T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/report_writing_oil.py:16- Finding
External Import Path Allows Packaged Workflow Code to Be Replaced
- Content
View full analysis
- Remediation
View remediation
Security audit
report-writing-skills
Security checks for vulnerabilities and agentic risk
Overview
This skill looks like a report-generation scaffold, but it misrepresents simulated research actions as successful and includes an unsafe external code import path.
Treat this as a review-needed scaffold, not a reliable production skill. Do not enter sensitive research-site credentials or rely on the generated financial analysis until the external import path is removed, real authentication and download verification are implemented, placeholder/demo behavior is clearly labeled, and output paths and retention are explicitly user-controlled.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/report_writing_workflow_v103.py:184- Finding
Authentication and Download Operations Report Success Without Performing or Verifying the Operations
- Content
View full analysis
bool: """ Handle website login with provided credentials Returns True if successful, False otherwise """ self.display_progress(1, details=f"正在登录网站: {url}") time.sleep(1) # Simulate processing time print(f"✅ 网站认证登录成功") return True ``` The corresponding download implementation also simulates progress without retrieving or validating report content: ```python def download_reports(self, reports: List[Dict], topic: str = "reports") -> bool: """ Download specified reports after asking for save location """ self.display_progress(5, details="准备下载报告文件") # Ask user for save location before downloading self.output_dir = self.ask_save_location(topic) print(f"\n📥 开始下载 {len(reports)} 份报告到: {self.output_dir}") # Simulate download progress if TQDM_AVAILABLE: for i in tqdm(range(len(reports)), desc="下载进度", unit="报告"): time.sleep(0.5) # Simulate download time else: for i, report in enumerate(reports): print(f"📥 下载报告 {i+1}/{len(reports)}: {report.get('title', 'Unknown')}") time.sleep(0.5) print(f"✅ 所有报告下载完成") return True ``` The specialized oil workflow similarly creates metadata placeholders instead of downloading the named PDF files: ```python for url, filename in download_urls: print(f" 📥 正在下载: {filename}") try: # In real implementation, this would download the actual PDF # ...[truncated 3414 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file consistently presents the skill’s user-facing behavior in Chinese, including interaction steps such as asking the user for report requirements and save locations. There is no indication that the user can choose another language or that the Chinese-only behavior is a justified region-specific constraint, which may violate language/locale policy.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly instructs use of provided credentials to log into a third-party research website, but it gives no warning about how credentials are collected, transmitted, stored, or whether they should be scoped to least privilege. In a browser-automation workflow, unclear credential handling increases the risk of accidental exposure in logs, prompts, screenshots, or persisted automation state.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The natural-language instructions and reporting workflow are presented entirely in Chinese, including the report-writing guidance, with no indication that the user may choose another language. Under the stated policy, forcing a specific language without opt-in can be a locale-policy violation unless clearly justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The document's security note states '不执行任何JavaScript代码或可疑脚本' at L53, implying the workflow should avoid JavaScript execution. However, the earlier login step at L08 requires handling CAPTCHA or security verification, which on modern websites generally depends on JavaScript-driven page logic and challenge execution, creating a contradiction in the documented intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code prints status messages in Chinese and generates the final report and README entirely in Chinese, while the file contains no user opt-in, language selection, or justification that the skill is region-specific. That creates a natural-language locale policy issue because the skill imposes a specific language on all users by default.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script falsely reports successful authentication, searching, filtering, and report downloading even though it only simulates those steps and writes placeholder metadata files. This is dangerous because downstream users or automation may trust the output as genuine research provenance, leading to deceptive reporting, bad decisions, and integrity failures in environments that rely on accurate collection and auditability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file prints all user-facing status messages in Chinese, which imposes a specific language on the user. The file does not offer any locale selection, fallback, or opt-in mechanism, so it violates the language/locale policy criterion for natural-language policy violations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
User-facing strings for the core workflow steps are fixed in Chinese, and several prompts and status messages elsewhere are also Chinese-only. This imposes a specific language on users without opt-in or documented justification, which matches the locale/language policy violation category.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level docstring describes a complete automated workflow including authentication, content search/filtering, report identification, and analysis synthesis. In implementation, login_to_website merely sleeps and returns True (L184-L192), search_content returns an empty list placeholder (L194-L204), and generate_analysis_report writes mostly static markdown with placeholder analysis text (L255-L285, L335-L337).
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow step names are hard-coded in Chinese, and the rest of the user-facing prompts throughout the script are also presented only in Chinese. This imposes a single language on users without any opt-in or language-selection mechanism, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions and examples are entirely in Chinese, and the file does not indicate that language selection is optional or that the skill is intended only for a Chinese-language environment. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill directs downloading files to a local directory and saving generated PDFs, but it does not clearly warn that it will create local files or describe where data will be written and retained. This can lead to unintended persistence of potentially sensitive research data on the host system, especially when the default location is the desktop.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The guide directs saving downloaded files to a specific local directory but does not mention user consent, overwrite protection, path validation, or storage limits. In an agent setting, uncontrolled local writes can lead to accidental overwriting of files, cluttering sensitive directories, or writing data to an inappropriate location on the host.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The docstring for generate_analysis_report says it generates an analysis report and the code constructs a .pdf filename, which implies PDF output. However, the implementation explicitly replaces the .pdf suffix with .md and writes Markdown content to that file, so the documented/output intent contradicts actual behavior.
- Content
Static analysis
No suspicious patterns detected.