inventory-anomaly

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:41 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent local inventory-analysis template, with bounded file writes and normal data-science dependencies but no evidence of exfiltration, hidden persistence, or agent hijacking.

Install only in a project workspace, use copies of real inventory spreadsheets, and consider pinning reviewed dependency versions before operational use. Expect Chinese-language inputs/outputs and local files under data/ and output/.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a domain-specific system generator for inventory anomaly detection and demand forecasting. However, the supplied code merely scaffolds a folder structure for a project. While project scaffolding could be a small supporting part of building such a system, this chunk does not contain any inventory-specific behavior or generation logic beyond naming the default project 'inventory-system'. The primary purpose of the code is generic filesystem structure creation, which is materially narrower and different from the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a domain-specific inventory analytics and forecasting system generator. However, the supplied code does not implement any inventory management, anomaly detection, forecasting, Excel handling, alerts, or reporting. Its sole purpose is generic validation of a skill's metadata file (SKILL.md), including YAML parsing and schema-like checks on frontmatter fields. This is a materially different primary purpose, so the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个较完整的“库存异常检测和需求预测系统生成工具”，核心能力应包括库存管理系统搭建、异常检测、需求预测、预警和报告输出。实际代码行为则是一个数据生成脚本：使用 pandas/numpy 构造配件信息、库存表和订单历史，写入 Excel 文件，并输出一些预设分布统计。虽然生成的数据包含缺货、低库存、超量库存和近期需求升高等模式，可用于后续测试异常检测/预测系统，但代码本身并没有执行这些分析或系统生成功能。因此其主要用途与声明明显不一致，属于描述与行为不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All user-facing documentation in this file is presented only in Chinese, effectively forcing a specific language for users. Under the stated policy, a fixed language requirement should either provide user opt-in/choice or clearly document a justified locale-specific scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs creation and use of local files and Excel workbooks, plus writing reports, but it does not declare any explicit tool scope or permissions. This is dangerous because an agent may perform file reads and writes without clear least-privilege boundaries, increasing the risk of unintended access to sensitive local data or modification of user files when the skill is invoked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and the full markdown instructions require Chinese comprehension, but the file does not state that the skill is intentionally limited to Chinese-speaking users or offer an opt-in language selection. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains multiple hard-coded Chinese field names and recommendation strings used in returned results, such as 配件ID, 异常类型, 严重缺货, and 立即补货. That imposes a specific language/locale in user-facing output with no opt-in or documented justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The demand anomaly results and summary keys are also emitted exclusively in Chinese, including 需求异常跳升, 需求异常增加，建议增加备货, 库存异常, and 总计. Because the file provides no language-selection mechanism or documented regional limitation, this is a policy-relevant locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The save_data method writes all in-memory dataframes back to the original Excel path, which can overwrite user data. In this code, there is no confirmation prompt, logging/print statement, or explanatory comment/docstring disclosing that the operation rewrites the workbook.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This file embeds Chinese column names and response keys such as '日期', '数量', and '月均需求' directly in the implementation. That creates a language/locale constraint with no user opt-in or documented justification, which matches the policy category for forced language behavior.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file contains natural-language content such as column names and printed status messages entirely in Chinese, which imposes a specific language on users. The policy allows fixed locale behavior only when the skill offers opt-in or clearly documents a justified regional constraint, neither of which is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill uses Chinese field names and status/warning messages throughout the code, such as '当前库存', '严重缺货', and '库存正常'. This enforces a specific language/locale in user-facing outputs without offering a language choice or documenting that the skill is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits user-facing status messages and report content entirely in Chinese string literals, including the main report and console output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present in this file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a system-generation skill for inventory anomaly detection, demand forecasting, Excel data handling, and report generation. This file also refreshes data via generate_fake_data() and persists execution artifacts by saving a run date and writing output/report.txt, which are additional state-changing behaviors not clearly described in the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code hard-codes user-facing result keys and status/error messages in Chinese, and similar Chinese-only strings recur throughout the file. That creates a language/locale constraint without any user opt-in or documented justification, which matches the policy-violation category for forced language choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file states that the system reads and writes Excel data, which can affect user data on disk. The documentation does not include any caution or disclosure about file modification, backup expectations, or where writes occur, so users are not warned about potential data-impacting behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The markdown asks users to supply real operational data in an Excel file, which may contain sensitive inventory and order history information. There is no accompanying notice about protecting sensitive business data, limiting exposure, or understanding how the skill will process that file.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with only a minimum version, so builds may resolve to different releases over time. This weakens supply-chain control and can lead to accidental installation of vulnerable or incompatible versions, especially in automated or long-lived environments.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pandas>=1.5.0
numpy>=1.21.0
statsmodels>=0.13.0
openpyxl>=3.0.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Because pandas is not pinned, it is impossible to verify from this manifest whether deployment will use a version affected by known advisories. This is a real security risk, though lower severity here because the cited advisory is disputed and no directly vulnerable version is shown.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Using an unpinned numpy version allows package resolution to drift between environments and over time. That increases the chance of consuming a compromised, vulnerable, or breaking upstream release without explicit review.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pandas>=1.5.0
numpy>=1.21.0
statsmodels>=0.13.0
openpyxl>=3.0.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest does not pin numpy, so the package version actually installed could fall into a vulnerable range without visibility. Although the file alone does not prove exploitation, unverifiable versions undermine patch assurance and make security review incomplete.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

statsmodels is declared with a lower bound only, which means the actual installed version is not deterministic. Non-deterministic dependency resolution is a real supply-chain hygiene issue because security posture cannot be reliably assessed or reproduced.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

pandas>=1.5.0
numpy>=1.21.0
statsmodels>=0.13.0
openpyxl>=3.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

openpyxl is also unpinned, so future installs may silently pick newer or affected versions. In a skill that processes Excel files, this matters more because parser libraries are exposed to untrusted document content and should be tightly controlled.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

pandas>=1.5.0
numpy>=1.21.0
statsmodels>=0.13.0
openpyxl>=3.0.0

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

openpyxl has known historical XML-related issues, and the unpinned requirement means the deployed version cannot be verified as safe. This is more concerning in this skill's context because it explicitly handles Excel data, so a parser flaw could be reachable through user-supplied spreadsheets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.