T08 · Insecure Dependencies
Note
- Location
SKILL.md:99- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Flexible Database Design – SQLite flexible schema & knowledge base skill
Security checks for vulnerabilities and agentic risk
Overview
The skill coherently helps users build a local SQLite-based archive, with no evidence of hidden exfiltration or deceptive behavior.
Install this only if you want an agent to help create and operate a local SQLite archive. Keep the database in a project-specific path, treat archived raw content and exports as potentially sensitive, do not use untrusted FLEXIBLE_DB_SCHEMA or extractor modules, pin optional Python packages in a virtual environment, and be careful opening CSV exports in spreadsheet apps.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query_items.py:116- Finding
Spreadsheet Formula Injection in CSV Exports
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (31)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises substantial functionality and guidance related to building a flexible SQLite-backed knowledge/archive system. However, the provided code chunk does not implement any of that behavior; it is only an empty tests package initializer. This is a material mismatch in primary purpose and actual behavior, since the code neither provides the described database-related capabilities nor any meaningful supporting implementation for them.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. 修改 `flexible_db.py` 中的 `db_path` 指向用户的 db 路径。
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This is the same core issue as the environment-controlled schema execution, framed as silent persistence modification: a schema script from an environment-controlled path is executed automatically without any user confirmation or trust check. In a library that may run inside agents or automation, silent execution of arbitrary SQL during initialization materially increases the risk of unauthorized data modification or destructive setup actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises activation phrases like building a personal knowledge base or collecting scattered information, which are common, broad user intents rather than narrowly scoped triggers. In agent ecosystems that auto-load or prioritize skills from conversational similarity, this can cause the skill to activate in many unrelated contexts and steer the agent toward executing local Python/database workflows without the user explicitly asking for this specific capability.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description says the skill activates when users say things like "I want to build a knowledge base," "archive PDF reports," or "collect policies or scattered information." These phrases are broad, common task descriptions rather than tightly scoped trigger conditions, and the file does not provide exclusion conditions or a narrower activation context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The title and core description are written in Chinese and label the skill as a general-purpose skill, but there is no indication that the user can opt into another language. For a broadly applicable skill, forcing one language without opt-in can violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file is natural-language documentation, and all headings and descriptions are presented only in Chinese. The policy requires flagging language/locale constraints when a skill forces a specific language without user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code file contains natural-language strings entirely in Chinese in the module docstring, help text, examples, and status messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 89% confidence
- Finding
The extractor is chosen from an environment variable or caller-provided string and then imported dynamically with no allowlist or trust boundary enforcement. If an attacker can influence FLEXIBLE_EXTRACTOR or the spec argument, they can cause arbitrary module loading and execution of module top-level code, which can lead to code execution in the context of the process.
- Content
python return None mod_path, func_name = spec.rsplit(":", 1) try: mod = __import__(mod_path, fromlist=[func_name]) return getattr(mod, func_name) except (ImportError, AttributeError) as e: logger.warning("抽取器加载失败 %s: %s", spec, e)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring and many user-facing string literals are written exclusively in Chinese, which imposes a specific language/locale without any opt-in or documented regional constraint. Under the policy, language-specific behavior should offer user choice or be clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code creates directories and opens a SQLite database file, which can create or modify files on disk, but there is no user-facing disclosure such as a prompt, print, or explicit warning near the operation. The surrounding docstrings describe functionality but do not warn that running the skill will write to the local filesystem.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code reads FLEXIBLE_DB_SCHEMA from the environment and passes the file contents directly into sqlite3.executescript(), which allows execution of arbitrary SQL from any local path the process can access. In this skill’s context, that goes beyond normal schema initialization and can modify or destroy data, attach other databases, create triggers, or otherwise alter application behavior if an attacker can influence environment variables or deployment configuration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This method inserts raw content and extracted data into the database and commits it, creating persistent storage of potentially sensitive user data. The code logs only debug/status messages and does not provide a clear user-facing warning that submitted content will be retained locally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The update flow first deletes existing dynamic_data rows for the record and then rewrites extracted content, which is a data-modifying operation with potential loss of prior structured state. There is no visible confirmation prompt or explicit warning to the user about this overwrite behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file's user-facing natural-language content, including the module description, CLI description, examples, and argument help text, is entirely in Chinese. This creates a language/locale constraint in the skill interface without any opt-in, alternative language option, or justification that the tool is region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains user-facing docstrings, argparse descriptions, help text, and status messages exclusively in Chinese. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in, and there is no indication here that the locale is optional or region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The export_data function serializes full rows including raw_content and writes them to an arbitrary output path. Although the code prints a success message after writing, there is no prior warning, confirmation, or explanatory comment/docstring disclosing that potentially sensitive database contents will be persisted to disk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file presents core instructional content in Chinese and continues with Chinese invocation examples and descriptions, but does not state that the skill is intentionally Chinese-language only or offer an English/localized alternative. That can amount to an implicit language policy constraint without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file is natural-language documentation, and all user-facing content is presented only in Chinese. The stated policy category requires flagging language or locale constraints when a skill forces a specific language without user opt-in or an explicitly justified regional scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
该 markdown 文档中的自然语言说明要求金额类字段“统一存元”，属于对单位/本地化约定的强制性要求。虽然这在财务场景中可能合理，但文档未说明是否仅适用于中国财报场景，也未提供其他币种或单位的选择，存在 locale/region 约束未明确告知的问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
该文件全文使用中文描述使用方式与约定，但没有说明这是面向特定中文用户群体的示例，亦未提供语言选择或英文等替代说明。按规则，若技能内容强制特定语言且无用户选择或明确合理范围，可能构成自然语言层面的语言/locale 政策问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The SQL file contains operational comments only in Chinese ('添加复合索引', '执行前请备份'), which imposes a specific language on readers without any opt-in or documented reason for a locale restriction. This matches the language/locale policy category because the file's natural-language guidance is not presented in a user-selectable or justified form.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file's instructional comments are written only in Chinese, including the usage guidance telling the reader to adjust the schema based on SKILL.md. This imposes a specific language on users without offering an opt-in or documenting that the schema is intended for a Chinese-only or region-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file's instructional comments are entirely in Chinese, including usage guidance for copying and executing the SQL examples. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and no alternative language or justification is provided here.
- Content