrity and trust-related: users may believe documents were produced in a requested format when they were not, or may expose template/data handling to the wrong implementation path.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the code only generates DOCX while the skill advertises Excel and PDF generation, downstream systems may send sensitive business data into an incompatible or lossy path and receive misleading artifacts. The security risk is primarily integrity and trust-related: users may believe documents were produced in a requested format when they were not, or may expose template/data handling to the wrong implementation path.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the code only generates DOCX while the skill advertises Excel and PDF generation, downstream systems may send sensitive business data into an incompatible or lossy path and receive misleading artifacts. The security risk is primarily integrity and trust-related: users may believe documents were produced in a requested format when they were not, or may expose template/data handling to the wrong implementation path.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger language is very broad, including indirect phrases like wanting data in a table or formatted as a document, which can cause over-invocation. Overly broad activation increases the chance that the skill is selected in situations involving unrelated or sensitive content, expanding file access and output generation beyond what the user clearly intended.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The when-to-use section lacks clear activation boundaries and overlaps with many normal assistant tasks such as creating reports or working with data. In an agent setting, ambiguous routing guidance can misdirect sensitive data into a file-writing workflow unnecessarily, increasing exposure and unintended side effects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This is a JSON manifest-style file, so vague-trigger checks apply. The prompt texts begin with broad, common phrases like '我需要生成...' and '帮我创建...', which overlap with everyday user requests and do not define any trigger scope, exclusions, or activation constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
All user-facing prompt and assertion descriptions in this file are written in Chinese, with no indication that language choice is optional or that the skill is intentionally limited to a Chinese-language context. That can violate language/locale policy because it implicitly fixes the interaction language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code explicitly centers its behavior around Chinese fonts and uses Chinese-language comments and user-facing status messages such as the success and warning prints. The skill does not offer any language/locale choice or explain that it is a region-specific tool, which can violate language/locale policy requirements for user-facing behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The instructions show commands that write output files but do not prominently warn users that the skill will create files on disk and may overwrite chosen paths. This can lead to unintended file creation, confusion about persistence, or accidental writes in sensitive working directories, especially when combined with template and image path inputs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains natural-language behavior stating that Chinese text handling will automatically select a system Chinese font. Because the policy scope includes language/locale constraints across all file types, this can be interpreted as enforcing a language-specific behavior without explicit user opt-in.
- Content
Static analysis
No suspicious patterns detected.