T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/merge_reports.py:1421- Finding
Spreadsheet Formula Injection in Generated Excel Workbooks
- Content
View full analysis
- Remediation
View remediation
Security audit
企业报表合并·模板填充·分析报告生成
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned, but it should be reviewed because it handles sensitive financial reports and can generate trusted Excel/Word outputs with insufficient safeguards against formula content and incorrect financial adjustments.
Install only in an isolated environment with reviewed, pinned dependency versions. Use trusted source reports, choose unique output paths, inspect generated Excel files for formulas or external links, and manually review all consolidation elimination entries, OCR-derived values, and generated risk analysis before relying on or sharing the documents.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/merge_reports.py:1296- Finding
Ambiguous Elimination-Entry Matching Can Modify the Wrong Financial Account
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:20- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: pdfplumber== --hash=sha256: python-docx== --hash=sha256: xlrd== --hash=sha256: PyMuPDF== --hash=sha256: ``` Install with: ```bash python -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt ``` The exact versions and hashes should be selected only after compatibility and security review; they should not be invented or copied from an unverified source. ]]>
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
虽然声明里最后提到“当用户明确要求生成分析报告且无模板时可自动构建完整分析报告”，这与代码的部分行为相符，但该代码块的核心实现几乎完全聚焦于自动生成分析报告，而不是声明中的主功能——多格式企业报表合并与模板嵌入。代码通过命令行参数接收资产负债表、利润表、现金流量表 JSON 文件，构建表格、计算比率、生成风险评估和建议，并输出 docx。没有看到任何 Excel/PDF/图片解析、跨报表合并、合并策略选择、抵销分录处理、或 Word 模板注入逻辑。因此描述对主要能力有显著夸大和偏离，属于明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The core declared purpose mostly matches the main implemented behavior: merging Excel/PDF report data in three modes and filling a Word template. However, there are material gaps and some extra behavior. First, the description explicitly claims support for 图片格式 enterprise reports, but this code does not actually read or extract data from standalone image files; it only detects image-based PDFs and can render PDF pages to images for later manual/agent vision use. That is not equivalent to implemented image report merging. Second, the description says that when the user requests an analysis report and no template is available, the skill can automatically construct a complete analytical report including financial ratios, risk assessment, and strategic suggestions. While the code contains financial ratio and validation helper functions, there is no implemented command or workflow that generates such a narrative report or outputs risk/strategy analysis. Third, the code exposes adjacent undeclared capabilities like PDF type detection and PDF-to-image conversion; these are related support functions rather than a different primary purpose, so they are less severe. Overall, this is a mismatch because important declared capabilities are absent in the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个高层业务技能：企业报表汇总合并、合并策略处理、嵌入 Word 模板并生成分析报告。而提供的代码块是一个独立的 PDF 预处理工具，主要用于判断 PDF 是否可提取文本，并将页面渲染成图片供后续视觉/OCR使用。它不读取 Excel，不进行任何报表字段级合并，不生成统一报表，也不输出 Word 文档或分析内容。虽然该工具可能作为处理扫描版 PDF 的辅助步骤，与报表处理流程存在间接关联，但从该代码块本身看，其主要目的与声明的核心能力明显不一致，因此应判定为描述与实际行为不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/merge_reports.py` 执行合并操作。所有命令通过 Bash 工具运行。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/merge_reports.py` 执行合并操作。所有命令通过 Bash 工具运行。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 当用户提供了财务报表但没有 Word 模板，且明确要求生成分析报告时，可使用 `scripts/generate_report.py` 自动生成一份完整的分析报告（如贷后分析报告）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 当用户提供了财务报表但没有 Word 模板，且明确要求生成分析报告时，可使用 `scripts/generate_report.py` 自动生成一份完整的分析报告（如贷后分析报告）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 当用户提供了财务报表但没有 Word 模板，且明确要求生成分析报告时，可使用 `scripts/generate_report.py` 自动生成一份完整的分析报告（如贷后分析报告）。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The feature description states that the skill writes merged Excel files, fills Word templates, and can auto-generate complete analysis reports, but it does not clearly warn users that new output files and report documents will be created. In a business-document context, silent file creation can expose sensitive financial data, overwrite expectations about where data goes, or cause users to approve processing without understanding the persistence and distribution of generated artifacts.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The README instructs users to run
npx clawhub@latest install enterprise-report-merger, which pulls and executes the latest published package version at install time. This creates a supply-chain risk because a compromised or malicious newly published version could run arbitrary code on the user's system, and the risk is amplified becausenpxexecutes fetched package code immediately.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger guidance is very broad and based on common natural-language phrases such as 'Merge these Excel reports' or 'Fill this data into the Word template'. In agent environments, overly generic triggers can cause accidental invocation on unrelated user requests, leading the skill to process sensitive enterprise files or generate outputs when the user did not intend to invoke this specific capability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This skill processes potentially sensitive enterprise financial reports and can generate new Excel/Word outputs, yet the documentation does not warn users about confidentiality, file handling, or the risks of ingesting untrusted business documents. In a financial-report-merging context, missing risk disclosures increase the chance of users exposing regulated or proprietary data and misunderstanding how generated artifacts should be reviewed before use.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
该说明写明“在对话中用自然语言描述任务即可触发”，并给出“合并这些 Excel 报表”“把数据填到 Word 模板里”等宽泛短语，但没有限定上下文、边界条件或非触发示例。这类触发描述缺乏具体约束，容易与普通办公对话重叠，增加非预期调用风险。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill explicitly instructs reading local Excel/PDF/Word files and processing their contents, but it declares no
permissionsorallowed-toolsscope. That creates an authorization ambiguity: an agent/runtime may grant broader file access than users expect, increasing the chance of unintended local file reads during normal use or accidental overreach if the skill is invoked in the wrong context.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill describes generating Excel and Word output files but does not clearly warn that local files may be created or overwritten. In a document-processing skill, that omission can cause accidental destruction of existing files, silent modification of user work products, or unexpected persistence of sensitive financial data on disk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
A broad trigger like “生成报告” can cause this skill to activate on many unrelated requests. Because the skill performs file reads, file writes, Bash-driven processing, and document generation, accidental invocation can lead to unintended handling of sensitive enterprise documents or unwanted local file creation in contexts where the user did not mean to use this skill.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document sets a primary safety rule against automatically filling Word templates from image-based PDFs due to OCR misreads, but later provides an alternate path that still permits automated extraction and template filling after validation. In a financial reporting skill, this inconsistency can cause operators or downstream agents to choose the less safe path and produce materially inaccurate reports, creating integrity and compliance risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Claiming screenshot recognition is 'close to 100%' and 'no longer requires item-by-item verification' directly undermines later instructions that all OCR results must be validated and user-checked. In this context, overstated accuracy can induce over-trust in extracted financial figures, leading to incorrect merged statements, faulty risk analysis, or professional reports containing undetected numeric errors.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown template is entirely specified in Chinese and presents the report format as a mandatory standard, including language-specific headings and content. Under the policy rule, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the regional constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains user-facing natural-language content and report generation that is fixed to Chinese, including the report title, headings, labels, and examples. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest focuses on merging reports, mapping subjects, applying elimination entries, and embedding results into Word templates; it only mentions generating an analysis report when explicitly requested and when no template exists. This file adds substantial analytic capabilities—18 financial ratios and multi-step cross-statement validation—but these routines are not tied to the documented commands and are not described as part of this script’s behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes merging Excel/PDF/image-format reports into unified reports and filling Word templates, with optional generation of analysis reports. This file additionally implements PDF classification and rasterization utilities intended for downstream multimodal/manual vision extraction, but these capabilities are not exposed in the documented CLI usage and are not part of the stated merger/template-filling behavior in the manifest.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
整个说明与示例触发语均默认要求中文交互，未说明是否支持其他语言，也未提供用户语言选择。若组织要求避免在无用户选择的情况下强制特定语言，这种单一语言约束可能构成自然语言策略问题。
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
L033 把“把数据填到Word模板里”“填充Word模板”作为核心触发词，但这类表述可出现在大量通用文档编辑任务中。虽然全文整体聚焦企业报表场景，但该触发短语本身缺少财务/报表限定，仍存在误触发风险。
- Content
Static analysis
No suspicious patterns detected.