Security audit

SQL Report Generator

Security checks for vulnerabilities and agentic risk

Overview

This report-generation skill is mostly coherent, but its core HTML export code renders user/data-controlled values without escaping, which can create unsafe reports if opened or hosted.

Review before installing if you will generate reports from uploaded, third-party, database, or customer-controlled data. Do not publish generated HTML on an authenticated or trusted web origin until the generators escape text, validate base64/image fields, restrict CSS/class inputs, and add an appropriate CSP. Pin and complete dependencies for reproducible installs, and add privacy/legal guardrails before using templates that profile users or recommend marketing outreach.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_report.py:238
Finding: Stored HTML and JavaScript Injection in the Core Report Generator
Content: View full analysis

{kpi['label']}

{kpi['value']}

{kpi['change']}
""" # Section content sections_html = '' for section in sections: section_type = section.get('type', 'chart') if section_type == 'chart': sections_html += f"""

{section.get('title', '')}
{f'
' + section.get('insight', '') + '
' if section.get('insight') else ''}
""" elif section_type == 'table': sections_html += f"""

{section.get('title', '')}
{section.get('content', '')}
""" elif section_type == 'insight': sections_html += f"""
📌 {section.get('title', 'Key Insight')}
{section.get('content', '')}

""" ``` ### Technical Analysis The generator concatenates report fields directly into an HTML document without context-sensitive escaping. Affected values include KPI labels, values, changes, CSS class names, section titles, image alternative text, insights, and arbitrary table or section content. If any of these values originate from uploaded data, database query results, imported report configurations, or another untrusted source, HTML elements and event handlers remain executable. Values pla ...[truncated 1462 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/interactive_components.py:470
Finding: Stored HTML Injection in ReportBuilder Exports
Content: View full analysis
str: """Render all sections""" html_parts = [] for section in self.sections: if section['type'] == 'title': level = section.get('level', 1) html_parts.append(f"{section['content']}") elif section['type'] == 'text': html_parts.append(f"
{section['content']}
") elif section['type'] == 'chart': html_parts.append(f"""

{section['title']}
{f'
{section["description"]}
' if section.get('description') else ''}

""") elif section['type'] == 'table': html_parts.append(f"""

{section['title']}

""") elif section['type'] == 'slicer': html_parts.append(f"""

""") ``` ### Technical Analysis Report metadata and section values are inserted into the final HTML without escaping. The vulnerable fields include the report title, author, date, version, headings, parag ...[truncated 1412 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ai_insights.py:246
Finding: Stored HTML Injection in Statistical Insight Reports
Content: View full analysis
") html_parts.append("
📊 Data Insight Report
") html_parts.append(f"
Generated: {self.generated_at} | Total insights: {len(self.insights)}
") html_parts.append("") if self.summary: html_parts.append("
") html_parts.append(f"Summary: {self.summary}") html_parts.append("
") html_parts.append("
") for insight in self.insights: severity_class = insight.severity.lower() html_parts.append(f"
") html_parts.append(f"
") html_parts.append(f"{insight.severity.upper()}") html_parts.append(f"{insight.title}") html_parts.append("
") html_parts.append("
") html_parts.append(f"
Type: {insight.type}
") html_parts.append(f"
Metric: {insight.metric}
") html_parts.append(f"
Key value: {insight.value}
") html_parts.append(f"
Confidence: {insight.confidence:.1%}
") html_parts.append("
") html_parts.append(f"
{insight.description}
") html_parts.append("
") html_parts.append("
") if self.recommendations: html_parts.append("
") html_parts.append("
Recommendations
") for rec in self.recommendations: html_parts.append(f"
{rec ...[truncated 1520 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dashboard_tooltips.py:305
Finding: HTML and Attribute Injection in Dashboard Tooltip Generation
Content: View full analysis
""" if self.config.show_dimensions and "dimensions" in data: for dim in data["dimensions"]: html += f'
{dim}
' if self.config.show_metrics and "metrics" in data: for metric in data["metrics"]: html += f'
{metric}
' if self.config.show_comparison and "comparison" in data: html += f'
{data["comparison"]}
' # Custom tooltip content if content.subtitle: html += f'
{content.subtitle}
' for metric in content.metrics: value = data.get(metric.field_name, "-") html += f'''
{metric.display_name} {value}
''' if content.table_data and "rows" in content.table_data: for row in content.table_data["rows"][:5]: html += f'{row[0]}{row[1]}' ``` ### Technical Analysis Tooltip dimensions, metrics, comparison text, subtitles, metric names, values, and table cells are rendered as raw HTML. Style configuration values are also interpolated into an inline `style` attribute without strict vali ...[truncated 1095 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:4
Finding: Unpinned and Incomplete Runtime Dependency Declaration
Content: View full analysis
=1.5.0 numpy>=1.21.0 matplotlib>=3.5.0 jinja2>=3.1.0 ``` Related runtime imports found in the project include: ```python # scripts/ai_insights.py from scipy import stats # scripts/interactive_components.py import seaborn as sns ``` ### Technical Analysis All declared dependencies use open-ended lower bounds. A future installation can therefore resolve to versions that were never tested or audited with this Skill. The declaration also omits `scipy` and `seaborn`, even though executable modules import them. No malicious package name, typosquatted package, custom package index, or known malicious component was identified in the reviewed material. The risk arises from weak dependency reproducibility and an incomplete software bill of materials rather than a confirmed malicious dependency. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver downloads the newest versions satisfying the lower bounds. 3. Installation behavior can change over time as upstream releases change. 4. Some modules may fail at runtime because `scipy` or `seaborn` is absent, prompting ad hoc installation outside the reviewed dependency set. 5. If a newly resolved upstream version is compromised or incompatible, the affected code runs with the privileges of the installing user when imported or used. ### Impact Assessment The immediate confirmed impact is unreliable installation and runtime failure for modules with undeclared dependencies. The broader supply-chain exposure is execution of future, unreviewed dependency versions with the user's Python-process privileges. The repository itself does not demonstrate dependency confusion, remote payload retrieval, or privilege escalation. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (103)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructions and documentation exclusively in Chinese, and it does not provide an opt-in language choice or explain that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The title and the entire report are written in Chinese, presenting the skill benchmark report in a fixed language without any indication that users may choose another language or locale. This matches the policy category for language or locale constraints that are imposed without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This markdown file contains user-facing guidance exclusively in Chinese, starting from the title and throughout all sections. Under the policy rule, forcing a specific language without user opt-in or a documented locale justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains only Chinese-language guidance and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the natural-language policy rule, forcing a specific language without user opt-in is a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown skill reference forces a specific language/locale for all instructions and examples, which can violate organizational language-choice policies when no user opt-in is provided. The document does not indicate that it is region-specific or that alternative languages are supported.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: 该清单将“老板报告”“一页纸报告”列为触发词，但这些表达在日常办公沟通中较常见，且未说明仅在特定命令、上下文或明确模板选择流程中生效。缺少排除条件或负例，容易与普通请求重叠并导致意外调用高管摘要模板。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: “给老板看？”和“其他专项？”这类条件属于宽泛自然语言分类，而非明确、可判定的触发范围。文档没有说明这些条件如何区分、何时不适用，也未给出负例，可能让相近需求被错误路由到不合适模板。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The HTML output hard-codes lang='zh-CN', which imposes a specific language/locale on generated content. The file does not offer a user-selectable locale or explain that the skill is intentionally limited to a Chinese-language/regional context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The tooltip HTML is built by directly interpolating untrusted values such as dimensions, metrics, titles, subtitles, and table rows into HTML strings without escaping. If any of those fields can be influenced by users, upstream datasets, or external integrations, an attacker could inject script-bearing markup or event handlers and trigger DOM-based XSS when the tooltip renders.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML declares lang="zh-CN", and the surrounding generated content and CLI/docstrings are also fixed in Chinese. The policy for this category flags language or locale constraints when the skill forces a specific language without user opt-in or configuration.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstrings and module header describe '交互组件', '切片器 - 多维度筛选', and '按钮与导航器 - 报表页面跳转', which imply functioning interactive filtering and page navigation. In practice, these classes only draw visual representations into PNG images and return base64 strings, so they do not perform filtering, click handling, or page transitions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code hard-codes <html lang="zh-CN">, which imposes a specific language/locale in generated output. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file is written entirely in Chinese and presents all labels, descriptions, and recommendations in a single required language, with no indication that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written as Chinese-only content and provides fixed Chinese output phrasing for generated insights. There is no indication that the user can choose another language or that the template is intentionally limited to a China-specific or Chinese-language reporting context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file contains user-facing natural-language instructions and descriptions exclusively in Chinese, which can force a specific language/locale on users without opt-in. The policy for SQP-3 applies to all file types and flags language or locale constraints unless the skill offers a choice or clearly documents a justified regional limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file explicitly describes joint probabilities between features and user path dependency, which implies collection and analysis of user interaction sequences. Because this is a markdown skill/template, it should warn users that such analytics may affect privacy and should be performed with appropriate safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file instructs teams to ensure event instrumentation across exposure, click, use, and reuse, and to automatically aggregate health reports weekly. Those behaviors involve collecting and processing user behavior data, but the template provides no warning about privacy, consent, retention, or handling of user data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown template is entirely written in Chinese and presents all labels, guidance, and generated-output framing in a single language. Under the policy, a skill should not force a specific language or locale unless it provides user opt-in or clearly documents a justified region-specific scope, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all headings, descriptions, insights, and recommendations in Chinese, which effectively forces a specific language for users of the skill. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written as a Chinese-only content report format, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific context. This is a natural-language policy concern because it imposes a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill template and instructions are written in Chinese, and the file does not state that language choice is optional or that the skill is intended only for a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template explicitly recommends user profiling, behavior-path analysis, churn prediction, cart-recovery SMS, and personalized outreach, but it provides no privacy notice, consent constraints, retention limits, or lawful-basis guidance. In an agent skill, this can normalize invasive tracking and direct marketing practices that may violate privacy and marketing rules if deployed as-is, especially because the content is operational and prescriptive rather than purely descriptive.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing natural-language content entirely in Chinese, and it does not indicate that the skill is limited to Chinese-speaking users or provide any opt-in language choice. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown template presents all user-facing content in a single language and does not indicate that the user can select another language or that the template is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown template forces a specific language/locale in its natural-language content, and there is no indication that users can opt into another language or that the template is intentionally limited to a Chinese-language context. Under the policy, locale constraints should be optional or explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

{section['title']}

{section['title']}

T09 · Insecure Skill Coding Practices

📊 Data Insight Report

Recommendations

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Vague Triggers

Vague Triggers

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis