Security audit

对话生产器（自用）

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its XLSX dependency is installed and loaded from a shared temporary path in a way that could run untrusted code.

Review this before installing. Use a project-local, pinned `xlsx` dependency with a lockfile instead of the shared `/tmp` cache, and choose explicit non-existing output paths for generated files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:96
Finding: Unpinned Dependency Installation and Trust of a Shared Temporary Module Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明的核心能力是生成完整的模拟微信群聊 Excel 数据集，包含多个工作表和聊天记录内容；而实际代码仅输出一个 group_def.json 配置文件，保存群名、成员 persona、加入时间和话题时间基准。这可以视为上游辅助配置步骤，但就该代码片段本身而言，其主要目的与声明不一致，且缺少声明中最关键的 .xlsx 生成、sheet 结构构建和消息流生成功能，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
收集所有子 Agent 结果后，运行 `scripts/write_xlsx.js` 写入文件。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings that require Chinese for usage instructions and user-facing interaction. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file's usage instructions and behavioral descriptions are written entirely in Chinese, which imposes a specific language on users without offering an opt-in choice. This is a natural-language locale policy concern because the skill does not indicate that it is intentionally region-specific or provide an alternative language path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs writing an XLSX file to disk but does not specify a safe output path, uniqueness requirements, or overwrite protections. In an agent environment, this can cause unintended file creation or clobber an existing file if a default or user-derived filename collides, especially when automated workflows run unattended.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all instructions, field descriptions, and examples exclusively in Chinese. Under the policy rule for language/locale, forcing a single language without user opt-in or a documented justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing natural-language instructions exclusively in Chinese, and there is no indication that users may choose another language or that the format is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.