T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/compare_bom.py:143- Finding
Formula Injection in BOM Comparison Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
bom-toolkit
Security checks for vulnerabilities and agentic risk
Overview
This is a local BOM spreadsheet toolkit with some hardening gaps, but no evidence of hidden, deceptive, persistent, or exfiltrating behavior.
Use this skill for local BOM Excel processing, but treat supplier workbooks as untrusted. Before opening generated reports from untrusted inputs, consider sanitizing formula-like cell values, and install dependencies from a pinned, trusted environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract_bom.py:140- Finding
Formula Injection in Merged and Split BOM Workbooks
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/compare_bom.py:18- Finding
Unpinned Dependency Installation Guidance in BOM Comparison Script
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/extract_bom.py:16- Finding
Unpinned Dependency Installation Guidance in BOM Extraction Script
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code chunk only implements BOM version comparison and report export. It loads Excel BOMs, detects row-level additions/deletions and field-level differences, and outputs an Excel report with color highlighting. The declared description presents a much broader toolkit covering the full BOM lifecycle, including integrity validation, mechanical/electrical splitting, supplier merging, and generation of change explanations. None of those additional capabilities appear in this code. While '版本对比' is accurately represented, the overall declared purpose materially overstates the implemented functionality of the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code only implements two of the declared functions: supplier BOM merging and mechanical/electrical splitting. It does not perform completeness checks, version diffs, or generate change explanations, which are specifically called out in the declared description. There are no suspicious undeclared capabilities beyond local Excel file I/O needed for the implemented features, but the declared description materially overstates the functionality present in this code chunk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is entirely Chinese-language in its user-facing description and operational guidance, and it does not state that the skill is region-specific or provide any opt-in for language preference. Under the policy, forcing a specific language without user choice is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script's user-facing documentation and examples are entirely in Chinese, and the CLI help strings later in the file also enforce Chinese-language interaction. Under the policy, locale/language constraints should be optional or explicitly justified; this file does not provide an opt-in choice or explain why Chinese-only usage is required.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The argparse description and help text are presented only in Chinese, which constrains interaction to a specific language. The file does not provide an alternative locale, opt-in behavior, or a documented regional justification.
- Content
Static analysis
No suspicious patterns detected.