SQL Dataviz

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:54 AM UTC
• Version: 1.0.1

Overview

This appears to be a real SQL charting skill, but its generated HTML reports and dependency installation have safety gaps users should review first.

Install only in an isolated virtual environment, avoid running installers with administrator privileges, and review or pin dependencies before use. Treat generated HTML dashboards as active web pages: do not feed them untrusted database text or raw HTML, review/redact sensitive data before sharing, and expect external network access unless Plotly is bundled locally. Avoid setting a persistent pip mirror unless you intentionally want future pip installs to use it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/interactive_charts.py:97

Finding

Stored HTML and JavaScript Injection in Generated Reports

Content

View full analysis

str: """Wrap a Plotly div in a complete HTML document.""" t = THEMES.get(theme, THEMES["powerbi"]) return f""" {title or 'Chart'} * {{ box-sizing: border-box; margin: 0; padding: 0; }} body {{ font-family: {FONT_FAMILY}; background: {t['paper_bg']}; color: {t['font_color']}; padding: 16px; }} .chart-title {{ font-size: 18px; font-weight: 600; margin-bottom: 12px; color: {t['primary']}; }} .chart-wrap {{ background: {t['bg']}; border-radius: 8px; padding: 16px; box-shadow: 0 2px 8px rgba(0,0,0,.08); }}

{('

' + title + '

') if title else ''} {plotly_div}

""" ``` Additional unsafe interpolation occurs in KPI cards and dashboard sections: ```python for c in cards: change = c.get("change", "") change_color = "#107C10" if str(change).startswith("+") else "#D83B01" card_html += f"""

{c['title']}

{c['value']}

{change}

""" ``` ```python elif sec["type"] == "insights": sections_html += f'

{sec["html"]}

' ``` ### Technical Analysis The report generator inserts caller-controlled values directly into HTML without context-aware escaping or sanitization. Affected values inc ...[truncated 2144 chars]

Remediation

View remediation

`, ``, `<object>`, and `<embed>` elements. - Inline event attributes such as `onclick` and `onerror`. - `javascript:` and unsafe `data:` URLs. - Untrusted style content and navigation-capable elements. 5. Keep trusted Plotly-generated fragments separate from arbitrary caller-provided HTML. 6. Add a restrictive Content Security Policy to generated reports, avoiding `unsafe-inline` where possible. 7. Add regression tests using malicious values in every exposed text and HTML field. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/install_deps.sh:49

Finding

Unpinned and Unverified Python Dependency Installation

Content

View full analysis

=3.5.0 seaborn>=0.11.0 pandas>=1.5.0 numpy>=1.21.0 pillow>=9.0.0 plotly>=5.9.0 networkx>=2.8.0 wordcloud>=1.9.0 scipy>=1.9.0 ``` ### Technical Analysis The installation script downloads mutable latest releases directly from the configured Python package index. The requirements file also permits any future version newer than the stated minimum. Neither mechanism validates artifact hashes. Python packages may execute build-system or installation code during installation. Their imported modules also execute package initialization code when the Skill runs. Consequently, dependency installation is a code-execution trust boundary. Automatically upgrading `pip` further expands the supply-chain surface and changes the installer independently of the Skill's reviewed source. The lack of exact versions and hashes prevents reproducible installation and makes it difficult to establish that users execute the same dependency artifa ...[truncated 1448 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/interactive_charts.py:84

Finding

Generated Reports Retrieve and Execute Plotly JavaScript from a Remote CDN

Content

View full analysis

str: """Wrap a Plotly div in a complete HTML document.""" t = THEMES.get(theme, THEMES["powerbi"]) return f""" {title or 'Chart'} ``` Dashboard output uses the same remote script: ```html ``` ### Technical Analysis Interactive reports reference executable JavaScript hosted at `cdn.plot.ly`. The JavaScript is not embedded in the report, and the generated script element does not use Subresource Integrity metadata. When a report is opened, the browser contacts the CDN and executes the returned content. This creates a runtime dependency whose effective content is controlled outside the audited project. It also conflicts with the module's claim that generated HTML is self-contained. Although the URL identifies a specific Plotly version, the absence of integrity verification means the browser does not cryptographically confirm that the response matches a reviewed artifact. ### Attack Path 1. The Skill generates an interactive chart or dashboard. 2. The generated HTML includes a script reference to `https://cdn.plot.ly/plotly-2.27.0.min.js`. 3. A user opens the report while connected to a network. 4. The browser contacts the external CDN, exposing network metadata such as the user's IP address and potentially a referrer. 5. The browser executes the JavaScript returned by the remote server. 6. If the CDN, DNS path, hosting account, or served ...[truncated 771 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (69)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all user-facing instructions and status information exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file is written entirely in Chinese and presents the skill/project reporting content in a single language with no indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue unless it is explicitly documented as region-specific or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is written entirely in Chinese and presents the skill information, examples, and status updates only in that language. Under the stated policy, a skill that effectively requires a specific language without opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The text asserts that all Power BI and mainstream BI chart types have been fully implemented, using definitive completion language such as '完成度：100%' and '已全部实现'. In this file, however, there is no implementation code at all—only descriptive documentation and examples—so the document's statements about actual implementation are not supported by the file contents and therefore contradict what this file actually does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's natural-language instructions, headings, and usage guidance are all presented in Chinese, which effectively forces a specific language on the user. Under the policy, language restrictions should either be optional via user choice or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Natural-language policy violations apply to all file types, including markdown. This file presents all instructional content in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language instructions and usage guidance are presented in Chinese, but the document does not indicate that the skill is region-specific or provide an opt-in or alternative language. Per the policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The '受限模式' section states that interactive HTML charts and dashboard building are not available, yet the same file later presents scripts/interactive_charts.py as providing interactive HTML output and dashboard generation. This is an active contradiction in the skill's own documentation about what the skill does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The overview states that all charts are output as base64 PNG, which directly conflicts with the earlier section documenting Plotly-based self-contained HTML output and save_html/dashboard generation. This is more than incomplete documentation because it asserts exclusivity ('所有图表') that the rest of the file disproves.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level module description is entirely in Chinese and presents the skill as Chinese-oriented by default. In combination with the explicit automatic Chinese font setup later in the file, this indicates a locale-specific behavior without any visible user opt-in or documented language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code automatically searches for and applies Chinese fonts at import time via _setup_chinese_font(), changing global matplotlib rendering defaults to prefer Chinese-capable fonts. This is a natural-language locale policy concern because it imposes a specific language/script configuration on all users without any visible choice mechanism.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The class docstring presents this as an 'ArcGIS 地图 - 专业空间分析' visual, which implies a map/chart driven by supplied spatial data. However, the create method never uses the provided data argument and instead generates random grids with np.random.rand, so the output is unrelated to caller input and not an ArcGIS-backed map.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation says '智能叙事 - 自然语言摘要', suggesting the skill derives a narrative summary from data. In reality, the function simply iterates over data['insights'] and lays those strings out on a canvas; no summarization or analysis is performed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The class and sample data indicate support for product images/logo embedding via image paths, but the create method only renders a placeholder text block and ignores the images list entirely. This is an active contradiction between the documented capability and the actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Natural-language content throughout the file is exclusively Chinese, and there is no indication that users may choose another language or that the installation guide is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a locale/language policy issue.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/INSTALLATION.md (reported line 40)May include surrounding context.

如果命令不存在，请先安装 Python

Windows: https://www.python.org/downloads/

Linux: sudo apt-get install python3 python3-pip

macOS: brew install python3

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/INSTALLATION.md (reported line 176)May include surrounding context.

如果命令不存在，请先安装 Python

Windows: https://www.python.org/downloads/

Linux: sudo apt-get install python3 python3-pip

macOS: brew install python3

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/INSTALLATION.md (reported line 177)May include surrounding context.

如果命令不存在，请先安装 Python

Windows: https://www.python.org/downloads/

Linux: sudo apt-get install python3 python3-pip

macOS: brew install python3

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

Writing ~/.pip/pip.conf creates persistent user-level configuration that affects later sessions and future package installations. Because this changes package source behavior beyond the immediate task, it can have long-lived supply-chain and troubleshooting consequences if done without explicit warning and reversal guidance.

Content

Scanner excerpt · references/INSTALLATION.md (reported line 143)May include surrounding context.

bash

# 编辑 ~/.pip/pip.conf
mkdir -p ~/.pip
cat > ~/.pip/pip.conf << 'EOF'
[global]
index-url = https://mirrors.aliyun.com/pypi/simple/

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The report-generator section explicitly handles order details, customer names, and file exports, but it does not disclose privacy or data-handling risks associated with embedding and exporting potentially sensitive data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill reference, including headings, labels, and example chart text, is written in Chinese and configures Chinese fonts in the embedded examples. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file title, all narrative text, chart titles, labels, and example outputs are written in Chinese, and the code explicitly configures Chinese fonts. This effectively imposes a specific language/locale on users without any opt-in or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The entire markdown skill is written in Chinese, including headings, instructions, and normative requirements such as '强制规范' and 'MUST DO/MUST NOT', with no indication that users may choose another language or locale. This creates a language-policy concern because the skill effectively mandates a specific language without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill is written as mandatory guidance in Chinese, with no indication that the user can choose another language or locale. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.