Security audit

Excel Report

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Excel report generator, but it needs Review because some report/template paths can trigger unsafe code or formula execution.

Install only after reviewing or patching the unsafe formula handling and auto-open behavior. Use only trusted templates and trusted source data, avoid attacker-influenced output paths, and do not open generated workbooks from untrusted data without spreadsheet formula protections. Do not provide SMTP credentials expecting email sending from the inspected CLI, because the documented email flags are not implemented.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/template_engine.py:136
Finding: Unrestricted Python Evaluation of Template Formulas
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_report.py:395
Finding: Spreadsheet Formula Injection Through Imported Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_report.py:609
Finding: Shell-Enabled Command Invocation Uses a User-Controlled Output Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Unvalidated Output Injection

High

Category: Output Handling
Confidence: 97% confidence
Finding: The output path reaches a shell-backed process launch without validation or escaping. Because the script accepts user-controlled output locations and then passes the resulting path into subprocess.Popen(..., shell=True), an attacker can craft a filename/path containing shell-special characters to execute arbitrary commands on the host.
Content: Scanner excerpt · scripts/generate_report.py (reported line 614)May include surrounding context.
python
if gen.load_data(data_path): result = gen.generate(output_path) import subprocess subprocess.Popen(["start", "", str(result)], shell=True) print(f"\n[DONE] {result}")

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module is presented as a template/report computation engine, but its formula evaluation path executes template-controlled strings as Python code. In this skill context, templates are likely treated as data/configuration, so hidden code execution is especially dangerous because users and integrators may trust templates as non-executable content.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code evaluates template-provided formula expressions via eval(), which can execute arbitrary Python expressions derived from external template content. Although formula failures are logged, there is no confirmation prompt, warning comment/docstring, or other user-facing disclosure that untrusted template files may trigger code execution behavior.
Content: No source excerpt is available for this finding.

eval() call detected

High

Category: Dangerous Code Execution
Confidence: 99% confidence
Finding: The formula string is derived from template content and then executed with Python's eval(), which allows arbitrary Python expression execution in the current process. Because templates are externally loaded JSON and the code exposes in-scope objects like df, an attacker who can modify a template can achieve remote code execution, data exfiltration, or process compromise.
Content: Scanner excerpt · scripts/template_engine.py (reported line 141)May include surrounding context.
python
expr = re.sub(rf"\b{col}\b", f"df['{col}']", expr) try: result = eval(expr) if isinstance(result, (int, float)): return pd.Series([result] * len(df)) return result

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The LAG formula path transforms user-supplied formula text and then passes it to eval(), creating executable behavior from template content. The file does not provide any user disclosure that loading a template may execute dynamic expressions, so this safety-critical operation lacks warning coverage.
Content: No source excerpt is available for this finding.

eval() call detected

High

Category: Dangerous Code Execution
Confidence: 99% confidence
Finding: After substituting LAG() syntax, the code still executes the full resulting expression with eval(), so any attacker-controlled template formula can inject arbitrary Python code beyond the intended shift operation. This turns a data-transformation feature into code execution within the application context.
Content: Scanner excerpt · scripts/template_engine.py (reported line 164)May include surrounding context.
python
expr = re.sub(rf"\b{col}\b", f"df['{col}']", expr) try: return eval(expr) except: return pd.Series([np.nan] * len(df))

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This branch evaluates a transformed TOTAL expression with eval(), so externally supplied template formulas can influence executed code. There is no visible disclosure in comments, docstrings, prompts, or usage text warning users about the risks of processing untrusted templates.
Content: No source excerpt is available for this finding.

eval() call detected

High

Category: Dangerous Code Execution
Confidence: 99% confidence
Finding: TOTAL() expressions are converted to strings and then evaluated with eval(), preserving the ability for malicious template authors to execute arbitrary Python in addition to legitimate aggregation logic. Since this runs during report generation, exploitation could affect confidentiality, integrity, and availability of the host environment.
Content: Scanner excerpt · scripts/template_engine.py (reported line 182)May include surrounding context.
python
expr = re.sub(rf"\b{col}\b", f"df['{col}']", expr) try: result = eval(expr) if isinstance(result, (int, float)): return pd.Series([result] * len(df)) return result

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises email-sending of generated reports and instructs users to configure SMTP credentials, but it does not clearly warn that report contents will be transmitted to an external mail server and recipient. In a reporting skill, those files may contain sensitive business, financial, medical, or customer data, so silent or poorly explained exfiltration risk is material even if the feature is intended.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The section header says the convenience API 'directly returns chart objects (does not write ws)', implying no worksheet modification. However, build_chart calls _write_series_data(ws, ...) at L799-L800, which writes categories and series data into the provided worksheet before returning the chart.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language descriptions, docstrings, and command-line messages in Chinese only, which imposes a specific language on users. The policy allows locale constraints only when they are clearly documented and justified or when users can opt in, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring presents the tool entirely in Chinese (Excel可视化报表生成器), and the script also embeds Chinese labels and formatting conventions elsewhere, indicating a fixed language/locale experience. There is no user choice or documented justification that this skill is intentionally limited to a Chinese-language or China-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: CURRENCY_CN = '¥#,##0.00' enforces a China-specific currency format in generated reports. Because the script does not offer a locale or currency selection and does not document a China-only scope, this hard-coded locale behavior violates the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatically launching an external process is outside the core requirement of generating a report and increases attack surface, especially because it opens whatever file was written without confirmation. In this script that behavior is coupled to shell execution, so the extra capability materially contributes to exploitation opportunities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script opens the generated report immediately and without user confirmation, which can trigger unintended local execution paths and surprises in automated or agent-driven environments. In skill/agent contexts, silent side effects are riskier because users may not expect a reporting tool to spawn external applications.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 96% confidence
Finding: The script invokes a shell with shell=True and passes a path derived from user-controlled --output/generated filename into the command used to open the report. On Windows, shell metacharacters in the path can alter command parsing and lead to arbitrary command execution, making this more dangerous than a simple convenience feature.
Content: Scanner excerpt · scripts/generate_report.py (reported line 614)May include surrounding context.
python
if gen.load_data(data_path): result = gen.generate(output_path) import subprocess subprocess.Popen(["start", "", str(result)], shell=True) print(f"\n[DONE] {result}")

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstrings, warnings, validation output, and CLI usage strings are presented only in Chinese, which imposes a language choice on users without opt-in. Under the stated policy, locale or language constraints should either be optional for users or clearly documented as justified for a region-specific tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This manifest presents the primary skill name, scene, and description in Chinese, with only a secondary English name field and no indication that users can choose language or locale. That can violate a language/locale policy when the skill implicitly defaults to a specific language without explicit user opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This manifest uses Chinese for the primary skill name, scene, and description while only partially providing an English alternative via name_en. Under the policy, forcing a specific language without user opt-in or a documented regional justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JSON manifest presents the primary skill name, scene, description, sheet names, labels, chart titles, and output filename in Chinese, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking region. The presence of a single English fallback field at L004 does not change that the operational user-facing content is otherwise fixed to one locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill's natural-language interface and documentation are entirely in Chinese, including headings, usage guidance, and examples, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. This can violate language/locale policy when a skill implicitly forces one language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The top-level docstring presents the module name and description entirely in Chinese, indicating a fixed locale/language expectation for the skill module. There is no accompanying language choice, opt-in, or region-specific justification, which can violate an organizational language/locale policy for multilingual users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The embed_data docstring states 返回写入数据的起始行号(1-based) ('returns the starting row number'), which is an explicit behavioral claim. The implementation only writes cells and has no return statement, so it actually returns None, creating a direct intent-code divergence in documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON file contains multiple visible user-facing labels such as "制造业", "零售业", and "通用" that force a specific language locale. The file provides no indication of user opt-in, alternate language support, or documented justification for a Chinese-only presentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This manifest presents the skill name, scene, and description entirely in Chinese for the primary fields, while English appears only as a secondary name field. Because the file does not state that the skill is region-specific or that users can choose locale/language, it may violate language/locale policy requiring opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/template_engine.py:141