地产项目前期产策报告

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:38 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a Chinese real-estate report helper, but it writes generated reports to a hard-coded local path and sends project context to web search without clear user control.

Review this skill before installing in a sensitive business environment. Avoid using confidential deal names or internal project identifiers with its web-search workflow unless you are comfortable sending that context to external search providers, and do not run the report script until its output directory, filename sanitization, and HTML escaping are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:140

Finding

Windows Path Traversal Through Unsanitized Project Name

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:109

Finding

HTML Injection Through Unescaped Project Name

Content

View full analysis

str: md = generate_markdown(project_name, data) html_body = md html_body = html_body.replace('# ', '

').replace('## ', '

').replace('### ', '

') html_body = html_body.replace('**', '').replace('**', '') html_body = html_body.replace('\n\n', '

').replace('\n- ', '

') html_body = html_body.replace('| ', '').replace(' | ', '').replace(' |', '') return f""" {project_name}产策定位报告 body{{ font-family: 'Microsoft YaHei', Arial, sans-serif; max-width: 900px; margin: 40px auto; padding: 0 20px; color: #1a1a2e; line-height: 1.8; }} h1{{ color: #0D1B3E; border-bottom: 3px solid #C9A855; padding-bottom: 10px; }} h2{{ color: #0D1B3E; margin-top: 30px; }} table{{ border-collapse: collapse; width: 100%; margin: 15px 0; }} td, th{{ border: 1px solid #ddd; padding: 10px; text-align: left; }} th{{ background: #0D1B3E; color: #fff; }}

{project_name}

报告日期：{datetime.now().strftime('%Y.%m.%d')}

{html_body} """ ``` ### Technical Analysis The user-controlled `project_name` is interpolated directly into the HTML document without context-appropriate escaping. It is inserted into both the `` element and the document body. The same value is also incorporated into the Markdown report and then processed by a series of string replacements that do not sanitize HTML. Consequently, HTML metacharacters and active elements remain intact. An attacker can supply a project name containing closing tags and malicious HTML. Depending on the browser and local-file security policy, this can result in script e ...[truncated 1219 chars]

Remediation

View remediation

str: safe_project_name = escape(project_name, quote=True) md = generate_markdown(project_name, data) # Render Markdown with raw HTML disabled, then sanitize the result. html_body = render_sanitized_markdown(md) return f""" {safe_project_name} Strategy Report

{safe_project_name}

{html_body} """ ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents this as a substantive professional skill for early-stage real-estate strategic analysis, including feasibility judgment, competitor analysis, product positioning, investment risk checks, and customer research. The supplied code does not implement those capabilities. Instead, it generates a preformatted report skeleton with placeholder fields and saves it locally as Markdown and/or HTML. There is no ingestion of project data, no market/competitor/customer analysis, no risk assessment logic, and no decision-making methodology beyond static text. Additionally, the code advertises Word/PPT support in the module docstring but does not implement those formats. The local file-writing behavior is also undeclared. Therefore, the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises generation of Word/PPT/PDF outputs and references scripts that create files, but it does not declare any explicit tool scope or permissions boundaries. In practice, undeclared file-write capability can lead to outputs being written to local storage without user awareness or policy enforcement, which is risky in an enterprise workflow handling potentially sensitive project materials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest states the skill activates when the user provides '项目名称+城市', which is a very common input pattern in many real-estate or research conversations and is not specific to this skill's intended task. Without narrower constraints or exclusion examples, this could cause unintended invocation outside explicit产策定位/竞品分析 requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that it will proactively perform web searches for planning, policy, competitors, and customer trends, but it does not warn users that project-related context may be sent to external services. For a real-estate pre-investment strategy skill, this can expose confidential deal intent, location targets, and internal research topics to third-party providers or logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description is entirely in Chinese and presents the skill as operating in that language, with no indication that users may choose another language or locale. This can violate language/locale policy when the skill effectively assumes a fixed language without explicit opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The docstring, prompts, and user-facing output are entirely in Chinese, and the skill does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This is a natural-language policy concern because it imposes a specific language on users without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-level docstring explicitly advertises support for Markdown, HTML, Word, and PPT. The rest of the file provides no Word or PPT generation or saving logic, so the documentation actively contradicts the code's real capabilities rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file description and generated report content are entirely fixed in Chinese, and the HTML output explicitly sets lang="zh-CN". Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring states '支持 Markdown / HTML / Word / PPT', implying four output formats. However, the implemented generation and save paths only handle Markdown and HTML, and the CLI only exposes markdown/html/all modes, so the documented behavior materially overstates actual functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes output to a hard-coded desktop path on a specific local user profile, causing data to be written outside any caller-controlled workspace or sandbox. In an agent/skill context, this can leak generated reports containing potentially sensitive project information to an unintended host location, create privacy/compliance issues, and make behavior non-portable and hard to audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file presents the skill/reference content only in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.