T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/qc_tool.py:611- Finding
Annotation-Controlled Path Traversal Allows Unauthorized Local Image Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Image Annotation QC
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent image-annotation QC tool, but crafted annotation files can make it read images outside the chosen image folder and can place unsafe values into Excel reports.
Review before installing or using on untrusted annotation files. Run it in a dedicated project directory or sandbox, keep visualization disabled for untrusted datasets until image-path containment is fixed, avoid opening generated XLSX files from untrusted labels, and prefer pinned dependency versions in an isolated Python environment.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/qc_tool.py:693- Finding
Attacker-Controlled Annotation Labels Can Cause Excel Formula Injection
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:5- Finding
Unpinned Third-Party Dependencies Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: openpyxl== --hash=sha256: ``` Install with integrity enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` ]]>
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises and describes behavior that reads inputs and writes reports/visualizations, but it does not declare any explicit tool scope or permissions. That gap can cause users or orchestrators to invoke it without clear awareness of its filesystem access, increasing the risk of unintended writes, output placement in sensitive directories, or over-broad execution privileges.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains user-facing natural language in the module docstring and throughout CLI help/output that assumes Chinese as the only supported language. The policy requires flagging forced language or locale behavior when no opt-in or justified region-specific scope is provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file’s user-facing content is entirely in Chinese, including the title, labels, and status, with no indication that language selection is optional or constrained by a documented regional requirement. This can violate a language/locale policy when users are not given an opt-in or alternative locale.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill states that reports are auto-saved and later notes output locations, but it does not present a clear upfront warning that execution will create files and visualization artifacts in the annotation or chosen output directory. This can lead to surprising side effects, clutter, accidental overwrites, or writes into directories containing sensitive or production data.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code performs file-system modifications by creating a qc_report directory and later saving TXT, JSON, XLSX, and PNG outputs. Although there are print statements after writing, the skill lacks an upfront user warning or disclosure in its main description/help that running it will create directories and write files to disk.
- Content
Static analysis
No suspicious patterns detected.