Security audit

Menu Pricing and Profit Optimization Consultant

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local restaurant menu analysis tool, but its browser sales page can mishandle crafted imported data and some pricing-impact labels may mislead decisions.

Install only if you are comfortable processing proprietary restaurant pricing and sales data with a local tool. Do not import sales CSV files from untrusted parties into the HTML page, and treat exported CSV reports as untrusted when opening them in spreadsheet software. Pricing recommendations should be reviewed manually, especially the menu-level impact figures for Puzzle repricing and target-margin scenarios.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: references/sales_entry.html:326
Finding: DOM-Based Cross-Site Scripting Through Imported Sales Data
Content: View full analysis
Dish count
${o.recs.length?new Set(o.recs.map(r=>r.dish)).size:0}

Days
${o.nDays}

Total sales
${o.totalQty}

Daily average
${Math.round(o.avgDaily)}
`; const topRows=o.top.map((d,i)=>`${i+1}${d.dish}${d.qty}${(d.share*100).toFixed(1)}%${Math.round(d.avg)}`).join(''); document.getElementById('topT').innerHTML=`RankDishTotal salesShareDaily average${topRows}`; const slowRows=o.slow.map(d=>`${d.dish}${d.qty}${(d.share*100).toFixed(1)}%${Math.round(d.avg)}`).join(''); document.getElementById('slowT').innerHTML=`DishTotal salesShareDaily average${slowRows}`; document.getElementById('trendNote').innerHTML=o.trendOverall!=null?`Overall daily sales trend: ${o.trendOverall>=0?'up':'down'} ${(Math.abs(o.trendOverall)*100).toFixed(1)}%`:'Insufficient data to determine a trend.'; document.getElementById('catBars').innerHTML=o.catList.map(c=>`
${c.category} ${(c.share*100).toFixed(1)}%

Sales ${c.qty} · ${c.n} dishes · Avera ...[truncated 3369 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/sales_entry.html:401
Finding: Spreadsheet Formula Injection in Exported CSV Reports
Content: View full analysis
`${d.dish},${d.qty},${(d.share*100).toFixed(1)}`).join('\n'); download('menu_sales.csv',s,'text/csv'); } ``` ### Technical Analysis The exported dish name is derived from imported or pasted user-controlled data. It is concatenated directly into CSV output without standards-compliant field quoting or neutralization of spreadsheet formula prefixes. Spreadsheet applications may interpret a cell beginning with `=`, `+`, `-`, or `@` as a formula rather than text. Consequently, a malicious dish name can survive import and analysis, enter the exported CSV unchanged, and be evaluated when the report is opened in compatible spreadsheet software. The implementation also fails to escape commas, quotes, and line breaks, allowing malformed rows or additional attacker-controlled cells to be introduced. ### Attack Path 1. An attacker creates sales data containing a dish name that begins with a spreadsheet formula prefix. 2. A user imports or pastes the data into the HTML analysis page. 3. The user runs the analysis and exports the results through `exportCSV()`. 4. The page writes the malicious dish name directly into `menu_sales.csv`. 5. The user or another recipient opens the report in spreadsheet software. 6. The spreadsheet interprets the dish-name cell as a formula and evaluates it according to the application's security model. ### Impact Assessment The exact impact depends on the spreadsheet application and its security configuration. Potential consequences include: - Opening attacker-controlled links or generating deceptive clickable content. - Exfiltrating information through formula-supported external references or requests. - Manipulating the ...[truncated 430 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 整体上，代码与声明的“利润诊断/菜单工程/战略定价”主方向高度一致，且多数利润模块和专业定价扩展确实实现了。但声明将 Skill 描述为同时覆盖完整“利润模块 + 销量模块”，尤其强调 Excel/CSV 上传、HTML 填表、销量趋势变化、品类占比、时段分布、畅销/滞销统计、联合看板与双报告；这些在代码中并未实现。代码实际上更像是一个专注于菜单利润工程和定价优化的命令行分析器，只带有基础销量字段作为利润计算输入，而不是完整销量分析系统。因此描述对能力范围有明显夸大，属于实质性描述-行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 描述覆盖“利润模块+销量模块”的完整双模块能力，但该代码块只实现了“销量模块”的一个子集。它确实符合描述中的销量分析部分：支持菜单销量数据解析，输出畅销/滞销排名、趋势、品类占比、时段分布和结构化建议报告。然而，描述中占重要地位的利润诊断、菜单工程、BCG 分类、定价优化等核心能力在代码中完全 отсутствуют。代码末尾免责声明还明确说明“本报告…不含成本与利润维度”，这进一步表明其实际主功能明显窄于声明。因此，虽然代码没有表现出危险的未声明越权行为，但声明与实际行为存在实质性能力不匹配，应判定为 mismatch。
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
- `references/sales_entry.html` — **销量数据录入与分析页**（单文件零后端：手动填表 / 粘贴 / 上传 Excel·CSV，浏览器本地出报告，可导出 JSON·CSV）。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.
md
- `references/sales_entry.html` — **销量数据录入与分析页**（单文件零后端：手动填表 / 粘贴 / 上传 Excel·CSV，浏览器本地出报告，可导出 JSON·CSV）。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
md
- `references/sales_entry.html` — **销量数据录入与分析页**（单文件零后端：手动填表 / 粘贴 / 上传 Excel·CSV，浏览器本地出报告，可导出 JSON·CSV）。

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The report tells users the menu-level impact is calculated as if all Puzzle dishes were repriced to target gross margin, but it actually reuses an unrelated aggregate from earlier recommendation logic. In a pricing-advice skill, this creates materially misleading output that can drive incorrect pricing decisions at scale; the domain context makes the integrity issue more dangerous because users are likely to rely on the report for operational decisions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the agent to read and write local files (for example, saving input to /tmp and reading generated JSON/Markdown) but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance of overbroad file access if the hosting platform infers or grants generic file capabilities, especially because the workflow is built around filesystem operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest display name and the entire instruction set are written solely in Chinese, and the skill repeatedly prescribes fixed Chinese phrasing and output conventions without indicating that the user may choose another language. This creates a locale constraint without opt-in or justification as a region-specific compliance requirement.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation phrases are broad, natural-language business queries that could cause the skill to trigger unintentionally in unrelated conversations about pricing, analysis, or menu strategy. Overbroad invocation can expose user data to the wrong workflow, cause unwanted file-processing behavior, or crowd out safer/more appropriate skills in multi-skill environments.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This methodology file presents all instructional content in Chinese and does not indicate that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is in scope for all file types.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JSON file contains user-facing natural-language content in a single forced language/locale, beginning with the period string and continuing throughout labels, findings, verdicts, and actions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown report is written predominantly in Chinese and presents the output format as fixed, with no indication that users may opt into another language. The policy requires flagging language or locale constraints when they are imposed without user choice or a clearly documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This JSON file uses Chinese-only values for key operational fields and dish names, such as "正餐", "一线", and the menu items, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy, a language or locale restriction should either be optional for the user or clearly documented as justified.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s natural-language content is presented exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy criteria, forcing a specific language without user choice can constitute a locale/language policy violation.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file includes natural-language instructions, argument descriptions, validation messages, and report content primarily in Chinese, effectively constraining the skill’s user-facing behavior to a specific language. The file does not indicate any user-selectable locale or language opt-in, which matches the policy violation category for forced language/locale behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: L0649 的注释与输出字段名 menu_delta_cm_puzzle10/menu_net_impact_pct_puzzle10 都表明这是统一按 +10% 计算的菜单级影响。但实际实现使用 d["recommend"]["delta_cm"] 聚合，而 recommend 在 L0455-L0465 会选取可行的最大提价幅度，并不固定为 +10%，与描述的分析口径不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module description and usage indicate the tool is designed around Chinese-language interaction and reporting, and the generated report content is also hard-coded in Chinese. This imposes a specific language/locale on users without any opt-in, fallback, or stated region-specific justification, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file sets the page language to "zh-CN", and the visible UI text throughout the document is exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language locale policy violation unless the restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file contains only Chinese headers and dish names, which can be interpreted as enforcing a specific language/locale without any documented user opt-in or justification. The policy for this review flags natural-language locale constraints across all file types, including data/config-style files when they embed user-facing language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown report is presented with a Chinese title and bilingual Chinese-first headings, but it does not state that the language choice is optional or limited to a specific regional/compliance context. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide explicitly asks users to send detailed menu cost, pricing, and sales data, which can constitute sensitive business information, but it provides no warning about confidentiality, minimization, retention, or who can access the data. In a business-advisory skill, this increases the risk of oversharing proprietary operational data and may lead users to disclose more than necessary.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.